[STATEMENT]
lemma r_distinguishable_k_least_Suc_correctness :
  assumes  "r_distinguishable_k_least M q1 q2 n = Some (Suc k,x)"
  shows "r_distinguishable_k M q1 q2 (Suc k) \<and> (Suc k) =
          (LEAST k . r_distinguishable_k M q1 q2 k)
          \<and> (x \<in> (inputs M) \<and> (\<forall> t1 \<in> transitions M . \<forall> t2 \<in> transitions M . (t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2) \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
          \<and> (\<forall> x' \<in> (inputs M) . x' < x \<longrightarrow> \<not>(\<forall> t1 \<in> transitions M . \<forall> t2 \<in> transitions M . (t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2) \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST k. r_distinguishable_k M q1 q2 k) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
r_distinguishable_k_least M q1 q2 n = Some (Suc k, x)

goal (1 subgoal):
 1. r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST k. r_distinguishable_k M q1 q2 k) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
proof (induction n)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. r_distinguishable_k_least M q1 q2 0 = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = Least (r_distinguishable_k M q1 q2) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
 2. \<And>n. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = Least (r_distinguishable_k M q1 q2) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x)\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = Least (r_distinguishable_k M q1 q2) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
case 0
[PROOF STATE]
proof (state)
this:
r_distinguishable_k_least M q1 q2 0 = Some (Suc k, x)

goal (2 subgoals):
 1. r_distinguishable_k_least M q1 q2 0 = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = Least (r_distinguishable_k M q1 q2) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
 2. \<And>n. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = Least (r_distinguishable_k M q1 q2) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x)\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = Least (r_distinguishable_k M q1 q2) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
r_distinguishable_k_least M q1 q2 0 = Some (Suc k, x)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
r_distinguishable_k_least M q1 q2 0 = Some (Suc k, x)

goal (1 subgoal):
 1. r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
by (cases " find
         (\<lambda>x. \<not> (\<exists>t1\<in>(transitions M).
                     \<exists>t2\<in>(transitions M).
                        t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2))
         (sort (inputs_as_list M))"; auto)
[PROOF STATE]
proof (state)
this:
r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))

goal (1 subgoal):
 1. \<And>n. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = Least (r_distinguishable_k M q1 q2) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x)\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = Least (r_distinguishable_k M q1 q2) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = Least (r_distinguishable_k M q1 q2) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x)\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = Least (r_distinguishable_k M q1 q2) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
case (Suc n)
[PROOF STATE]
proof (state)
this:
r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x)

goal (1 subgoal):
 1. \<And>n. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = Least (r_distinguishable_k M q1 q2) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x)\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = Least (r_distinguishable_k M q1 q2) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x)

goal (1 subgoal):
 1. r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
proof (cases "r_distinguishable_k_least M q1 q2 n")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = None\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
 2. \<And>a. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = Some a\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
case None
[PROOF STATE]
proof (state)
this:
r_distinguishable_k_least M q1 q2 n = None

goal (2 subgoals):
 1. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = None\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
 2. \<And>a. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = Some a\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
r_distinguishable_k_least M q1 q2 n = None
[PROOF STEP]
have *: "(case find (\<lambda> x . \<forall> t1 \<in> transitions M . \<forall> t2 \<in> transitions M . (t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2) \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n) (sort (inputs_as_list M)) of
      Some x \<Rightarrow> Some (Suc n,x) |
      None \<Rightarrow> None) = Some (Suc k,x)"
[PROOF STATE]
proof (prove)
using this:
r_distinguishable_k_least M q1 q2 n = None

goal (1 subgoal):
 1. (case find (\<lambda>x. \<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n) (sort (inputs_as_list M)) of None \<Rightarrow> None | Some x \<Rightarrow> Some (Suc n, x)) = Some (Suc k, x)
[PROOF STEP]
using Suc.prems
[PROOF STATE]
proof (prove)
using this:
r_distinguishable_k_least M q1 q2 n = None
r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x)

goal (1 subgoal):
 1. (case find (\<lambda>x. \<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n) (sort (inputs_as_list M)) of None \<Rightarrow> None | Some x \<Rightarrow> Some (Suc n, x)) = Some (Suc k, x)
[PROOF STEP]
unfolding r_distinguishable_k_least.simps
[PROOF STATE]
proof (prove)
using this:
r_distinguishable_k_least M q1 q2 n = None
(case r_distinguishable_k_least M q1 q2 n of None \<Rightarrow> case find (\<lambda>x. \<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n) (sort (inputs_as_list M)) of None \<Rightarrow> None | Some x \<Rightarrow> Some (Suc n, x) | Some x \<Rightarrow> Some x) = Some (Suc k, x)

goal (1 subgoal):
 1. (case find (\<lambda>x. \<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n) (sort (inputs_as_list M)) of None \<Rightarrow> None | Some x \<Rightarrow> Some (Suc n, x)) = Some (Suc k, x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(case find (\<lambda>x. \<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n) (sort (inputs_as_list M)) of None \<Rightarrow> None | Some x \<Rightarrow> Some (Suc n, x)) = Some (Suc k, x)

goal (2 subgoals):
 1. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = None\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
 2. \<And>a. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = Some a\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(case find (\<lambda>x. \<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n) (sort (inputs_as_list M)) of None \<Rightarrow> None | Some x \<Rightarrow> Some (Suc n, x)) = Some (Suc k, x)
[PROOF STEP]
obtain x' where x'_def : "find (\<lambda> x . \<forall> t1 \<in> transitions M . \<forall> t2 \<in> transitions M . (t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2) \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n) (sort (inputs_as_list M)) =  Some x'"
[PROOF STATE]
proof (prove)
using this:
(case find (\<lambda>x. \<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n) (sort (inputs_as_list M)) of None \<Rightarrow> None | Some x \<Rightarrow> Some (Suc n, x)) = Some (Suc k, x)

goal (1 subgoal):
 1. (\<And>x'. find (\<lambda>x. \<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n) (sort (inputs_as_list M)) = Some x' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
find (\<lambda>x. \<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n) (sort (inputs_as_list M)) = Some x'

goal (2 subgoals):
 1. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = None\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
 2. \<And>a. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = Some a\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
find (\<lambda>x. \<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n) (sort (inputs_as_list M)) = Some x'
[PROOF STEP]
have "x = x'"
[PROOF STATE]
proof (prove)
using this:
find (\<lambda>x. \<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n) (sort (inputs_as_list M)) = Some x'

goal (1 subgoal):
 1. x = x'
[PROOF STEP]
using *
[PROOF STATE]
proof (prove)
using this:
find (\<lambda>x. \<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n) (sort (inputs_as_list M)) = Some x'
(case find (\<lambda>x. \<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n) (sort (inputs_as_list M)) of None \<Rightarrow> None | Some x \<Rightarrow> Some (Suc n, x)) = Some (Suc k, x)

goal (1 subgoal):
 1. x = x'
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
x = x'

goal (2 subgoals):
 1. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = None\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
 2. \<And>a. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = Some a\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
x = x'
[PROOF STEP]
have p3: "x \<in> (inputs M) \<and> (\<forall> t1 \<in> transitions M . \<forall> t2 \<in> transitions M . (t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2) \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n)"
[PROOF STATE]
proof (prove)
using this:
x = x'

goal (1 subgoal):
 1. x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n)
[PROOF STEP]
using find_condition[OF x'_def] find_set[OF x'_def] set_sort inputs_as_list_set
[PROOF STATE]
proof (prove)
using this:
x = x'
\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n
x' \<in> set (sort (inputs_as_list M))
set (sort_key ?f ?xs) = set ?xs
set (inputs_as_list ?M) = FSM.inputs ?M

goal (1 subgoal):
 1. x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n)
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n)

goal (2 subgoals):
 1. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = None\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
 2. \<And>a. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = Some a\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n)
[PROOF STEP]
have p1: "r_distinguishable_k M q1 q2 (Suc n)"
[PROOF STATE]
proof (prove)
using this:
x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n)

goal (1 subgoal):
 1. r_distinguishable_k M q1 q2 (Suc n)
[PROOF STEP]
unfolding r_distinguishable_k.simps
[PROOF STATE]
proof (prove)
using this:
x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n)

goal (1 subgoal):
 1. r_distinguishable_k M q1 q2 n \<or> (\<exists>x\<in>FSM.inputs M. \<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
r_distinguishable_k M q1 q2 (Suc n)

goal (2 subgoals):
 1. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = None\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
 2. \<And>a. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = Some a\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
r_distinguishable_k M q1 q2 (Suc n)

goal (2 subgoals):
 1. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = None\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
 2. \<And>a. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = Some a\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
have "\<not> r_distinguishable_k M q1 q2 n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> r_distinguishable_k M q1 q2 n
[PROOF STEP]
using r_distinguishable_k_least_ex[OF None]
[PROOF STATE]
proof (prove)
using this:
\<not> r_distinguishable_k M q1 q2 n

goal (1 subgoal):
 1. \<not> r_distinguishable_k M q1 q2 n
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
\<not> r_distinguishable_k M q1 q2 n

goal (2 subgoals):
 1. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = None\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
 2. \<And>a. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = Some a\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
r_distinguishable_k M q1 q2 (Suc n)
\<not> r_distinguishable_k M q1 q2 n
[PROOF STEP]
have p2: "(Suc n) = (LEAST k . r_distinguishable_k M q1 q2 k)"
[PROOF STATE]
proof (prove)
using this:
r_distinguishable_k M q1 q2 (Suc n)
\<not> r_distinguishable_k M q1 q2 n

goal (1 subgoal):
 1. Suc n = (LEAST k. r_distinguishable_k M q1 q2 k)
[PROOF STEP]
by (metis LeastI Least_le le_SucE r_distinguishable_k_by_larger)
[PROOF STATE]
proof (state)
this:
Suc n = (LEAST k. r_distinguishable_k M q1 q2 k)

goal (2 subgoals):
 1. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = None\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
 2. \<And>a. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = Some a\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
from *
[PROOF STATE]
proof (chain)
picking this:
(case find (\<lambda>x. \<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n) (sort (inputs_as_list M)) of None \<Rightarrow> None | Some x \<Rightarrow> Some (Suc n, x)) = Some (Suc k, x)
[PROOF STEP]
have "k = n"
[PROOF STATE]
proof (prove)
using this:
(case find (\<lambda>x. \<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n) (sort (inputs_as_list M)) of None \<Rightarrow> None | Some x \<Rightarrow> Some (Suc n, x)) = Some (Suc k, x)

goal (1 subgoal):
 1. k = n
[PROOF STEP]
using x'_def
[PROOF STATE]
proof (prove)
using this:
(case find (\<lambda>x. \<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n) (sort (inputs_as_list M)) of None \<Rightarrow> None | Some x \<Rightarrow> Some (Suc n, x)) = Some (Suc k, x)
find (\<lambda>x. \<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n) (sort (inputs_as_list M)) = Some x'

goal (1 subgoal):
 1. k = n
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
k = n

goal (2 subgoals):
 1. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = None\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
 2. \<And>a. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = Some a\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
k = n
[PROOF STEP]
have "(\<forall> x' \<in> (inputs M) . x' < x \<longrightarrow> \<not>(\<forall> t1 \<in> transitions M . \<forall> t2 \<in> transitions M . (t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2) \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))"
[PROOF STATE]
proof (prove)
using this:
k = n

goal (1 subgoal):
 1. \<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)
[PROOF STEP]
using find_sort_least(1)[OF x'_def] \<open>x = x'\<close> inputs_as_list_set
[PROOF STATE]
proof (prove)
using this:
k = n
\<forall>x'a\<in>set (inputs_as_list M). x' \<le> x'a \<or> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x'a \<and> t_input t2 = x'a \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n)
x = x'
set (inputs_as_list ?M) = FSM.inputs ?M

goal (1 subgoal):
 1. \<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)
[PROOF STEP]
using leD
[PROOF STATE]
proof (prove)
using this:
k = n
\<forall>x'a\<in>set (inputs_as_list M). x' \<le> x'a \<or> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x'a \<and> t_input t2 = x'a \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n)
x = x'
set (inputs_as_list ?M) = FSM.inputs ?M
?y \<le> ?x \<Longrightarrow> \<not> ?x < ?y

goal (1 subgoal):
 1. \<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)

goal (2 subgoals):
 1. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = None\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
 2. \<And>a. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = Some a\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)

goal (1 subgoal):
 1. r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
using p1 p2 p3 \<open>k = n\<close>
[PROOF STATE]
proof (prove)
using this:
\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)
r_distinguishable_k M q1 q2 (Suc n)
Suc n = (LEAST k. r_distinguishable_k M q1 q2 k)
x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) n)
k = n

goal (1 subgoal):
 1. r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))

goal (1 subgoal):
 1. \<And>a. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = Some a\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = Some a\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
case (Some a)
[PROOF STATE]
proof (state)
this:
r_distinguishable_k_least M q1 q2 n = Some a

goal (1 subgoal):
 1. \<And>a. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = Some a\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
r_distinguishable_k_least M q1 q2 n = Some a
[PROOF STEP]
have "r_distinguishable_k_least M q1 q2 n = Some (Suc k, x)"
[PROOF STATE]
proof (prove)
using this:
r_distinguishable_k_least M q1 q2 n = Some a

goal (1 subgoal):
 1. r_distinguishable_k_least M q1 q2 n = Some (Suc k, x)
[PROOF STEP]
using Suc.prems
[PROOF STATE]
proof (prove)
using this:
r_distinguishable_k_least M q1 q2 n = Some a
r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x)

goal (1 subgoal):
 1. r_distinguishable_k_least M q1 q2 n = Some (Suc k, x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
r_distinguishable_k_least M q1 q2 n = Some (Suc k, x)

goal (1 subgoal):
 1. \<And>a. \<lbrakk>r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)); r_distinguishable_k_least M q1 q2 (Suc n) = Some (Suc k, x); r_distinguishable_k_least M q1 q2 n = Some a\<rbrakk> \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
r_distinguishable_k_least M q1 q2 n = Some (Suc k, x)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
r_distinguishable_k_least M q1 q2 n = Some (Suc k, x)

goal (1 subgoal):
 1. r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
using Suc.IH
[PROOF STATE]
proof (prove)
using this:
r_distinguishable_k_least M q1 q2 n = Some (Suc k, x)
r_distinguishable_k_least M q1 q2 n = Some (Suc k, x) \<Longrightarrow> r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))

goal (1 subgoal):
 1. r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))
[PROOF STEP]
by (meson r_distinguishable_k.simps(2))
[PROOF STATE]
proof (state)
this:
r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
r_distinguishable_k M q1 q2 (Suc k) \<and> Suc k = (LEAST a. r_distinguishable_k M q1 q2 a) \<and> (x \<in> FSM.inputs M \<and> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x \<and> t_input t2 = x \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k)) \<and> (\<forall>x'\<in>FSM.inputs M. x' < x \<longrightarrow> \<not> (\<forall>t1\<in>FSM.transitions M. \<forall>t2\<in>FSM.transitions M. t_source t1 = q1 \<and> t_source t2 = q2 \<and> t_input t1 = x' \<and> t_input t2 = x' \<and> t_output t1 = t_output t2 \<longrightarrow> r_distinguishable_k M (t_target t1) (t_target t2) k))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
theorem mono_imp_fp_complete:
  assumes comp: "UNIV-complete A (\<sqsubseteq>)"
    and f: "f ` A \<subseteq> A" and mono: "monotone_on A (\<sqsubseteq>) (\<sqsubseteq>) f"
  shows "UNIV-complete {p \<in> A. f p = p} (\<sqsubseteq>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. UNIV-complete {p \<in> A. f p = p} (\<sqsubseteq>)
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. UNIV-complete {p \<in> A. f p = p} (\<sqsubseteq>)
[PROOF STEP]
interpret fixed_point_proof
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fixed_point_proof A f
[PROOF STEP]
using f
[PROOF STATE]
proof (prove)
using this:
f ` A \<subseteq> A

goal (1 subgoal):
 1. fixed_point_proof A f
[PROOF STEP]
by unfold_locales
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. UNIV-complete {p \<in> A. f p = p} (\<sqsubseteq>)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. UNIV-complete {p \<in> A. f p = p} (\<sqsubseteq>)
[PROOF STEP]
apply (intro antisym_mono_imp_fp_complete mono antisymmetric_axioms comp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<forall>C\<subseteq>A. well_related_set C (\<sqsubseteq>) \<longrightarrow> C \<in> UNIV
 2. \<forall>X\<in>UNIV. \<forall>Y\<in>UNIV. X \<sqsubseteq>\<^sup>s Y \<longrightarrow> X \<union> Y \<in> UNIV
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
UNIV-complete {p \<in> A. f p = p} (\<sqsubseteq>)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma finite_Collect: "finite S \<Longrightarrow> inj f \<Longrightarrow> finite {a. f a : S}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>finite S; inj f\<rbrakk> \<Longrightarrow> finite {a. f a \<in> S}
[PROOF STEP]
by(simp add: finite_vimageI vimage_def[symmetric])

  \<comment> \<open>Finite sets have an injective mapping to an initial segments of the
      natural numbers\<close>


[STATEMENT]
lemma (in linorder_topology) tendsto_le:
  assumes F: "\<not> trivial_limit F"
    and x: "(f \<longlongrightarrow> x) F"
    and y: "(g \<longlongrightarrow> y) F"
    and ev: "eventually (\<lambda>x. g x \<le> f x) F"
  shows "y \<le> x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. y \<le> x
[PROOF STEP]
proof (rule ccontr)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> y \<le> x \<Longrightarrow> False
[PROOF STEP]
assume "\<not> y \<le> x"
[PROOF STATE]
proof (state)
this:
\<not> y \<le> x

goal (1 subgoal):
 1. \<not> y \<le> x \<Longrightarrow> False
[PROOF STEP]
with less_separate[of x y]
[PROOF STATE]
proof (chain)
picking this:
x < y \<Longrightarrow> \<exists>a b. x \<in> {..<a} \<and> y \<in> {b<..} \<and> {..<a} \<inter> {b<..} = {}
\<not> y \<le> x
[PROOF STEP]
obtain a b where xy: "x < a" "b < y" "{..<a} \<inter> {b<..} = {}"
[PROOF STATE]
proof (prove)
using this:
x < y \<Longrightarrow> \<exists>a b. x \<in> {..<a} \<and> y \<in> {b<..} \<and> {..<a} \<inter> {b<..} = {}
\<not> y \<le> x

goal (1 subgoal):
 1. (\<And>a b. \<lbrakk>x < a; b < y; {..<a} \<inter> {b<..} = {}\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (auto simp: not_le)
[PROOF STATE]
proof (state)
this:
x < a
b < y
{..<a} \<inter> {b<..} = {}

goal (1 subgoal):
 1. \<not> y \<le> x \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
x < a
b < y
{..<a} \<inter> {b<..} = {}
[PROOF STEP]
have "eventually (\<lambda>x. f x < a) F" "eventually (\<lambda>x. b < g x) F"
[PROOF STATE]
proof (prove)
using this:
x < a
b < y
{..<a} \<inter> {b<..} = {}

goal (1 subgoal):
 1. \<forall>\<^sub>F x in F. f x < a &&& \<forall>\<^sub>F x in F. b < g x
[PROOF STEP]
using x y
[PROOF STATE]
proof (prove)
using this:
x < a
b < y
{..<a} \<inter> {b<..} = {}
(f \<longlongrightarrow> x) F
(g \<longlongrightarrow> y) F

goal (1 subgoal):
 1. \<forall>\<^sub>F x in F. f x < a &&& \<forall>\<^sub>F x in F. b < g x
[PROOF STEP]
by (auto intro: order_tendstoD)
[PROOF STATE]
proof (state)
this:
\<forall>\<^sub>F x in F. f x < a
\<forall>\<^sub>F x in F. b < g x

goal (1 subgoal):
 1. \<not> y \<le> x \<Longrightarrow> False
[PROOF STEP]
with ev
[PROOF STATE]
proof (chain)
picking this:
\<forall>\<^sub>F x in F. g x \<le> f x
\<forall>\<^sub>F x in F. f x < a
\<forall>\<^sub>F x in F. b < g x
[PROOF STEP]
have "eventually (\<lambda>x. False) F"
[PROOF STATE]
proof (prove)
using this:
\<forall>\<^sub>F x in F. g x \<le> f x
\<forall>\<^sub>F x in F. f x < a
\<forall>\<^sub>F x in F. b < g x

goal (1 subgoal):
 1. \<forall>\<^sub>F x in F. False
[PROOF STEP]
by eventually_elim (insert xy, fastforce)
[PROOF STATE]
proof (state)
this:
\<forall>\<^sub>F x in F. False

goal (1 subgoal):
 1. \<not> y \<le> x \<Longrightarrow> False
[PROOF STEP]
with F
[PROOF STATE]
proof (chain)
picking this:
F \<noteq> bot
\<forall>\<^sub>F x in F. False
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
F \<noteq> bot
\<forall>\<^sub>F x in F. False

goal (1 subgoal):
 1. False
[PROOF STEP]
by (simp add: eventually_False)
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma (in Module) mr_cos_sprod_one:"\<lbrakk>submodule R M H; X \<in> set_mr_cos M H\<rbrakk> \<Longrightarrow>
                   mr_cos_sprod M H (1\<^sub>r\<^bsub>R\<^esub>) X = X"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>submodule R M H; X \<in> set_mr_cos M H\<rbrakk> \<Longrightarrow> mr_cos_sprod M H 1\<^sub>r\<^bsub>R\<^esub> X = X
[PROOF STEP]
apply (simp add:set_mr_cos_def, erule bexE, simp,
       thin_tac "X = a \<uplus>\<^bsub>M\<^esub> H")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>submodule R M H; a \<in> carrier M\<rbrakk> \<Longrightarrow> mr_cos_sprod M H 1\<^sub>r\<^bsub>R\<^esub> (a \<uplus>\<^bsub>M\<^esub> H) = a \<uplus>\<^bsub>M\<^esub> H
[PROOF STEP]
apply (cut_tac sc_Ring,
        frule Ring.ring_one[of "R"])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>submodule R M H; a \<in> carrier M; Ring R; 1\<^sub>r\<^bsub>R\<^esub> \<in> carrier R\<rbrakk> \<Longrightarrow> mr_cos_sprod M H 1\<^sub>r\<^bsub>R\<^esub> (a \<uplus>\<^bsub>M\<^esub> H) = a \<uplus>\<^bsub>M\<^esub> H
[PROOF STEP]
apply (subst mr_cos_sprodTr, assumption+)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>submodule R M H; a \<in> carrier M; Ring R; 1\<^sub>r\<^bsub>R\<^esub> \<in> carrier R\<rbrakk> \<Longrightarrow> 1\<^sub>r\<^bsub>R\<^esub> \<cdot>\<^sub>s a \<uplus>\<^bsub>M\<^esub> H = a \<uplus>\<^bsub>M\<^esub> H
[PROOF STEP]
apply (simp add:sprod_one)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma positive_proj_fst_k:
  "positive (proj_fst_k k)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. positive (proj_fst_k k)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. positive (proj_fst_k k)
[PROOF STEP]
have "(proj_fst_k k) * adjoint (proj_fst_k k) = (proj_fst_k k)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. proj_fst_k k * adjoint (proj_fst_k k) = proj_fst_k k
[PROOF STEP]
using hermitian_proj_fst_k proj_fst_k_is_projection
[PROOF STATE]
proof (prove)
using this:
adjoint (proj_fst_k ?k) = proj_fst_k ?k
proj_fst_k ?k * proj_fst_k ?k = proj_fst_k ?k

goal (1 subgoal):
 1. proj_fst_k k * adjoint (proj_fst_k k) = proj_fst_k k
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
proj_fst_k k * adjoint (proj_fst_k k) = proj_fst_k k

goal (1 subgoal):
 1. positive (proj_fst_k k)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
proj_fst_k k * adjoint (proj_fst_k k) = proj_fst_k k
[PROOF STEP]
have "\<exists>M. M * adjoint M = (proj_fst_k k)"
[PROOF STATE]
proof (prove)
using this:
proj_fst_k k * adjoint (proj_fst_k k) = proj_fst_k k

goal (1 subgoal):
 1. \<exists>M. M * adjoint M = proj_fst_k k
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>M. M * adjoint M = proj_fst_k k

goal (1 subgoal):
 1. positive (proj_fst_k k)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>M. M * adjoint M = proj_fst_k k
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<exists>M. M * adjoint M = proj_fst_k k

goal (1 subgoal):
 1. positive (proj_fst_k k)
[PROOF STEP]
apply (subst positive_if_decomp)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<exists>M. M * adjoint M = proj_fst_k k \<Longrightarrow> proj_fst_k k \<in> carrier_mat ?n1 ?n1
 2. \<exists>M. M * adjoint M = proj_fst_k k \<Longrightarrow> \<exists>M. M * adjoint M = proj_fst_k k
 3. \<exists>M. M * adjoint M = proj_fst_k k \<Longrightarrow> True
[PROOF STEP]
using proj_fst_k_def
[PROOF STATE]
proof (prove)
using this:
proj_fst_k ?k = mat K K (\<lambda>(i, j). if i = j \<and> i < ?k then 1 else 0)

goal (3 subgoals):
 1. \<exists>M. M * adjoint M = proj_fst_k k \<Longrightarrow> proj_fst_k k \<in> carrier_mat ?n1 ?n1
 2. \<exists>M. M * adjoint M = proj_fst_k k \<Longrightarrow> \<exists>M. M * adjoint M = proj_fst_k k
 3. \<exists>M. M * adjoint M = proj_fst_k k \<Longrightarrow> True
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
positive (proj_fst_k k)

goal:
No subgoals!
[PROOF STEP]
qed