[STATEMENT]
lemma PO_m3_DY_fake_refines_m2_fake:
  "{R23 \<inter> UNIV \<times> m3_inv1_lkeysec}
     m2_fake, m3_DY_fake
   {> R23}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {R23 \<inter> UNIV \<times> m3_inv1_lkeysec} m2_fake, m3_DY_fake {> R23}
[PROOF STEP]
apply (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros
            del: abs_msg.cases)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>a y x. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; y \<in> m3_inv1_lkeysec; x \<in> abs_msg (parts (IK y))\<rbrakk> \<Longrightarrow> x \<in> fake ik0 (dom (runs a)) (chan a)
 2. \<And>a y x. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; y \<in> m3_inv1_lkeysec; x \<in> abs_msg (synth (analz (IK y)))\<rbrakk> \<Longrightarrow> x \<in> fake ik0 (dom (runs a)) (chan a)
 3. \<And>a y KK K. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; y \<in> m3_inv1_lkeysec; KK \<subseteq> range sesK; Key K \<in> analz (Key ` KK \<union> IK y)\<rbrakk> \<Longrightarrow> aKey K \<in> extr (aKey ` KK \<union> ik0) (chan a)
 4. \<And>a y KK K. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; y \<in> m3_inv1_lkeysec; KK \<subseteq> range sesK; Key K \<in> analz (IK y)\<rbrakk> \<Longrightarrow> aKey K \<in> extr (aKey ` KK \<union> ik0) (chan a)
 5. \<And>a y KK N. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; y \<in> m3_inv1_lkeysec; KK \<subseteq> range sesK; Nonce N \<in> analz (Key ` KK \<union> IK y)\<rbrakk> \<Longrightarrow> aNon N \<in> extr (aKey ` KK \<union> ik0) (chan a)
 6. \<And>a y KK N. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; y \<in> m3_inv1_lkeysec; KK \<subseteq> range sesK; Nonce N \<in> analz (IK y)\<rbrakk> \<Longrightarrow> aNon N \<in> extr (aKey ` KK \<union> ik0) (chan a)
[PROOF STEP]
apply (auto intro: abs_msg_DY_subset_fakeable [THEN subsetD]
            del: abs_msg.cases)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a y KK K. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; y \<in> m3_inv1_lkeysec; KK \<subseteq> range sesK; Key K \<in> analz (IK y)\<rbrakk> \<Longrightarrow> aKey K \<in> extr (aKey ` KK \<union> ik0) (chan a)
 2. \<And>a y KK N. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; y \<in> m3_inv1_lkeysec; KK \<subseteq> range sesK; Nonce N \<in> analz (IK y)\<rbrakk> \<Longrightarrow> aNon N \<in> extr (aKey ` KK \<union> ik0) (chan a)
[PROOF STEP]
apply (auto simp add: R23_simps)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma Up_To_Technique:
"\<lbrakk> disj_dlHPP_Bisimulation_Up_To_R' d PP R' R;
  Arefl R \<inter> Arefl R' \<subseteq> {[]} \<rbrakk>
  \<Longrightarrow> SdlHPPB d PP (R \<union> R')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>disj_dlHPP_Bisimulation_Up_To_R' d PP R' R; Arefl R \<inter> Arefl R' \<subseteq> {[]}\<rbrakk> \<Longrightarrow> SdlHPPB d PP (R \<union> R')
[PROOF STEP]
proof (simp add: disj_dlHPP_Bisimulation_Up_To_R'_def
    Strong_dlHPP_Bisimulation_def, auto)
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2')\<rbrakk> \<Longrightarrow> sym (R \<union> R')
 2. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2')\<rbrakk> \<Longrightarrow> trans (R \<union> R')
 3. \<And>a b i m1 m1' m2 \<alpha> p. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); i < length a; \<langle>a ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>; m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'; (a, b) \<in> R'\<rbrakk> \<Longrightarrow> \<exists>p' \<alpha>' m2'. \<langle>b ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (a ! i)) m2 m2'
[PROOF STEP]
assume symR': "sym R'"
[PROOF STATE]
proof (state)
this:
sym R'

goal (3 subgoals):
 1. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2')\<rbrakk> \<Longrightarrow> sym (R \<union> R')
 2. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2')\<rbrakk> \<Longrightarrow> trans (R \<union> R')
 3. \<And>a b i m1 m1' m2 \<alpha> p. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); i < length a; \<langle>a ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>; m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'; (a, b) \<in> R'\<rbrakk> \<Longrightarrow> \<exists>p' \<alpha>' m2'. \<langle>b ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (a ! i)) m2 m2'
[PROOF STEP]
assume symR: "sym R"
[PROOF STATE]
proof (state)
this:
sym R

goal (3 subgoals):
 1. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2')\<rbrakk> \<Longrightarrow> sym (R \<union> R')
 2. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2')\<rbrakk> \<Longrightarrow> trans (R \<union> R')
 3. \<And>a b i m1 m1' m2 \<alpha> p. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); i < length a; \<langle>a ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>; m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'; (a, b) \<in> R'\<rbrakk> \<Longrightarrow> \<exists>p' \<alpha>' m2'. \<langle>b ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (a ! i)) m2 m2'
[PROOF STEP]
with symR'
[PROOF STATE]
proof (chain)
picking this:
sym R'
sym R
[PROOF STEP]
show "sym (R \<union> R')"
[PROOF STATE]
proof (prove)
using this:
sym R'
sym R

goal (1 subgoal):
 1. sym (R \<union> R')
[PROOF STEP]
by (simp add: sym_def)
[PROOF STATE]
proof (state)
this:
sym (R \<union> R')

goal (2 subgoals):
 1. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2')\<rbrakk> \<Longrightarrow> trans (R \<union> R')
 2. \<And>a b i m1 m1' m2 \<alpha> p. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); i < length a; \<langle>a ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>; m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'; (a, b) \<in> R'\<rbrakk> \<Longrightarrow> \<exists>p' \<alpha>' m2'. \<langle>b ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (a ! i)) m2 m2'
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2')\<rbrakk> \<Longrightarrow> trans (R \<union> R')
 2. \<And>a b i m1 m1' m2 \<alpha> p. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); i < length a; \<langle>a ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>; m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'; (a, b) \<in> R'\<rbrakk> \<Longrightarrow> \<exists>p' \<alpha>' m2'. \<langle>b ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (a ! i)) m2 m2'
[PROOF STEP]
assume symR': "sym R'"
[PROOF STATE]
proof (state)
this:
sym R'

goal (2 subgoals):
 1. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2')\<rbrakk> \<Longrightarrow> trans (R \<union> R')
 2. \<And>a b i m1 m1' m2 \<alpha> p. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); i < length a; \<langle>a ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>; m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'; (a, b) \<in> R'\<rbrakk> \<Longrightarrow> \<exists>p' \<alpha>' m2'. \<langle>b ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (a ! i)) m2 m2'
[PROOF STEP]
assume symR: "sym R"
[PROOF STATE]
proof (state)
this:
sym R

goal (2 subgoals):
 1. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2')\<rbrakk> \<Longrightarrow> trans (R \<union> R')
 2. \<And>a b i m1 m1' m2 \<alpha> p. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); i < length a; \<langle>a ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>; m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'; (a, b) \<in> R'\<rbrakk> \<Longrightarrow> \<exists>p' \<alpha>' m2'. \<langle>b ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (a ! i)) m2 m2'
[PROOF STEP]
assume transR': "trans R'"
[PROOF STATE]
proof (state)
this:
trans R'

goal (2 subgoals):
 1. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2')\<rbrakk> \<Longrightarrow> trans (R \<union> R')
 2. \<And>a b i m1 m1' m2 \<alpha> p. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); i < length a; \<langle>a ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>; m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'; (a, b) \<in> R'\<rbrakk> \<Longrightarrow> \<exists>p' \<alpha>' m2'. \<langle>b ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (a ! i)) m2 m2'
[PROOF STEP]
assume transR: "trans R"
[PROOF STATE]
proof (state)
this:
trans R

goal (2 subgoals):
 1. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2')\<rbrakk> \<Longrightarrow> trans (R \<union> R')
 2. \<And>a b i m1 m1' m2 \<alpha> p. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); i < length a; \<langle>a ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>; m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'; (a, b) \<in> R'\<rbrakk> \<Longrightarrow> \<exists>p' \<alpha>' m2'. \<langle>b ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (a ! i)) m2 m2'
[PROOF STEP]
assume eqlenR': "\<forall>(V, V')\<in>R'. length V = length V'"
[PROOF STATE]
proof (state)
this:
\<forall>(V, V')\<in>R'. length V = length V'

goal (2 subgoals):
 1. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2')\<rbrakk> \<Longrightarrow> trans (R \<union> R')
 2. \<And>a b i m1 m1' m2 \<alpha> p. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); i < length a; \<langle>a ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>; m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'; (a, b) \<in> R'\<rbrakk> \<Longrightarrow> \<exists>p' \<alpha>' m2'. \<langle>b ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (a ! i)) m2 m2'
[PROOF STEP]
assume eqlenR: "\<forall>(V, V')\<in>R. length V = length V'"
[PROOF STATE]
proof (state)
this:
\<forall>(V, V')\<in>R. length V = length V'

goal (2 subgoals):
 1. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2')\<rbrakk> \<Longrightarrow> trans (R \<union> R')
 2. \<And>a b i m1 m1' m2 \<alpha> p. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); i < length a; \<langle>a ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>; m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'; (a, b) \<in> R'\<rbrakk> \<Longrightarrow> \<exists>p' \<alpha>' m2'. \<langle>b ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (a ! i)) m2 m2'
[PROOF STEP]
assume areflassump: "Arefl R \<inter> Arefl R' \<subseteq> {[]}"
[PROOF STATE]
proof (state)
this:
Arefl R \<inter> Arefl R' \<subseteq> {[]}

goal (2 subgoals):
 1. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2')\<rbrakk> \<Longrightarrow> trans (R \<union> R')
 2. \<And>a b i m1 m1' m2 \<alpha> p. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); i < length a; \<langle>a ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>; m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'; (a, b) \<in> R'\<rbrakk> \<Longrightarrow> \<exists>p' \<alpha>' m2'. \<langle>b ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (a ! i)) m2 m2'
[PROOF STEP]
from symR' symR transR' transR eqlenR' eqlenR areflassump trans_RuR'
[PROOF STATE]
proof (chain)
picking this:
sym R'
sym R
trans R'
trans R
\<forall>(V, V')\<in>R'. length V = length V'
\<forall>(V, V')\<in>R. length V = length V'
Arefl R \<inter> Arefl R' \<subseteq> {[]}
\<lbrakk>trans ?R; sym ?R; trans ?R'; sym ?R'; \<forall>(V, V')\<in>?R. length V = length V'; \<forall>(V, V')\<in>?R'. length V = length V'; Arefl ?R \<inter> Arefl ?R' \<subseteq> {[]}\<rbrakk> \<Longrightarrow> trans (?R \<union> ?R')
[PROOF STEP]
show "trans (R \<union> R')"
[PROOF STATE]
proof (prove)
using this:
sym R'
sym R
trans R'
trans R
\<forall>(V, V')\<in>R'. length V = length V'
\<forall>(V, V')\<in>R. length V = length V'
Arefl R \<inter> Arefl R' \<subseteq> {[]}
\<lbrakk>trans ?R; sym ?R; trans ?R'; sym ?R'; \<forall>(V, V')\<in>?R. length V = length V'; \<forall>(V, V')\<in>?R'. length V = length V'; Arefl ?R \<inter> Arefl ?R' \<subseteq> {[]}\<rbrakk> \<Longrightarrow> trans (?R \<union> ?R')

goal (1 subgoal):
 1. trans (R \<union> R')
[PROOF STEP]
by blast
  \<comment> \<open>condition about IDC and NDC and equal length already proven above by auto tactic!\<close>
[PROOF STATE]
proof (state)
this:
trans (R \<union> R')

goal (1 subgoal):
 1. \<And>a b i m1 m1' m2 \<alpha> p. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); i < length a; \<langle>a ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>; m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'; (a, b) \<in> R'\<rbrakk> \<Longrightarrow> \<exists>p' \<alpha>' m2'. \<langle>b ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (a ! i)) m2 m2'
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a b i m1 m1' m2 \<alpha> p. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); i < length a; \<langle>a ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>; m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'; (a, b) \<in> R'\<rbrakk> \<Longrightarrow> \<exists>p' \<alpha>' m2'. \<langle>b ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (a ! i)) m2 m2'
[PROOF STEP]
fix V V' i m1 m1' m2 \<alpha> p
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a b i m1 m1' m2 \<alpha> p. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); i < length a; \<langle>a ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>; m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'; (a, b) \<in> R'\<rbrakk> \<Longrightarrow> \<exists>p' \<alpha>' m2'. \<langle>b ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (a ! i)) m2 m2'
[PROOF STEP]
assume inR': "(V,V') \<in> R'"
[PROOF STATE]
proof (state)
this:
(V, V') \<in> R'

goal (1 subgoal):
 1. \<And>a b i m1 m1' m2 \<alpha> p. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); i < length a; \<langle>a ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>; m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'; (a, b) \<in> R'\<rbrakk> \<Longrightarrow> \<exists>p' \<alpha>' m2'. \<langle>b ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (a ! i)) m2 m2'
[PROOF STEP]
assume irange: "i < length V"
[PROOF STATE]
proof (state)
this:
i < length V

goal (1 subgoal):
 1. \<And>a b i m1 m1' m2 \<alpha> p. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); i < length a; \<langle>a ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>; m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'; (a, b) \<in> R'\<rbrakk> \<Longrightarrow> \<exists>p' \<alpha>' m2'. \<langle>b ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (a ! i)) m2 m2'
[PROOF STEP]
assume step: "\<langle>V!i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>"
[PROOF STATE]
proof (state)
this:
\<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>

goal (1 subgoal):
 1. \<And>a b i m1 m1' m2 \<alpha> p. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); i < length a; \<langle>a ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>; m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'; (a, b) \<in> R'\<rbrakk> \<Longrightarrow> \<exists>p' \<alpha>' m2'. \<langle>b ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (a ! i)) m2 m2'
[PROOF STEP]
assume dhequal: "m1 \<sim>\<^bsub>d,(htchLocSet PP)\<^esub> m1'"
[PROOF STATE]
proof (state)
this:
m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'

goal (1 subgoal):
 1. \<And>a b i m1 m1' m2 \<alpha> p. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); i < length a; \<langle>a ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>; m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'; (a, b) \<in> R'\<rbrakk> \<Longrightarrow> \<exists>p' \<alpha>' m2'. \<langle>b ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (a ! i)) m2 m2'
[PROOF STEP]
assume disjBisimUpTo: "\<forall>(V,V')\<in>R'. \<forall>i < length V. \<forall>m1 m1' m2 \<alpha> p.
    \<langle>V!i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,(htchLocSet PP)\<^esub> m1' \<longrightarrow>
    (\<exists>p' \<alpha>' m2'. \<langle>V'!i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and>
    stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and>
    dhequality_alternative d PP (pp (V!i)) m2 m2')"
[PROOF STATE]
proof (state)
this:
\<forall>(V, V')\<in>R'. \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2')

goal (1 subgoal):
 1. \<And>a b i m1 m1' m2 \<alpha> p. \<lbrakk>Arefl R \<inter> Arefl R' \<subseteq> {[]}; sym R'; trans R'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R'. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); sym R; trans R; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> length V = length V'; \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. NDC d (V ! i) \<or> IDC d (V ! i) (htchLoc (pp (V ! i))); \<forall>x\<in>R. case x of (V, V') \<Rightarrow> \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'); i < length a; \<langle>a ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>; m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'; (a, b) \<in> R'\<rbrakk> \<Longrightarrow> \<exists>p' \<alpha>' m2'. \<langle>b ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (a ! i)) m2 m2'
[PROOF STEP]
from inR' irange step dhequal disjBisimUpTo
[PROOF STATE]
proof (chain)
picking this:
(V, V') \<in> R'
i < length V
\<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>
m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'
\<forall>(V, V')\<in>R'. \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2')
[PROOF STEP]
show "\<exists>p' \<alpha>' m2'.
    \<langle>V'!i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and>
    ((\<alpha>,\<alpha>') \<in> R \<or> (\<alpha>,\<alpha>') \<in> R') \<and>
    dhequality_alternative d PP (pp (V!i)) m2 m2'"
[PROOF STATE]
proof (prove)
using this:
(V, V') \<in> R'
i < length V
\<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle>
m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1'
\<forall>(V, V')\<in>R'. \<forall>i<length V. \<forall>m1 m1' m2 \<alpha> p. \<langle>V ! i,m1\<rangle> \<rightarrow>\<lhd>\<alpha>\<rhd> \<langle>p,m2\<rangle> \<and> m1 \<sim>\<^bsub>d,htchLocSet PP\<^esub> m1' \<longrightarrow> (\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' R' \<and> (\<alpha>, \<alpha>') \<in> R' \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2')

goal (1 subgoal):
 1. \<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'
[PROOF STEP]
by (simp add: stepResultsinR_def,fastforce)
[PROOF STATE]
proof (state)
this:
\<exists>p' \<alpha>' m2'. \<langle>V' ! i,m1'\<rangle> \<rightarrow>\<lhd>\<alpha>'\<rhd> \<langle>p',m2'\<rangle> \<and> stepResultsinR p p' (R \<union> R') \<and> ((\<alpha>, \<alpha>') \<in> R \<or> (\<alpha>, \<alpha>') \<in> R') \<and> dhequality_alternative d PP (pp (V ! i)) m2 m2'

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma share_all_until_volatile_write_Read_commute:
  shows "\<And>S i.  \<lbrakk>i < length ls; ls!i=(p,Read volatile a t#is,\<theta>,sb,\<D>,\<O>)
    \<rbrakk>
   \<Longrightarrow>
    share_all_until_volatile_write
       (ls[i := (p,is, \<theta>(t\<mapsto>v), sb @ [Read\<^sub>s\<^sub>b volatile a t v],\<D>', \<O>)]) S =
    share_all_until_volatile_write ls S"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>S i. \<lbrakk>i < length ls; ls ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)\<rbrakk> \<Longrightarrow> share_all_until_volatile_write (ls[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write ls S
[PROOF STEP]
proof (induct ls)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>S i. \<lbrakk>i < length []; [] ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)\<rbrakk> \<Longrightarrow> share_all_until_volatile_write ([][i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write [] S
 2. \<And>aa ls S i. \<lbrakk>\<And>S i. \<lbrakk>i < length ls; ls ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)\<rbrakk> \<Longrightarrow> share_all_until_volatile_write (ls[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write ls S; i < length (aa # ls); (aa # ls) ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)\<rbrakk> \<Longrightarrow> share_all_until_volatile_write ((aa # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (aa # ls) S
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
i < length []
[] ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)

goal (2 subgoals):
 1. \<And>S i. \<lbrakk>i < length []; [] ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)\<rbrakk> \<Longrightarrow> share_all_until_volatile_write ([][i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write [] S
 2. \<And>aa ls S i. \<lbrakk>\<And>S i. \<lbrakk>i < length ls; ls ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)\<rbrakk> \<Longrightarrow> share_all_until_volatile_write (ls[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write ls S; i < length (aa # ls); (aa # ls) ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)\<rbrakk> \<Longrightarrow> share_all_until_volatile_write ((aa # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (aa # ls) S
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
i < length []
[] ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)

goal (1 subgoal):
 1. share_all_until_volatile_write ([][i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write [] S
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
share_all_until_volatile_write ([][i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write [] S

goal (1 subgoal):
 1. \<And>aa ls S i. \<lbrakk>\<And>S i. \<lbrakk>i < length ls; ls ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)\<rbrakk> \<Longrightarrow> share_all_until_volatile_write (ls[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write ls S; i < length (aa # ls); (aa # ls) ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)\<rbrakk> \<Longrightarrow> share_all_until_volatile_write ((aa # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (aa # ls) S
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>aa ls S i. \<lbrakk>\<And>S i. \<lbrakk>i < length ls; ls ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)\<rbrakk> \<Longrightarrow> share_all_until_volatile_write (ls[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write ls S; i < length (aa # ls); (aa # ls) ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)\<rbrakk> \<Longrightarrow> share_all_until_volatile_write ((aa # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (aa # ls) S
[PROOF STEP]
case (Cons l ls)
[PROOF STATE]
proof (state)
this:
\<lbrakk>?i < length ls; ls ! ?i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)\<rbrakk> \<Longrightarrow> share_all_until_volatile_write (ls[?i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) ?S = share_all_until_volatile_write ls ?S
i < length (l # ls)
(l # ls) ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)

goal (1 subgoal):
 1. \<And>aa ls S i. \<lbrakk>\<And>S i. \<lbrakk>i < length ls; ls ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)\<rbrakk> \<Longrightarrow> share_all_until_volatile_write (ls[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write ls S; i < length (aa # ls); (aa # ls) ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)\<rbrakk> \<Longrightarrow> share_all_until_volatile_write ((aa # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (aa # ls) S
[PROOF STEP]
note i_bound =  \<open>i < length (l#ls)\<close>
[PROOF STATE]
proof (state)
this:
i < length (l # ls)

goal (1 subgoal):
 1. \<And>aa ls S i. \<lbrakk>\<And>S i. \<lbrakk>i < length ls; ls ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)\<rbrakk> \<Longrightarrow> share_all_until_volatile_write (ls[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write ls S; i < length (aa # ls); (aa # ls) ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)\<rbrakk> \<Longrightarrow> share_all_until_volatile_write ((aa # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (aa # ls) S
[PROOF STEP]
note ith = \<open>(l#ls)!i = (p,Read volatile a t#is,\<theta>,sb,\<D>,\<O>)\<close>
[PROOF STATE]
proof (state)
this:
(l # ls) ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)

goal (1 subgoal):
 1. \<And>aa ls S i. \<lbrakk>\<And>S i. \<lbrakk>i < length ls; ls ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)\<rbrakk> \<Longrightarrow> share_all_until_volatile_write (ls[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write ls S; i < length (aa # ls); (aa # ls) ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)\<rbrakk> \<Longrightarrow> share_all_until_volatile_write ((aa # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (aa # ls) S
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. share_all_until_volatile_write ((l # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (l # ls) S
[PROOF STEP]
proof (cases i)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. i = 0 \<Longrightarrow> share_all_until_volatile_write ((l # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (l # ls) S
 2. \<And>nat. i = Suc nat \<Longrightarrow> share_all_until_volatile_write ((l # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (l # ls) S
[PROOF STEP]
case 0
[PROOF STATE]
proof (state)
this:
i = 0

goal (2 subgoals):
 1. i = 0 \<Longrightarrow> share_all_until_volatile_write ((l # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (l # ls) S
 2. \<And>nat. i = Suc nat \<Longrightarrow> share_all_until_volatile_write ((l # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (l # ls) S
[PROOF STEP]
from ith 0
[PROOF STATE]
proof (chain)
picking this:
(l # ls) ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)
i = 0
[PROOF STEP]
have l: "l = (p,Read volatile a t#is,\<theta>,sb,\<D>,\<O>)"
[PROOF STATE]
proof (prove)
using this:
(l # ls) ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)
i = 0

goal (1 subgoal):
 1. l = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
l = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)

goal (2 subgoals):
 1. i = 0 \<Longrightarrow> share_all_until_volatile_write ((l # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (l # ls) S
 2. \<And>nat. i = Suc nat \<Longrightarrow> share_all_until_volatile_write ((l # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (l # ls) S
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
l = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)

goal (1 subgoal):
 1. share_all_until_volatile_write ((l # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (l # ls) S
[PROOF STEP]
by (simp add: 0 share_append_Read\<^sub>s\<^sub>b del: fun_upd_apply )
[PROOF STATE]
proof (state)
this:
share_all_until_volatile_write ((l # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (l # ls) S

goal (1 subgoal):
 1. \<And>nat. i = Suc nat \<Longrightarrow> share_all_until_volatile_write ((l # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (l # ls) S
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>nat. i = Suc nat \<Longrightarrow> share_all_until_volatile_write ((l # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (l # ls) S
[PROOF STEP]
case (Suc n)
[PROOF STATE]
proof (state)
this:
i = Suc n

goal (1 subgoal):
 1. \<And>nat. i = Suc nat \<Longrightarrow> share_all_until_volatile_write ((l # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (l # ls) S
[PROOF STEP]
obtain p\<^sub>l "is\<^sub>l" \<O>\<^sub>l \<D>\<^sub>l \<theta>\<^sub>l sb\<^sub>l where l: "l = (p\<^sub>l,is\<^sub>l,\<theta>\<^sub>l,sb\<^sub>l,\<D>\<^sub>l,\<O>\<^sub>l)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>p\<^sub>l is\<^sub>l \<theta>\<^sub>l sb\<^sub>l \<D>\<^sub>l \<O>\<^sub>l. l = (p\<^sub>l, is\<^sub>l, \<theta>\<^sub>l, sb\<^sub>l, \<D>\<^sub>l, \<O>\<^sub>l) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (cases l)
[PROOF STATE]
proof (state)
this:
l = (p\<^sub>l, is\<^sub>l, \<theta>\<^sub>l, sb\<^sub>l, \<D>\<^sub>l, \<O>\<^sub>l)

goal (1 subgoal):
 1. \<And>nat. i = Suc nat \<Longrightarrow> share_all_until_volatile_write ((l # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (l # ls) S
[PROOF STEP]
from i_bound ith
[PROOF STATE]
proof (chain)
picking this:
i < length (l # ls)
(l # ls) ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)
[PROOF STEP]
have "share_all_until_volatile_write
      (ls[n := (p,is, \<theta>(t\<mapsto>v), sb @ [Read\<^sub>s\<^sub>b volatile a t v],\<D>', \<O>)])
      (share (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) S) =
      share_all_until_volatile_write ls (share (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) S)"
[PROOF STATE]
proof (prove)
using this:
i < length (l # ls)
(l # ls) ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)

goal (1 subgoal):
 1. share_all_until_volatile_write (ls[n := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) (share (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) S) = share_all_until_volatile_write ls (share (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) S)
[PROOF STEP]
apply -
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>i < length (l # ls); (l # ls) ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)\<rbrakk> \<Longrightarrow> share_all_until_volatile_write (ls[n := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) (share (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) S) = share_all_until_volatile_write ls (share (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) S)
[PROOF STEP]
apply (rule Cons.hyps)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>i < length (l # ls); (l # ls) ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)\<rbrakk> \<Longrightarrow> n < length ls
 2. \<lbrakk>i < length (l # ls); (l # ls) ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)\<rbrakk> \<Longrightarrow> ls ! n = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)
[PROOF STEP]
apply (auto simp add: Suc l)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
share_all_until_volatile_write (ls[n := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) (share (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) S) = share_all_until_volatile_write ls (share (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) S)

goal (1 subgoal):
 1. \<And>nat. i = Suc nat \<Longrightarrow> share_all_until_volatile_write ((l # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (l # ls) S
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
share_all_until_volatile_write (ls[n := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) (share (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) S) = share_all_until_volatile_write ls (share (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) S)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
share_all_until_volatile_write (ls[n := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) (share (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) S) = share_all_until_volatile_write ls (share (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) S)

goal (1 subgoal):
 1. share_all_until_volatile_write ((l # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (l # ls) S
[PROOF STEP]
by (simp add: Suc l del: fun_upd_apply)
[PROOF STATE]
proof (state)
this:
share_all_until_volatile_write ((l # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (l # ls) S

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
share_all_until_volatile_write ((l # ls)[i := (p, is, \<theta>(t \<mapsto> v), sb @ [Read\<^sub>s\<^sub>b volatile a t v], \<D>', \<O>)]) S = share_all_until_volatile_write (l # ls) S

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma PO_m3_DY_fake_refines_m2_fake:
  "{R23 \<inter> UNIV \<times> m3_inv1_lkeysec}
     m2_fake, m3_DY_fake
   {> R23}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {R23 \<inter> UNIV \<times> m3_inv1_lkeysec} m2_fake, m3_DY_fake {> R23}
[PROOF STEP]
apply (auto simp add: PO_rhoare_defs R23_def m2_defs m3_defs intro!: R23_intros
            del: abs_msg.cases)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>a y x. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; y \<in> m3_inv1_lkeysec; x \<in> abs_msg (parts (IK y))\<rbrakk> \<Longrightarrow> x \<in> fake ik0 (dom (runs a)) (chan a)
 2. \<And>a y x. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; y \<in> m3_inv1_lkeysec; x \<in> abs_msg (synth (analz (IK y)))\<rbrakk> \<Longrightarrow> x \<in> fake ik0 (dom (runs a)) (chan a)
 3. \<And>a y KK K. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; y \<in> m3_inv1_lkeysec; KK \<subseteq> range sesK; Key K \<in> analz (Key ` KK \<union> IK y)\<rbrakk> \<Longrightarrow> aKey K \<in> extr (aKey ` KK \<union> ik0) (chan a)
 4. \<And>a y KK K. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; y \<in> m3_inv1_lkeysec; KK \<subseteq> range sesK; Key K \<in> analz (IK y)\<rbrakk> \<Longrightarrow> aKey K \<in> extr (aKey ` KK \<union> ik0) (chan a)
 5. \<And>a y KK N. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; y \<in> m3_inv1_lkeysec; KK \<subseteq> range sesK; Nonce N \<in> analz (Key ` KK \<union> IK y)\<rbrakk> \<Longrightarrow> aNon N \<in> extr (aKey ` KK \<union> ik0) (chan a)
 6. \<And>a y KK N. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; y \<in> m3_inv1_lkeysec; KK \<subseteq> range sesK; Nonce N \<in> analz (IK y)\<rbrakk> \<Longrightarrow> aNon N \<in> extr (aKey ` KK \<union> ik0) (chan a)
[PROOF STEP]
apply (auto intro: abs_msg_DY_subset_fakeable [THEN subsetD]
            del: abs_msg.cases)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a y KK K. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; y \<in> m3_inv1_lkeysec; KK \<subseteq> range sesK; Key K \<in> analz (IK y)\<rbrakk> \<Longrightarrow> aKey K \<in> extr (aKey ` KK \<union> ik0) (chan a)
 2. \<And>a y KK N. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; y \<in> m3_inv1_lkeysec; KK \<subseteq> range sesK; Nonce N \<in> analz (IK y)\<rbrakk> \<Longrightarrow> aNon N \<in> extr (aKey ` KK \<union> ik0) (chan a)
[PROOF STEP]
apply (auto simp add: R23_keys_simps dest: R23_non_dests)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma is_tm_ntsmcfD':
  assumes "\<NN> : \<FF> \<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>F\<^sub>.\<^sub>t\<^sub>m \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>.\<^sub>t\<^sub>m\<^bsub>\<alpha>\<^esub> \<BB>"
  shows "\<NN> : \<FF> \<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>F \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>"
    and "\<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>.\<^sub>t\<^sub>m\<^bsub>\<alpha>\<^esub> \<BB>"
    and "\<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>.\<^sub>t\<^sub>m\<^bsub>\<alpha>\<^esub> \<BB>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<NN> : \<FF> \<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>F \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB> &&& \<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>.\<^sub>t\<^sub>m\<^bsub>\<alpha>\<^esub> \<BB> &&& \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>.\<^sub>t\<^sub>m\<^bsub>\<alpha>\<^esub> \<BB>
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<NN> : \<FF> \<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>F \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>
 2. \<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>.\<^sub>t\<^sub>m\<^bsub>\<alpha>\<^esub> \<BB>
 3. \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>.\<^sub>t\<^sub>m\<^bsub>\<alpha>\<^esub> \<BB>
[PROOF STEP]
interpret is_tm_ntsmcf \<alpha> \<AA> \<BB> \<FF> \<GG> \<NN>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<NN> : \<FF> \<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>F\<^sub>.\<^sub>t\<^sub>m \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>.\<^sub>t\<^sub>m\<^bsub>\<alpha>\<^esub> \<BB>
[PROOF STEP]
by (rule assms(1))
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<NN> : \<FF> \<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>F \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>
 2. \<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>.\<^sub>t\<^sub>m\<^bsub>\<alpha>\<^esub> \<BB>
 3. \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>.\<^sub>t\<^sub>m\<^bsub>\<alpha>\<^esub> \<BB>
[PROOF STEP]
show "\<NN> : \<FF> \<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>F \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>"
    and "\<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>.\<^sub>t\<^sub>m\<^bsub>\<alpha>\<^esub> \<BB>"
    and "\<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>.\<^sub>t\<^sub>m\<^bsub>\<alpha>\<^esub> \<BB>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<NN> : \<FF> \<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>F \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB> &&& \<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>.\<^sub>t\<^sub>m\<^bsub>\<alpha>\<^esub> \<BB> &&& \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>.\<^sub>t\<^sub>m\<^bsub>\<alpha>\<^esub> \<BB>
[PROOF STEP]
by (auto simp: smc_small_cs_intros)
[PROOF STATE]
proof (state)
this:
\<NN> : \<FF> \<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>F \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>
\<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>.\<^sub>t\<^sub>m\<^bsub>\<alpha>\<^esub> \<BB>
\<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^sub>.\<^sub>t\<^sub>m\<^bsub>\<alpha>\<^esub> \<BB>

goal:
No subgoals!
[PROOF STEP]
qed