[STATEMENT]
lemma handleUT_dynamic_handles_transition :
  fixes M1::"('a::linorder,'b::linorder,'c::linorder) fsm"
  fixes M2::"('e,'b,'c) fsm"
  assumes "\<And> q1 q2 . q1 \<in> states M1 \<Longrightarrow> q2 \<in> states M1 \<Longrightarrow> q1 \<noteq> q2 \<Longrightarrow> distinguishes M1 q1 q2 (dist_fun q1 q2)"
  shows "handles_transition (handleUT_dynamic b c dist_fun d) M1 M2 V T0 cg_insert cg_lookup cg_merge"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. handles_transition (handleUT_dynamic b c dist_fun d) M1 M2 V T0 cg_insert cg_lookup cg_merge
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. handles_transition (handleUT_dynamic b c dist_fun d) M1 M2 V T0 cg_insert cg_lookup cg_merge
[PROOF STEP]
have "\<And> T G m t X .
       Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and>
       (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and>
       (observable M1 \<longrightarrow>
        observable M2 \<longrightarrow>
        minimal M1 \<longrightarrow>
        minimal M2 \<longrightarrow>
        size_r M1 \<le> m \<longrightarrow>
        FSM.size M2 \<le> m \<longrightarrow>
        FSM.inputs M2 = FSM.inputs M1 \<longrightarrow>
        FSM.outputs M2 = FSM.outputs M1 \<longrightarrow>
        is_state_cover_assignment M1 V \<longrightarrow>
        preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow>
        V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow>
        t \<in> FSM.transitions M1 \<longrightarrow>
        t_source t \<in> reachable_states M1 \<longrightarrow>
        V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow>
        convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow>
        convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow>
        convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow>
        L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) =
        L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow>
        Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow>
        (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow>
             L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) =
             L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and>
             preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and>
        convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))"
    (is "\<And> T G m t X . ?P T G m t X")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
fix T :: "('b\<times>'c) prefix_tree"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
fix G :: 'd
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
fix m :: nat
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
fix t :: "('a,'b,'c) transition"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
fix X :: "('a,'b,'c) transition list"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
let ?TG = "snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
define k where "k = (2 * size M1)"
[PROOF STATE]
proof (state)
this:
k = 2 * FSM.size M1

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
define l where "l = (m - size_r M1)"
[PROOF STATE]
proof (state)
this:
l = m - size_r M1

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
define X' where "X' = butlast X"
[PROOF STATE]
proof (state)
this:
X' = butlast X

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
define heuristic where "heuristic = (if c then append_heuristic_input M1 else append_heuristic_io)"
[PROOF STATE]
proof (state)
this:
heuristic = (if c then append_heuristic_input M1 else append_heuristic_io)

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
define rstates where "rstates   = (map V (reachable_states_as_list M1))"
[PROOF STATE]
proof (state)
this:
rstates = map V (reachable_states_as_list M1)

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
obtain T1 G1 where "(T1,G1)   = handle_io_pair b c M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>T1 G1. (T1, G1) = handle_io_pair b c M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using prod.collapse
[PROOF STATE]
proof (prove)
using this:
(fst ?prod, snd ?prod) = ?prod

goal (1 subgoal):
 1. (\<And>T1 G1. (T1, G1) = handle_io_pair b c M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(T1, G1) = handle_io_pair b c M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t)

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(T1, G1) = handle_io_pair b c M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t)
[PROOF STEP]
have T1_def: "T1 = fst (handle_io_pair b c M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))"
         and  G1_def: "G1 = snd (handle_io_pair b c M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))"
[PROOF STATE]
proof (prove)
using this:
(T1, G1) = handle_io_pair b c M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t)

goal (1 subgoal):
 1. T1 = fst (handle_io_pair b c M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t)) &&& G1 = snd (handle_io_pair b c M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))
[PROOF STEP]
using fst_conv[of T1 G1] snd_conv[of T1 G1]
[PROOF STATE]
proof (prove)
using this:
(T1, G1) = handle_io_pair b c M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t)
fst (T1, G1) = T1
snd (T1, G1) = G1

goal (1 subgoal):
 1. T1 = fst (handle_io_pair b c M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t)) &&& G1 = snd (handle_io_pair b c M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))
[PROOF STEP]
by force+
[PROOF STATE]
proof (state)
this:
T1 = fst (handle_io_pair b c M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))
G1 = snd (handle_io_pair b c M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
define u where "u         = ((V (t_source t))@[(t_input t, t_output t)])"
[PROOF STATE]
proof (state)
this:
u = V (t_source t) @ [(t_input t, t_output t)]

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
define v where "v         = (V (t_target t))"
[PROOF STATE]
proof (state)
this:
v = V (t_target t)

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
obtain T2 G2 where "(T2,G2) = distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>T2 G2. (T2, G2) = distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using prod.collapse
[PROOF STATE]
proof (prove)
using this:
(fst ?prod, snd ?prod) = ?prod

goal (1 subgoal):
 1. (\<And>T2 G2. (T2, G2) = distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(T2, G2) = distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(T2, G2) = distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False
[PROOF STEP]
have T2_def: "T2 = fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False)"
         and  G2_def: "G2 = snd (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False)"
[PROOF STATE]
proof (prove)
using this:
(T2, G2) = distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False

goal (1 subgoal):
 1. T2 = fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False) &&& G2 = snd (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False)
[PROOF STEP]
using fst_conv[of T2 G2] snd_conv[of T2 G2]
[PROOF STATE]
proof (prove)
using this:
(T2, G2) = distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False
fst (T2, G2) = T2
snd (T2, G2) = G2

goal (1 subgoal):
 1. T2 = fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False) &&& G2 = snd (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False)
[PROOF STEP]
by force+
[PROOF STATE]
proof (state)
this:
T2 = fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False)
G2 = snd (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False)

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
define G3 where "G3 = cg_merge G2 u v"
[PROOF STATE]
proof (state)
this:
G3 = cg_merge G2 u v

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
obtain TH GH where "(TH,GH) = distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>TH GH. (TH, GH) = distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using prod.collapse
[PROOF STATE]
proof (prove)
using this:
(fst ?prod, snd ?prod) = ?prod

goal (1 subgoal):
 1. (\<And>TH GH. (TH, GH) = distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(TH, GH) = distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(TH, GH) = distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True
[PROOF STEP]
have TH_def: "TH = fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True)"
         and  GH_def: "GH = snd (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True)"
[PROOF STATE]
proof (prove)
using this:
(TH, GH) = distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True

goal (1 subgoal):
 1. TH = fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True) &&& GH = snd (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True)
[PROOF STEP]
using fst_conv[of TH GH] snd_conv[of TH GH]
[PROOF STATE]
proof (prove)
using this:
(TH, GH) = distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True
fst (TH, GH) = TH
snd (TH, GH) = GH

goal (1 subgoal):
 1. TH = fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True) &&& GH = snd (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True)
[PROOF STEP]
by force+
[PROOF STATE]
proof (state)
this:
TH = fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True)
GH = snd (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True)

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
have TG_cases: "?TG = (if (d M1 V t X' l) then (T2,G3) else (TH,GH))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X) = (if d M1 V t X' l then (T2, G3) else (TH, GH))
[PROOF STEP]
unfolding handleUT_dynamic_def Let_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd (case handle_io_pair b c M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t) of (T1, G1) \<Rightarrow> if d M1 V t (butlast X) (m - size_r M1) then case distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)) (map V (reachable_states_as_list M1)) (2 * FSM.size M1) (m - size_r M1) b (if c then append_heuristic_input M1 else append_heuristic_io) False of (T2, G2) \<Rightarrow> (butlast X, T2, cg_merge G2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))) else (butlast X, distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun (V (t_source t) @ [(t_input t, t_output t)]) (V (t_source t) @ [(t_input t, t_output t)]) (map V (reachable_states_as_list M1)) (2 * FSM.size M1) (m - size_r M1) b (if c then append_heuristic_input M1 else append_heuristic_io) True)) = (if d M1 V t X' l then (T2, G3) else (TH, GH))
[PROOF STEP]
unfolding u_def[symmetric] v_def[symmetric] rstates_def[symmetric] k_def[symmetric] l_def[symmetric] heuristic_def[symmetric]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd (case handle_io_pair b c M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t) of (T1, G1) \<Rightarrow> if d M1 V t (butlast X) l then case distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False of (T2, G2) \<Rightarrow> (butlast X, T2, cg_merge G2 u v) else (butlast X, distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True)) = (if d M1 V t X' l then (T2, G3) else (TH, GH))
[PROOF STEP]
unfolding \<open>(T1,G1)   = handle_io_pair b c M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t)\<close>[symmetric] case_prod_conv
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd (if d M1 V t (butlast X) l then case distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False of (T2, G2) \<Rightarrow> (butlast X, T2, cg_merge G2 u v) else (butlast X, distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True)) = (if d M1 V t X' l then (T2, G3) else (TH, GH))
[PROOF STEP]
unfolding \<open>(T2,G2) = distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False\<close>[symmetric] case_prod_conv
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd (if d M1 V t (butlast X) l then (butlast X, T2, cg_merge G2 u v) else (butlast X, distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True)) = (if d M1 V t X' l then (T2, G3) else (TH, GH))
[PROOF STEP]
unfolding G3_def[symmetric]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd (if d M1 V t (butlast X) l then (butlast X, T2, G3) else (butlast X, distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True)) = (if d M1 V t X' l then (T2, G3) else (TH, GH))
[PROOF STEP]
unfolding \<open>(TH,GH) = distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True\<close>[symmetric]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd (if d M1 V t (butlast X) l then (butlast X, T2, G3) else (butlast X, TH, GH)) = (if d M1 V t X' l then (T2, G3) else (TH, GH))
[PROOF STEP]
unfolding X'_def[symmetric]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd (if d M1 V t X' l then (X', T2, G3) else (X', TH, GH)) = (if d M1 V t X' l then (T2, G3) else (TH, GH))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X) = (if d M1 V t X' l then (T2, G3) else (TH, GH))

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X) = (if d M1 V t X' l then (T2, G3) else (TH, GH))
[PROOF STEP]
have TG_cases_fst: "fst ?TG = (if (d M1 V t X' l) then T2 else TH)"
         and  TG_cases_snd: "snd ?TG = (if (d M1 V t X' l) then G3 else GH)"
[PROOF STATE]
proof (prove)
using this:
snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X) = (if d M1 V t X' l then (T2, G3) else (TH, GH))

goal (1 subgoal):
 1. fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)) = (if d M1 V t X' l then T2 else TH) &&& snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)) = (if d M1 V t X' l then G3 else GH)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)) = (if d M1 V t X' l then T2 else TH)
snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)) = (if d M1 V t X' l then G3 else GH)

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
have "set T \<subseteq> set T1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set T1
[PROOF STEP]
unfolding T1_def handle_io_pair_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b (if c then append_heuristic_input M1 else append_heuristic_io)))
[PROOF STEP]
by (metis distribute_extension_subset)
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set T1

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set T1

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
have "set T1 \<subseteq> set T2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T2
[PROOF STEP]
unfolding T2_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False))
[PROOF STEP]
by (meson distinguish_from_set_subset)
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T2

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T2

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
have "set T1 \<subseteq> set TH"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set TH
[PROOF STEP]
unfolding TH_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True))
[PROOF STEP]
by (meson distinguish_from_set_subset)
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set TH

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set T1
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T2
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set TH
[PROOF STEP]
have *:"set T \<subseteq> set (fst ?TG)"
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set T1
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T2
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set TH

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
using TG_cases
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set T1
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T2
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set TH
snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X) = (if d M1 V t X' l then (T2, G3) else (TH, GH))

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
have "finite_tree T \<Longrightarrow> finite_tree T1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite_tree T \<Longrightarrow> finite_tree T1
[PROOF STEP]
unfolding T1_def handle_io_pair_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite_tree T \<Longrightarrow> finite_tree (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b (if c then append_heuristic_input M1 else append_heuristic_io)))
[PROOF STEP]
by (metis distribute_extension_finite)
[PROOF STATE]
proof (state)
this:
finite_tree T \<Longrightarrow> finite_tree T1

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
finite_tree T \<Longrightarrow> finite_tree T1

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
have "finite_tree T1 \<Longrightarrow> finite_tree T2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite_tree T1 \<Longrightarrow> finite_tree T2
[PROOF STEP]
unfolding T2_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite_tree T1 \<Longrightarrow> finite_tree (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False))
[PROOF STEP]
by (meson distinguish_from_set_finite)
[PROOF STATE]
proof (state)
this:
finite_tree T1 \<Longrightarrow> finite_tree T2

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
finite_tree T1 \<Longrightarrow> finite_tree T2

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
have "finite_tree T1 \<Longrightarrow> finite_tree TH"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite_tree T1 \<Longrightarrow> finite_tree TH
[PROOF STEP]
unfolding TH_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite_tree T1 \<Longrightarrow> finite_tree (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True))
[PROOF STEP]
by (meson distinguish_from_set_finite)
[PROOF STATE]
proof (state)
this:
finite_tree T1 \<Longrightarrow> finite_tree TH

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
finite_tree T \<Longrightarrow> finite_tree T1
finite_tree T1 \<Longrightarrow> finite_tree T2
finite_tree T1 \<Longrightarrow> finite_tree TH
[PROOF STEP]
have **:"finite_tree T \<Longrightarrow> finite_tree (fst ?TG)"
[PROOF STATE]
proof (prove)
using this:
finite_tree T \<Longrightarrow> finite_tree T1
finite_tree T1 \<Longrightarrow> finite_tree T2
finite_tree T1 \<Longrightarrow> finite_tree TH

goal (1 subgoal):
 1. finite_tree T \<Longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
using TG_cases
[PROOF STATE]
proof (prove)
using this:
finite_tree T \<Longrightarrow> finite_tree T1
finite_tree T1 \<Longrightarrow> finite_tree T2
finite_tree T1 \<Longrightarrow> finite_tree TH
snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X) = (if d M1 V t X' l then (T2, G3) else (TH, GH))

goal (1 subgoal):
 1. finite_tree T \<Longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
finite_tree T \<Longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
have ***: "observable M1 \<Longrightarrow>
              observable M2 \<Longrightarrow>
              minimal M1 \<Longrightarrow>
              minimal M2 \<Longrightarrow>
              size_r M1 \<le> m \<Longrightarrow>
              size M2 \<le> m \<Longrightarrow>
              inputs M2 = inputs M1 \<Longrightarrow>
              outputs M2 = outputs M1 \<Longrightarrow>
              is_state_cover_assignment M1 V \<Longrightarrow>
              preserves_divergence M1 M2 (V ` reachable_states M1) \<Longrightarrow>
              V ` reachable_states M1 \<subseteq> set T \<Longrightarrow>
              t \<in> transitions M1 \<Longrightarrow>
              t_source t \<in> reachable_states M1 \<Longrightarrow>
              V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<Longrightarrow>
              convergence_graph_lookup_invar M1 M2 cg_lookup G \<Longrightarrow>
              convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<Longrightarrow>
              convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<Longrightarrow>
              L M1 \<inter> set (fst ?TG) = L M2 \<inter> set (fst ?TG) \<Longrightarrow>
              (set T0 \<subseteq> set T) \<Longrightarrow>
              (\<forall> \<gamma> . (length \<gamma> \<le> (m-size_r M1) \<and> list.set \<gamma> \<subseteq> inputs M1 \<times> outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t))
                      \<longrightarrow> ((L M1 \<inter> (V ` reachable_states M1 \<union> {((V (t_source t))@[(t_input t,t_output t)]) @ \<omega>' | \<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
                            = L M2 \<inter> (V ` reachable_states M1 \<union> {((V (t_source t))@[(t_input t,t_output t)]) @ \<omega>' | \<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}))
                           \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {((V (t_source t))@[(t_input t,t_output t)]) @ \<omega>' | \<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})))
              \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd ?TG)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
assume a01 : "observable M1"
[PROOF STATE]
proof (state)
this:
observable M1

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
assume a02 : "observable M2"
[PROOF STATE]
proof (state)
this:
observable M2

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
assume a03 : "minimal M1"
[PROOF STATE]
proof (state)
this:
minimal M1

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
assume a04 : "minimal M2"
[PROOF STATE]
proof (state)
this:
minimal M2

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
assume a05 : "size_r M1 \<le> m"
[PROOF STATE]
proof (state)
this:
size_r M1 \<le> m

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
assume a06 : "size M2 \<le> m"
[PROOF STATE]
proof (state)
this:
FSM.size M2 \<le> m

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
assume a07 : "inputs M2 = inputs M1"
[PROOF STATE]
proof (state)
this:
FSM.inputs M2 = FSM.inputs M1

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
assume a08 : "outputs M2 = outputs M1"
[PROOF STATE]
proof (state)
this:
FSM.outputs M2 = FSM.outputs M1

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
assume a09 : "is_state_cover_assignment M1 V"
[PROOF STATE]
proof (state)
this:
is_state_cover_assignment M1 V

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
assume a10 : "preserves_divergence M1 M2 (V ` reachable_states M1)"
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (V ` reachable_states M1)

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
assume a11 : "V ` reachable_states M1 \<subseteq> set T"
[PROOF STATE]
proof (state)
this:
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
assume a12 : "t \<in> transitions M1"
[PROOF STATE]
proof (state)
this:
t \<in> FSM.transitions M1

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
assume a13 : "t_source t \<in> reachable_states M1"
[PROOF STATE]
proof (state)
this:
t_source t \<in> reachable_states M1

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
assume a14 : "convergence_graph_lookup_invar M1 M2 cg_lookup G"
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup G

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
assume a15 : "convergence_graph_insert_invar M1 M2 cg_lookup cg_insert"
[PROOF STATE]
proof (state)
this:
convergence_graph_insert_invar M1 M2 cg_lookup cg_insert

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
assume a16 : "convergence_graph_merge_invar M1 M2 cg_lookup cg_merge"
[PROOF STATE]
proof (state)
this:
convergence_graph_merge_invar M1 M2 cg_lookup cg_merge

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
assume a17 : "L M1 \<inter> set (fst ?TG) = L M2 \<inter> set (fst ?TG)"
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
assume a18 : "(set T0 \<subseteq> set T)"
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
assume a19 : "V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t)"
[PROOF STATE]
proof (state)
this:
V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t)

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have pass_T1 : "L M1 \<inter> set T1 = L M2 \<inter> set T1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1
[PROOF STEP]
using a17 \<open>set T1 \<subseteq> set T2\<close> \<open>set T1 \<subseteq> set TH\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T2
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set TH

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1
[PROOF STEP]
unfolding TG_cases_fst
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (if d M1 V t X' l then T2 else TH) = L M2 \<inter> Prefix_Tree.set (if d M1 V t X' l then T2 else TH)
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T2
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set TH

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1
[PROOF STEP]
by (cases "d M1 V t X' l"; auto)
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1
[PROOF STEP]
have pass_T : "L M1 \<inter> set T = L M2 \<inter> set T"
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
[PROOF STEP]
using \<open>set T \<subseteq> set T1\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1
Prefix_Tree.set T \<subseteq> Prefix_Tree.set T1

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have "t_target t \<in> reachable_states M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. t_target t \<in> reachable_states M1
[PROOF STEP]
using reachable_states_next[OF a13 a12]
[PROOF STATE]
proof (prove)
using this:
t_source t = t_source t \<Longrightarrow> t_target t \<in> reachable_states M1

goal (1 subgoal):
 1. t_target t \<in> reachable_states M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
t_target t \<in> reachable_states M1

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
t_target t \<in> reachable_states M1
[PROOF STEP]
have "(V (t_target t)) \<in> L M1"
[PROOF STATE]
proof (prove)
using this:
t_target t \<in> reachable_states M1

goal (1 subgoal):
 1. V (t_target t) \<in> L M1
[PROOF STEP]
using is_state_cover_assignment_language[OF a09]
[PROOF STATE]
proof (prove)
using this:
t_target t \<in> reachable_states M1
?q \<in> reachable_states M1 \<Longrightarrow> V ?q \<in> L M1

goal (1 subgoal):
 1. V (t_target t) \<in> L M1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V (t_target t) \<in> L M1

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
V (t_target t) \<in> L M1

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have "(V (t_target t)) \<in> set T"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V (t_target t) \<in> Prefix_Tree.set T
[PROOF STEP]
using a11 \<open>t_target t \<in> reachable_states M1\<close>
[PROOF STATE]
proof (prove)
using this:
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T
t_target t \<in> reachable_states M1

goal (1 subgoal):
 1. V (t_target t) \<in> Prefix_Tree.set T
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V (t_target t) \<in> Prefix_Tree.set T

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
V (t_target t) \<in> L M1
V (t_target t) \<in> Prefix_Tree.set T
[PROOF STEP]
have "(V (t_target t)) \<in> L M2"
[PROOF STATE]
proof (prove)
using this:
V (t_target t) \<in> L M1
V (t_target t) \<in> Prefix_Tree.set T

goal (1 subgoal):
 1. V (t_target t) \<in> L M2
[PROOF STEP]
using pass_T
[PROOF STATE]
proof (prove)
using this:
V (t_target t) \<in> L M1
V (t_target t) \<in> Prefix_Tree.set T
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T

goal (1 subgoal):
 1. V (t_target t) \<in> L M2
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V (t_target t) \<in> L M2

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V (t_target t) \<in> L M2
[PROOF STEP]
have "v \<in> L M2"
[PROOF STATE]
proof (prove)
using this:
V (t_target t) \<in> L M2

goal (1 subgoal):
 1. v \<in> L M2
[PROOF STEP]
unfolding v_def
[PROOF STATE]
proof (prove)
using this:
V (t_target t) \<in> L M2

goal (1 subgoal):
 1. V (t_target t) \<in> L M2
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
v \<in> L M2

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have "(V (t_source t)) \<in> L M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V (t_source t) \<in> L M1
[PROOF STEP]
using is_state_cover_assignment_language[OF a09 a13]
[PROOF STATE]
proof (prove)
using this:
V (t_source t) \<in> L M1

goal (1 subgoal):
 1. V (t_source t) \<in> L M1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V (t_source t) \<in> L M1

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
V (t_source t) \<in> L M1

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have "(V (t_source t)) \<in> set T"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V (t_source t) \<in> Prefix_Tree.set T
[PROOF STEP]
using a11 a13
[PROOF STATE]
proof (prove)
using this:
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T
t_source t \<in> reachable_states M1

goal (1 subgoal):
 1. V (t_source t) \<in> Prefix_Tree.set T
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V (t_source t) \<in> Prefix_Tree.set T

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
V (t_source t) \<in> L M1
V (t_source t) \<in> Prefix_Tree.set T
[PROOF STEP]
have "(V (t_source t)) \<in> L M2"
[PROOF STATE]
proof (prove)
using this:
V (t_source t) \<in> L M1
V (t_source t) \<in> Prefix_Tree.set T

goal (1 subgoal):
 1. V (t_source t) \<in> L M2
[PROOF STEP]
using pass_T
[PROOF STATE]
proof (prove)
using this:
V (t_source t) \<in> L M1
V (t_source t) \<in> Prefix_Tree.set T
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T

goal (1 subgoal):
 1. V (t_source t) \<in> L M2
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V (t_source t) \<in> L M2

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have "u \<in> L M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. u \<in> L M1
[PROOF STEP]
unfolding u_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V (t_source t) @ [(t_input t, t_output t)] \<in> L M1
[PROOF STEP]
using a01 a09 a12 a13 converge.simps state_cover_transition_converges
[PROOF STATE]
proof (prove)
using this:
observable M1
is_state_cover_assignment M1 V
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1
converge ?M ?\<pi> ?\<tau> = (?\<pi> \<in> L ?M \<and> ?\<tau> \<in> L ?M \<and> LS ?M (after_initial ?M ?\<pi>) = LS ?M (after_initial ?M ?\<tau>))
\<lbrakk>observable ?M; is_state_cover_assignment ?M ?V; ?t \<in> FSM.transitions ?M; t_source ?t \<in> reachable_states ?M\<rbrakk> \<Longrightarrow> converge ?M (?V (t_source ?t) @ [(t_input ?t, t_output ?t)]) (?V (t_target ?t))

goal (1 subgoal):
 1. V (t_source t) @ [(t_input t, t_output t)] \<in> L M1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
u \<in> L M1

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have heuristic_prop: "(\<And>T w u' uBest lBest. fst (heuristic T w (uBest, lBest) u') \<in> {u', uBest})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>T w u' uBest lBest. fst (heuristic T w (uBest, lBest) u') \<in> {u', uBest}
[PROOF STEP]
unfolding heuristic_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>T w u' uBest lBest. fst ((if c then append_heuristic_input M1 else append_heuristic_io) T w (uBest, lBest) u') \<in> {u', uBest}
[PROOF STEP]
using append_heuristic_input_in append_heuristic_io_in
[PROOF STATE]
proof (prove)
using this:
fst (append_heuristic_input ?M ?T ?w (?uBest, ?lBest) ?u') \<in> {?u', ?uBest}
fst (append_heuristic_io ?T ?w (?uBest, ?lBest) ?u') \<in> {?u', ?uBest}

goal (1 subgoal):
 1. \<And>T w u' uBest lBest. fst ((if c then append_heuristic_input M1 else append_heuristic_io) T w (uBest, lBest) u') \<in> {u', uBest}
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
fst (heuristic ?T ?w (?uBest, ?lBest) ?u') \<in> {?u', ?uBest}

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have "convergence_graph_lookup_invar M1 M2 cg_lookup G1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup G1
[PROOF STEP]
using distribute_extension_adds_sequence(2)[OF a01 a03 \<open>(V (t_source t)) \<in> L M1\<close> \<open>(V (t_source t)) \<in> L M2\<close> a14 a15, of T "[(t_input t, t_output t)]" b heuristic, OF _ heuristic_prop]
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic)) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup G1
[PROOF STEP]
using pass_T1
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic)) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic))
L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup G1
[PROOF STEP]
unfolding T1_def G1_def handle_io_pair_def
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic)) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic))
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b (if c then append_heuristic_input M1 else append_heuristic_io))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b (if c then append_heuristic_input M1 else append_heuristic_io)))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b (if c then append_heuristic_input M1 else append_heuristic_io)))
[PROOF STEP]
unfolding heuristic_def[symmetric]
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic)) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic))
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup G1

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have "list.set rstates = V ` reachable_states M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list.set rstates = V ` reachable_states M1
[PROOF STEP]
unfolding rstates_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list.set (map V (reachable_states_as_list M1)) = V ` reachable_states M1
[PROOF STEP]
using reachable_states_as_list_set
[PROOF STATE]
proof (prove)
using this:
list.set (reachable_states_as_list ?M) = reachable_states ?M

goal (1 subgoal):
 1. list.set (map V (reachable_states_as_list M1)) = V ` reachable_states M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
list.set rstates = V ` reachable_states M1

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
list.set rstates = V ` reachable_states M1
[PROOF STEP]
have "V ` reachable_states M1 \<subseteq> list.set rstates"
[PROOF STATE]
proof (prove)
using this:
list.set rstates = V ` reachable_states M1

goal (1 subgoal):
 1. V ` reachable_states M1 \<subseteq> list.set rstates
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
V ` reachable_states M1 \<subseteq> list.set rstates

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have "preserves_divergence M1 M2 (list.set rstates)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set rstates)
[PROOF STEP]
unfolding rstates_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set (map V (reachable_states_as_list M1)))
[PROOF STEP]
using a10
[PROOF STATE]
proof (prove)
using this:
preserves_divergence M1 M2 (V ` reachable_states M1)

goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set (map V (reachable_states_as_list M1)))
[PROOF STEP]
by (metis image_set reachable_states_as_list_set)
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (list.set rstates)

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
preserves_divergence M1 M2 (list.set rstates)
[PROOF STEP]
have "preserves_divergence M1 M2 (V ` reachable_states M1)"
[PROOF STATE]
proof (prove)
using this:
preserves_divergence M1 M2 (list.set rstates)

goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1)
[PROOF STEP]
unfolding \<open>list.set rstates = V ` reachable_states M1\<close>
[PROOF STATE]
proof (prove)
using this:
preserves_divergence M1 M2 (V ` reachable_states M1)

goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (V ` reachable_states M1)

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have "(\<And>w. w \<in> list.set rstates \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>w. w \<in> list.set rstates \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>w. w \<in> list.set rstates \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'
[PROOF STEP]
fix w
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>w. w \<in> list.set rstates \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'
[PROOF STEP]
assume "w \<in> list.set rstates"
[PROOF STATE]
proof (state)
this:
w \<in> list.set rstates

goal (1 subgoal):
 1. \<And>w. w \<in> list.set rstates \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
w \<in> list.set rstates
[PROOF STEP]
obtain q where "w = V q" and "q \<in> reachable_states M1"
[PROOF STATE]
proof (prove)
using this:
w \<in> list.set rstates

goal (1 subgoal):
 1. (\<And>q. \<lbrakk>w = V q; q \<in> reachable_states M1\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding rstates_def
[PROOF STATE]
proof (prove)
using this:
w \<in> list.set (map V (reachable_states_as_list M1))

goal (1 subgoal):
 1. (\<And>q. \<lbrakk>w = V q; q \<in> reachable_states M1\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using reachable_states_as_list_set
[PROOF STATE]
proof (prove)
using this:
w \<in> list.set (map V (reachable_states_as_list M1))
list.set (reachable_states_as_list ?M) = reachable_states ?M

goal (1 subgoal):
 1. (\<And>q. \<lbrakk>w = V q; q \<in> reachable_states M1\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
w = V q
q \<in> reachable_states M1

goal (1 subgoal):
 1. \<And>w. w \<in> list.set rstates \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
w = V q
q \<in> reachable_states M1
[PROOF STEP]
have "w \<in> L M1" and "w \<in> set T"
[PROOF STATE]
proof (prove)
using this:
w = V q
q \<in> reachable_states M1

goal (1 subgoal):
 1. w \<in> L M1 &&& w \<in> Prefix_Tree.set T
[PROOF STEP]
using is_state_cover_assignment_language[OF a09] a11
[PROOF STATE]
proof (prove)
using this:
w = V q
q \<in> reachable_states M1
?q \<in> reachable_states M1 \<Longrightarrow> V ?q \<in> L M1
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T

goal (1 subgoal):
 1. w \<in> L M1 &&& w \<in> Prefix_Tree.set T
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
w \<in> L M1
w \<in> Prefix_Tree.set T

goal (1 subgoal):
 1. \<And>w. w \<in> list.set rstates \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
w \<in> L M1
w \<in> Prefix_Tree.set T
[PROOF STEP]
have "w \<in> L M2"
[PROOF STATE]
proof (prove)
using this:
w \<in> L M1
w \<in> Prefix_Tree.set T

goal (1 subgoal):
 1. w \<in> L M2
[PROOF STEP]
using pass_T
[PROOF STATE]
proof (prove)
using this:
w \<in> L M1
w \<in> Prefix_Tree.set T
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T

goal (1 subgoal):
 1. w \<in> L M2
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
w \<in> L M2

goal (1 subgoal):
 1. \<And>w. w \<in> list.set rstates \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
w \<in> L M2
[PROOF STEP]
have "converge M1 w w" and "converge M2 w w"
[PROOF STATE]
proof (prove)
using this:
w \<in> L M2

goal (1 subgoal):
 1. converge M1 w w &&& converge M2 w w
[PROOF STEP]
using \<open>w \<in> L M1\<close>
[PROOF STATE]
proof (prove)
using this:
w \<in> L M2
w \<in> L M1

goal (1 subgoal):
 1. converge M1 w w &&& converge M2 w w
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M1 w w
converge M2 w w

goal (1 subgoal):
 1. \<And>w. w \<in> list.set rstates \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
converge M1 w w
converge M2 w w
[PROOF STEP]
show "\<exists>w'. converge M1 w w' \<and> converge M2 w w'"
[PROOF STATE]
proof (prove)
using this:
converge M1 w w
converge M2 w w

goal (1 subgoal):
 1. \<exists>w'. converge M1 w w' \<and> converge M2 w w'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>w'. converge M1 w w' \<and> converge M2 w w'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?w \<in> list.set rstates \<Longrightarrow> \<exists>w'. converge M1 ?w w' \<and> converge M2 ?w w'

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have "L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1
[PROOF STEP]
by (meson a11 inter_eq_subsetI pass_T)
[PROOF STATE]
proof (state)
this:
L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have "converge M1 u v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. converge M1 u v
[PROOF STEP]
unfolding u_def v_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. converge M1 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
using a01 a09 a12 a13 state_cover_transition_converges
[PROOF STATE]
proof (prove)
using this:
observable M1
is_state_cover_assignment M1 V
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1
\<lbrakk>observable ?M; is_state_cover_assignment ?M ?V; ?t \<in> FSM.transitions ?M; t_source ?t \<in> reachable_states ?M\<rbrakk> \<Longrightarrow> converge ?M (?V (t_source ?t) @ [(t_input ?t, t_output ?t)]) (?V (t_target ?t))

goal (1 subgoal):
 1. converge M1 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
converge M1 u v

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have "u \<in> L M2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. u \<in> L M2
[PROOF STEP]
using distribute_extension_adds_sequence(1)[OF a01 a03 \<open>(V (t_source t)) \<in> L M1\<close> \<open>(V (t_source t)) \<in> L M2\<close> a14 a15, of T "[(t_input t, t_output t)]" b heuristic, OF _ heuristic_prop]
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic)) \<Longrightarrow> \<exists>u'. converge M1 (V (t_source t)) u' \<and> u' @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic)) \<and> converge M2 (V (t_source t)) u'

goal (1 subgoal):
 1. u \<in> L M2
[PROOF STEP]
using pass_T1
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic)) \<Longrightarrow> \<exists>u'. converge M1 (V (t_source t)) u' \<and> u' @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic)) \<and> converge M2 (V (t_source t)) u'
L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1

goal (1 subgoal):
 1. u \<in> L M2
[PROOF STEP]
unfolding T1_def G1_def handle_io_pair_def
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic)) \<Longrightarrow> \<exists>u'. converge M1 (V (t_source t)) u' \<and> u' @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic)) \<and> converge M2 (V (t_source t)) u'
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b (if c then append_heuristic_input M1 else append_heuristic_io))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b (if c then append_heuristic_input M1 else append_heuristic_io)))

goal (1 subgoal):
 1. u \<in> L M2
[PROOF STEP]
unfolding heuristic_def[symmetric]
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic)) \<Longrightarrow> \<exists>u'. converge M1 (V (t_source t)) u' \<and> u' @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic)) \<and> converge M2 (V (t_source t)) u'
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) [(t_input t, t_output t)] b heuristic))

goal (1 subgoal):
 1. u \<in> L M2
[PROOF STEP]
by (metis (no_types, lifting) Int_iff \<open>V (t_target t) \<in> L M1\<close> \<open>converge M1 u v\<close> a01 a02 append_Nil2 converge_append_language_iff u_def v_def)
[PROOF STATE]
proof (state)
this:
u \<in> L M2

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have "(u = v) = False"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (u = v) = False
[PROOF STEP]
unfolding u_def v_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)) = False
[PROOF STEP]
using a19
[PROOF STATE]
proof (prove)
using this:
V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t)

goal (1 subgoal):
 1. (V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)) = False
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(u = v) = False

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have "after_initial M1 u = t_target t"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. after_initial M1 u = t_target t
[PROOF STEP]
using a09
[PROOF STATE]
proof (prove)
using this:
is_state_cover_assignment M1 V

goal (1 subgoal):
 1. after_initial M1 u = t_target t
[PROOF STEP]
unfolding u_def
[PROOF STATE]
proof (prove)
using this:
is_state_cover_assignment M1 V

goal (1 subgoal):
 1. after_initial M1 (V (t_source t) @ [(t_input t, t_output t)]) = t_target t
[PROOF STEP]
by (metis \<open>converge M1 u v\<close> \<open>t_target t \<in> reachable_states M1\<close> a01 a03 converge.elims(2) convergence_minimal is_state_cover_assignment_observable_after u_def v_def)
[PROOF STATE]
proof (state)
this:
after_initial M1 u = t_target t

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have "\<And> \<gamma> x y . {u @ \<omega>' | \<omega>'. \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} \<subseteq> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<gamma> x y. {u @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} \<subseteq> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
{u @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes (?\<gamma> @ [(?x, ?y)]))} \<subseteq> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma> @ [(?x, ?y)]))}

goal (1 subgoal):
 1. \<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
show "(\<forall> \<gamma> . (length \<gamma> \<le> (m-size_r M1) \<and> list.set \<gamma> \<subseteq> inputs M1 \<times> outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t))
                      \<longrightarrow> ((L M1 \<inter> (V ` reachable_states M1 \<union> {((V (t_source t))@[(t_input t,t_output t)]) @ \<omega>' | \<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
                            = L M2 \<inter> (V ` reachable_states M1 \<union> {((V (t_source t))@[(t_input t,t_output t)]) @ \<omega>' | \<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}))
                           \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {((V (t_source t))@[(t_input t,t_output t)]) @ \<omega>' | \<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})))
              \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd ?TG)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
proof (cases "d M1 V t X' l")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
 2. \<not> d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
d M1 V t X' l

goal (2 subgoals):
 1. d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
 2. \<not> d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
d M1 V t X' l
[PROOF STEP]
have "?TG = (T2,G3)"
[PROOF STATE]
proof (prove)
using this:
d M1 V t X' l

goal (1 subgoal):
 1. snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X) = (T2, G3)
[PROOF STEP]
unfolding TG_cases
[PROOF STATE]
proof (prove)
using this:
d M1 V t X' l

goal (1 subgoal):
 1. (if d M1 V t X' l then (T2, G3) else (TH, GH)) = (T2, G3)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X) = (T2, G3)

goal (2 subgoals):
 1. d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
 2. \<not> d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have pass_T2: "L M1 \<inter> set T2 = L M2 \<inter> set T2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set T2 = L M2 \<inter> Prefix_Tree.set T2
[PROOF STEP]
using a17
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set T2 = L M2 \<inter> Prefix_Tree.set T2
[PROOF STEP]
unfolding \<open>?TG = (T2,G3)\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (T2, G3)) = L M2 \<inter> Prefix_Tree.set (fst (T2, G3))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set T2 = L M2 \<inter> Prefix_Tree.set T2
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set T2 = L M2 \<inter> Prefix_Tree.set T2

goal (2 subgoals):
 1. d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
 2. \<not> d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have "convergence_graph_lookup_invar M1 M2 cg_lookup G2"
        and  "converge M2 u v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup G2 &&& converge M2 u v
[PROOF STEP]
using pass_T2
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set T2 = L M2 \<inter> Prefix_Tree.set T2

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup G2 &&& converge M2 u v
[PROOF STEP]
using distinguish_from_set_establishes_convergence[OF a01 a02 a03 a04 a05 a06 a07 a08 a09 \<open>preserves_divergence M1 M2 (V ` reachable_states M1)\<close> \<open>L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1\<close> \<open>converge M1 u v\<close> \<open>u \<in> L M2\<close> \<open>v \<in> L M2\<close> \<open>convergence_graph_lookup_invar M1 M2 cg_lookup G1\<close> a15 assms, of T1 k b heuristic, OF _ _ _ _ heuristic_prop]
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set T2 = L M2 \<inter> Prefix_Tree.set T2
\<lbrakk>\<And>q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v (map V (reachable_states_as_list M1)) k (m - size_r M1) b heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v (map V (reachable_states_as_list M1)) k (m - size_r M1) b heuristic (u = v)))\<rbrakk> \<Longrightarrow> converge M2 u v
\<lbrakk>\<And>q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v (map V (reachable_states_as_list M1)) k (m - size_r M1) b heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v (map V (reachable_states_as_list M1)) k (m - size_r M1) b heuristic (u = v)))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v (map V (reachable_states_as_list M1)) k (m - size_r M1) b heuristic (u = v)))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup G2 &&& converge M2 u v
[PROOF STEP]
unfolding G2_def T2_def \<open>(u = v) = False\<close> rstates_def[symmetric] l_def[symmetric]
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False)) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False))
\<lbrakk>\<And>q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False)) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False))\<rbrakk> \<Longrightarrow> converge M2 u v
\<lbrakk>\<And>q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False)) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False)) &&& converge M2 u v
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup G2
converge M2 u v

goal (2 subgoals):
 1. d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
 2. \<not> d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
convergence_graph_lookup_invar M1 M2 cg_lookup G2
converge M2 u v
[PROOF STEP]
have "convergence_graph_lookup_invar M1 M2 cg_lookup (snd ?TG)"
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup G2
converge M2 u v

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
unfolding \<open>?TG = (T2,G3)\<close> G3_def snd_conv
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup G2
converge M2 u v

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (cg_merge G2 u v)
[PROOF STEP]
using a16
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup G2
converge M2 u v
convergence_graph_merge_invar M1 M2 cg_lookup cg_merge

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (cg_merge G2 u v)
[PROOF STEP]
by (meson \<open>converge M1 u v\<close> convergence_graph_merge_invar_def)
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))

goal (2 subgoals):
 1. d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
 2. \<not> d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have cons_prop: "\<And>\<gamma> x y.
                           length (\<gamma> @ [(x, y)]) \<le> l \<Longrightarrow>
                           \<gamma> \<in> LS M1 (after_initial M1 u) \<Longrightarrow>
                           x \<in> FSM.inputs M1 \<Longrightarrow>
                           y \<in> FSM.outputs M1 \<Longrightarrow>
                           L M1 \<inter> (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) =
                           L M2 \<inter> (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and>
                           preserves_divergence M1 M2 (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})"
         and nil_prop: "preserves_divergence M1 M2 (list.set rstates \<union> {u, v})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> l; \<gamma> \<in> LS M1 (after_initial M1 u); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) &&& preserves_divergence M1 M2 (list.set rstates \<union> {u, v})
[PROOF STEP]
using pass_T2
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set T2 = L M2 \<inter> Prefix_Tree.set T2

goal (1 subgoal):
 1. (\<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> l; \<gamma> \<in> LS M1 (after_initial M1 u); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) &&& preserves_divergence M1 M2 (list.set rstates \<union> {u, v})
[PROOF STEP]
using distinguish_from_set_properties(1,2)[OF a01 a02 a03 a04 a07 a08 a09 \<open>V ` reachable_states M1 \<subseteq> list.set rstates\<close> \<open>preserves_divergence M1 M2 (list.set rstates)\<close> \<open>(\<And>w. w \<in> list.set rstates \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w')\<close> \<open>converge M1 u v\<close> \<open>u \<in> L M2\<close> \<open>v \<in> L M2\<close> \<open>convergence_graph_lookup_invar M1 M2 cg_lookup G1\<close> a15 assms, of T1 k l b heuristic, OF _ _ _ _ _ heuristic_prop ]
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set T2 = L M2 \<inter> Prefix_Tree.set T2
\<lbrakk>\<And>w. w \<in> list.set rstates \<Longrightarrow> w \<in> list.set rstates; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic (u = v)))\<rbrakk> \<Longrightarrow> \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> l \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
\<lbrakk>\<And>w. w \<in> list.set rstates \<Longrightarrow> w \<in> list.set rstates; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic (u = v)))\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (list.set rstates \<union> {u, v})

goal (1 subgoal):
 1. (\<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> l; \<gamma> \<in> LS M1 (after_initial M1 u); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) &&& preserves_divergence M1 M2 (list.set rstates \<union> {u, v})
[PROOF STEP]
unfolding G2_def T2_def \<open>(u = v) = False\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False)) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False))
\<lbrakk>\<And>w. w \<in> list.set rstates \<Longrightarrow> w \<in> list.set rstates; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False)) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False))\<rbrakk> \<Longrightarrow> \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> l \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
\<lbrakk>\<And>w. w \<in> list.set rstates \<Longrightarrow> w \<in> list.set rstates; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False)) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u v rstates k l b heuristic False))\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (list.set rstates \<union> {u, v})

goal (1 subgoal):
 1. (\<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> l; \<gamma> \<in> LS M1 (after_initial M1 u); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) &&& preserves_divergence M1 M2 (list.set rstates \<union> {u, v})
[PROOF STEP]
by presburger+
[PROOF STATE]
proof (state)
this:
\<lbrakk>length (?\<gamma> @ [(?x, ?y)]) \<le> l; ?\<gamma> \<in> LS M1 (after_initial M1 u); ?x \<in> FSM.inputs M1; ?y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma> @ [(?x, ?y)]))}) = L M2 \<inter> (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma> @ [(?x, ?y)]))}) \<and> preserves_divergence M1 M2 (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma> @ [(?x, ?y)]))})
preserves_divergence M1 M2 (list.set rstates \<union> {u, v})

goal (2 subgoals):
 1. d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
 2. \<not> d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have "\<And> \<gamma> . (length \<gamma> \<le> (m-size_r M1) \<and> list.set \<gamma> \<subseteq> inputs M1 \<times> outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t))
                      \<Longrightarrow> ((L M1 \<inter> (V ` reachable_states M1 \<union> {((V (t_source t))@[(t_input t,t_output t)]) @ \<omega>' | \<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
                            = L M2 \<inter> (V ` reachable_states M1 \<union> {((V (t_source t))@[(t_input t,t_output t)]) @ \<omega>' | \<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}))
                           \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {((V (t_source t))@[(t_input t,t_output t)]) @ \<omega>' | \<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}))"
          (is "\<And> \<gamma> . (length \<gamma> \<le> (m-size_r M1) \<and> list.set \<gamma> \<subseteq> inputs M1 \<times> outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t)) \<Longrightarrow> ?P1 \<gamma> \<and> ?P2 \<gamma>")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
fix \<gamma>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
assume assm:"(length \<gamma> \<le> (m-size_r M1) \<and> list.set \<gamma> \<subseteq> inputs M1 \<times> outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t))"
[PROOF STATE]
proof (state)
this:
length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t)

goal (1 subgoal):
 1. \<And>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
show "?P1 \<gamma> \<and> ?P2 \<gamma>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
proof (cases \<gamma> rule: rev_cases)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<gamma> = [] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
 2. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
\<gamma> = []

goal (2 subgoals):
 1. \<gamma> = [] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
 2. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
have *: "(V ` reachable_states M1 \<union> {((V (t_source t))@[(t_input t,t_output t)]) @ \<omega>' | \<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
                        = (V ` reachable_states M1 \<union> {u})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)} = V ` reachable_states M1 \<union> {u}
[PROOF STEP]
unfolding u_def[symmetric] \<open>list.set rstates = V ` reachable_states M1\<close> Nil
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V ` reachable_states M1 \<union> {u @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes [])} = V ` reachable_states M1 \<union> {u}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)} = V ` reachable_states M1 \<union> {u}

goal (2 subgoals):
 1. \<gamma> = [] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
 2. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
have "?P1 \<gamma>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
using \<open>L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1\<close>
                    \<open>u \<in> L M1\<close> \<open>u \<in> L M2\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1
u \<in> L M1
u \<in> L M2

goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
unfolding *
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1
u \<in> L M1
u \<in> L M2

goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {u}) = L M2 \<inter> (V ` reachable_states M1 \<union> {u})
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})

goal (2 subgoals):
 1. \<gamma> = [] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
 2. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})

goal (2 subgoals):
 1. \<gamma> = [] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
 2. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
have "?P2 \<gamma>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
using preserves_divergence_subset[OF nil_prop]
[PROOF STATE]
proof (prove)
using this:
?A \<subseteq> list.set rstates \<union> {u, v} \<Longrightarrow> preserves_divergence M1 M2 ?A

goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
unfolding * \<open>list.set rstates = V ` reachable_states M1\<close>
[PROOF STATE]
proof (prove)
using this:
?A \<subseteq> V ` reachable_states M1 \<union> {u, v} \<Longrightarrow> preserves_divergence M1 M2 ?A

goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {u})
[PROOF STEP]
by (metis Un_empty_right Un_insert_right Un_upper1 insertI1 insert_subsetI)
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})

goal (2 subgoals):
 1. \<gamma> = [] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
 2. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})

goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})

goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
case (snoc \<gamma>' xy)
[PROOF STATE]
proof (state)
this:
\<gamma> = \<gamma>' @ [xy]

goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<gamma> = \<gamma>' @ [xy]

goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
obtain x y where "xy = (x,y)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>x y. xy = (x, y) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using prod.exhaust
[PROOF STATE]
proof (prove)
using this:
(\<And>x1 x2. ?y = (x1, x2) \<Longrightarrow> ?P) \<Longrightarrow> ?P

goal (1 subgoal):
 1. (\<And>x y. xy = (x, y) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
xy = (x, y)

goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<gamma> = \<gamma>' @ [xy]
xy = (x, y)
[PROOF STEP]
have "\<gamma> = \<gamma>'@[(x,y)]"
[PROOF STATE]
proof (prove)
using this:
\<gamma> = \<gamma>' @ [xy]
xy = (x, y)

goal (1 subgoal):
 1. \<gamma> = \<gamma>' @ [(x, y)]
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<gamma> = \<gamma>' @ [(x, y)]

goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
have *: "(V ` reachable_states M1 \<union> {u @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<subseteq> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V ` reachable_states M1 \<union> {u @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)} \<subseteq> V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V ` reachable_states M1 \<union> {u @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)} \<subseteq> V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)}

goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
have "length (\<gamma>' @ [(x, y)]) \<le> l"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length (\<gamma>' @ [(x, y)]) \<le> l
[PROOF STEP]
using assm
[PROOF STATE]
proof (prove)
using this:
length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t)

goal (1 subgoal):
 1. length (\<gamma>' @ [(x, y)]) \<le> l
[PROOF STEP]
unfolding l_def \<open>\<gamma> = \<gamma>'@[(x,y)]\<close>
[PROOF STATE]
proof (prove)
using this:
length (\<gamma>' @ [(x, y)]) \<le> m - size_r M1 \<and> list.set (\<gamma>' @ [(x, y)]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast (\<gamma>' @ [(x, y)]) \<in> LS M1 (t_target t)

goal (1 subgoal):
 1. length (\<gamma>' @ [(x, y)]) \<le> m - size_r M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
length (\<gamma>' @ [(x, y)]) \<le> l

goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
length (\<gamma>' @ [(x, y)]) \<le> l

goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
have "\<gamma>' \<in> LS M1 (after_initial M1 u)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<gamma>' \<in> LS M1 (after_initial M1 u)
[PROOF STEP]
using assm
[PROOF STATE]
proof (prove)
using this:
length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t)

goal (1 subgoal):
 1. \<gamma>' \<in> LS M1 (after_initial M1 u)
[PROOF STEP]
unfolding l_def \<open>\<gamma> = \<gamma>'@[(x,y)]\<close>
[PROOF STATE]
proof (prove)
using this:
length (\<gamma>' @ [(x, y)]) \<le> m - size_r M1 \<and> list.set (\<gamma>' @ [(x, y)]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast (\<gamma>' @ [(x, y)]) \<in> LS M1 (t_target t)

goal (1 subgoal):
 1. \<gamma>' \<in> LS M1 (after_initial M1 u)
[PROOF STEP]
by (simp add: \<open>after_initial M1 u = t_target t\<close>)
[PROOF STATE]
proof (state)
this:
\<gamma>' \<in> LS M1 (after_initial M1 u)

goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<gamma>' \<in> LS M1 (after_initial M1 u)

goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
have "x \<in> FSM.inputs M1" and "y \<in> FSM.outputs M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<in> FSM.inputs M1 &&& y \<in> FSM.outputs M1
[PROOF STEP]
using assm
[PROOF STATE]
proof (prove)
using this:
length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t)

goal (1 subgoal):
 1. x \<in> FSM.inputs M1 &&& y \<in> FSM.outputs M1
[PROOF STEP]
unfolding \<open>\<gamma> = \<gamma>'@[(x,y)]\<close>
[PROOF STATE]
proof (prove)
using this:
length (\<gamma>' @ [(x, y)]) \<le> m - size_r M1 \<and> list.set (\<gamma>' @ [(x, y)]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast (\<gamma>' @ [(x, y)]) \<in> LS M1 (t_target t)

goal (1 subgoal):
 1. x \<in> FSM.inputs M1 &&& y \<in> FSM.outputs M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1

goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
length (\<gamma>' @ [(x, y)]) \<le> l
\<gamma>' \<in> LS M1 (after_initial M1 u)
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
length (\<gamma>' @ [(x, y)]) \<le> l
\<gamma>' \<in> LS M1 (after_initial M1 u)
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1

goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
using cons_prop[of \<gamma>' x y] preserves_divergence_subset[of M1 M2 "(V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)})", OF _ *]
[PROOF STATE]
proof (prove)
using this:
length (\<gamma>' @ [(x, y)]) \<le> l
\<gamma>' \<in> LS M1 (after_initial M1 u)
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1
\<lbrakk>length (\<gamma>' @ [(x, y)]) \<le> l; \<gamma>' \<in> LS M1 (after_initial M1 u); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma>' @ [(x, y)]))}) = L M2 \<inter> (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma>' @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma>' @ [(x, y)]))})
preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)}) \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {u @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})

goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
unfolding \<open>\<gamma> = \<gamma>'@[(x,y)]\<close>[symmetric] u_def[symmetric] \<open>list.set rstates = V ` reachable_states M1\<close>
[PROOF STATE]
proof (prove)
using this:
length \<gamma> \<le> l
\<gamma>' \<in> LS M1 (after_initial M1 u)
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1
\<lbrakk>length \<gamma> \<le> l; \<gamma>' \<in> LS M1 (after_initial M1 u); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)})
preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)}) \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {u @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})

goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {u @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {u @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {u @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
length ?\<gamma> \<le> m - size_r M1 \<and> list.set ?\<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast ?\<gamma> \<in> LS M1 (t_target t) \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)})

goal (2 subgoals):
 1. d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
 2. \<not> d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
length ?\<gamma> \<le> m - size_r M1 \<and> list.set ?\<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast ?\<gamma> \<in> LS M1 (t_target t) \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)})
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
length ?\<gamma> \<le> m - size_r M1 \<and> list.set ?\<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast ?\<gamma> \<in> LS M1 (t_target t) \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)})

goal (1 subgoal):
 1. (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
using \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd ?TG)\<close>
[PROOF STATE]
proof (prove)
using this:
length ?\<gamma> \<le> m - size_r M1 \<and> list.set ?\<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast ?\<gamma> \<in> LS M1 (t_target t) \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)})
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))

goal (1 subgoal):
 1. (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
(\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))

goal (1 subgoal):
 1. \<not> d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> d M1 V t X' l

goal (1 subgoal):
 1. \<not> d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> d M1 V t X' l
[PROOF STEP]
have "?TG = (TH,GH)"
[PROOF STATE]
proof (prove)
using this:
\<not> d M1 V t X' l

goal (1 subgoal):
 1. snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X) = (TH, GH)
[PROOF STEP]
unfolding TG_cases
[PROOF STATE]
proof (prove)
using this:
\<not> d M1 V t X' l

goal (1 subgoal):
 1. (if d M1 V t X' l then (T2, G3) else (TH, GH)) = (TH, GH)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X) = (TH, GH)

goal (1 subgoal):
 1. \<not> d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have pass_TH: "L M1 \<inter> set TH = L M2 \<inter> set TH"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set TH = L M2 \<inter> Prefix_Tree.set TH
[PROOF STEP]
using a17
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set TH = L M2 \<inter> Prefix_Tree.set TH
[PROOF STEP]
unfolding \<open>?TG = (TH,GH)\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (TH, GH)) = L M2 \<inter> Prefix_Tree.set (fst (TH, GH))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set TH = L M2 \<inter> Prefix_Tree.set TH
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set TH = L M2 \<inter> Prefix_Tree.set TH

goal (1 subgoal):
 1. \<not> d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have "converge M1 u u"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. converge M1 u u
[PROOF STEP]
using \<open>u \<in> L M1\<close>
[PROOF STATE]
proof (prove)
using this:
u \<in> L M1

goal (1 subgoal):
 1. converge M1 u u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M1 u u

goal (1 subgoal):
 1. \<not> d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have cons_prop: "\<And>\<gamma> x y.
                           length (\<gamma> @ [(x, y)]) \<le> l \<Longrightarrow>
                           \<gamma> \<in> LS M1 (t_target t) \<Longrightarrow>
                           x \<in> FSM.inputs M1 \<Longrightarrow>
                           y \<in> FSM.outputs M1 \<Longrightarrow>
                           L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) =
                           L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and>
                           preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})"
        and  nil_prop: "preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {u,u})"
        and  "convergence_graph_lookup_invar M1 M2 cg_lookup (snd ?TG)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> l; \<gamma> \<in> LS M1 (t_target t); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) &&& preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {u, u}) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
using pass_TH
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set TH = L M2 \<inter> Prefix_Tree.set TH

goal (1 subgoal):
 1. (\<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> l; \<gamma> \<in> LS M1 (t_target t); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) &&& preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {u, u}) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
using distinguish_from_set_properties[OF a01 a02 a03 a04 a07 a08 a09 \<open>V ` reachable_states M1 \<subseteq> list.set rstates\<close> \<open>preserves_divergence M1 M2 (list.set rstates)\<close> \<open>(\<And>w. w \<in> list.set rstates \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w')\<close> \<open>converge M1 u u\<close> \<open>u \<in> L M2\<close> \<open>u \<in> L M2\<close> \<open>convergence_graph_lookup_invar M1 M2 cg_lookup G1\<close> a15 assms, of T1 k l b heuristic, OF _ _ _ _ _ heuristic_prop ]
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set TH = L M2 \<inter> Prefix_Tree.set TH
\<lbrakk>\<And>w. w \<in> list.set rstates \<Longrightarrow> w \<in> list.set rstates; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic (u = u))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic (u = u)))\<rbrakk> \<Longrightarrow> \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> l \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
\<lbrakk>\<And>w. w \<in> list.set rstates \<Longrightarrow> w \<in> list.set rstates; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic (u = u))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic (u = u)))\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (list.set rstates \<union> {u, u})
\<lbrakk>\<And>w. w \<in> list.set rstates \<Longrightarrow> w \<in> list.set rstates; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic (u = u))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic (u = u)))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic (u = u)))

goal (1 subgoal):
 1. (\<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> l; \<gamma> \<in> LS M1 (t_target t); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) &&& preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {u, u}) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
unfolding \<open>?TG = (TH,GH)\<close> snd_conv
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set TH = L M2 \<inter> Prefix_Tree.set TH
\<lbrakk>\<And>w. w \<in> list.set rstates \<Longrightarrow> w \<in> list.set rstates; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic (u = u))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic (u = u)))\<rbrakk> \<Longrightarrow> \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> l \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set rstates \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
\<lbrakk>\<And>w. w \<in> list.set rstates \<Longrightarrow> w \<in> list.set rstates; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic (u = u))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic (u = u)))\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (list.set rstates \<union> {u, u})
\<lbrakk>\<And>w. w \<in> list.set rstates \<Longrightarrow> w \<in> list.set rstates; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic (u = u))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic (u = u)))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic (u = u)))

goal (1 subgoal):
 1. (\<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> l; \<gamma> \<in> LS M1 (t_target t); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) &&& preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {u, u}) &&& convergence_graph_lookup_invar M1 M2 cg_lookup GH
[PROOF STEP]
unfolding GH_def TH_def \<open>list.set rstates = V ` reachable_states M1\<close> \<open>after_initial M1 u = t_target t\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True)) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True))
\<lbrakk>\<And>w. w \<in> V ` reachable_states M1 \<Longrightarrow> w \<in> V ` reachable_states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic (u = u))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic (u = u)))\<rbrakk> \<Longrightarrow> \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> l \<longrightarrow> \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
\<lbrakk>\<And>w. w \<in> V ` reachable_states M1 \<Longrightarrow> w \<in> V ` reachable_states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic (u = u))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic (u = u)))\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {u, u})
\<lbrakk>\<And>w. w \<in> V ` reachable_states M1 \<Longrightarrow> w \<in> V ` reachable_states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic (u = u))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic (u = u)))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic (u = u)))

goal (1 subgoal):
 1. (\<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> l; \<gamma> \<in> LS M1 (t_target t); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) &&& preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {u, u}) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T1 G1 cg_lookup cg_insert dist_fun u u rstates k l b heuristic True))
[PROOF STEP]
by presburger+
[PROOF STATE]
proof (state)
this:
\<lbrakk>length (?\<gamma> @ [(?x, ?y)]) \<le> l; ?\<gamma> \<in> LS M1 (t_target t); ?x \<in> FSM.inputs M1; ?y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma> @ [(?x, ?y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma> @ [(?x, ?y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma> @ [(?x, ?y)]))})
preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {u, u})
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))

goal (1 subgoal):
 1. \<not> d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
have "\<And> \<gamma> . (length \<gamma> \<le> (m-size_r M1) \<and> list.set \<gamma> \<subseteq> inputs M1 \<times> outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t))
                      \<Longrightarrow> ((L M1 \<inter> (V ` reachable_states M1 \<union> {((V (t_source t))@[(t_input t,t_output t)]) @ \<omega>' | \<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
                            = L M2 \<inter> (V ` reachable_states M1 \<union> {((V (t_source t))@[(t_input t,t_output t)]) @ \<omega>' | \<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}))
                           \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {((V (t_source t))@[(t_input t,t_output t)]) @ \<omega>' | \<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}))"
          (is "\<And> \<gamma> . (length \<gamma> \<le> (m-size_r M1) \<and> list.set \<gamma> \<subseteq> inputs M1 \<times> outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t)) \<Longrightarrow> ?P1 \<gamma> \<and> ?P2 \<gamma>")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
fix \<gamma>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
assume assm:"(length \<gamma> \<le> (m-size_r M1) \<and> list.set \<gamma> \<subseteq> inputs M1 \<times> outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t))"
[PROOF STATE]
proof (state)
this:
length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t)

goal (1 subgoal):
 1. \<And>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
show "?P1 \<gamma> \<and> ?P2 \<gamma>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
proof (cases \<gamma> rule: rev_cases)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<gamma> = [] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
 2. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
\<gamma> = []

goal (2 subgoals):
 1. \<gamma> = [] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
 2. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
have *: "(V ` reachable_states M1 \<union> {((V (t_source t))@[(t_input t,t_output t)]) @ \<omega>' | \<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
                        = (V ` reachable_states M1 \<union> {u})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)} = V ` reachable_states M1 \<union> {u}
[PROOF STEP]
unfolding u_def[symmetric] \<open>list.set rstates = V ` reachable_states M1\<close> Nil
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V ` reachable_states M1 \<union> {u @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes [])} = V ` reachable_states M1 \<union> {u}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)} = V ` reachable_states M1 \<union> {u}

goal (2 subgoals):
 1. \<gamma> = [] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
 2. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
have "?P1 \<gamma>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
using \<open>L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1\<close>
                    \<open>u \<in> L M1\<close> \<open>u \<in> L M2\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1
u \<in> L M1
u \<in> L M2

goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
unfolding *
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1
u \<in> L M1
u \<in> L M2

goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {u}) = L M2 \<inter> (V ` reachable_states M1 \<union> {u})
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})

goal (2 subgoals):
 1. \<gamma> = [] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
 2. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})

goal (2 subgoals):
 1. \<gamma> = [] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
 2. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
have "?P2 \<gamma>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
using nil_prop
[PROOF STATE]
proof (prove)
using this:
preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {u, u})

goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
unfolding *
[PROOF STATE]
proof (prove)
using this:
preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {u, u})

goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {u})
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})

goal (2 subgoals):
 1. \<gamma> = [] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
 2. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})

goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})

goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
case (snoc \<gamma>' xy)
[PROOF STATE]
proof (state)
this:
\<gamma> = \<gamma>' @ [xy]

goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<gamma> = \<gamma>' @ [xy]

goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
obtain x y where "xy = (x,y)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>x y. xy = (x, y) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using prod.exhaust
[PROOF STATE]
proof (prove)
using this:
(\<And>x1 x2. ?y = (x1, x2) \<Longrightarrow> ?P) \<Longrightarrow> ?P

goal (1 subgoal):
 1. (\<And>x y. xy = (x, y) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
xy = (x, y)

goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<gamma> = \<gamma>' @ [xy]
xy = (x, y)
[PROOF STEP]
have "\<gamma> = \<gamma>'@[(x,y)]"
[PROOF STATE]
proof (prove)
using this:
\<gamma> = \<gamma>' @ [xy]
xy = (x, y)

goal (1 subgoal):
 1. \<gamma> = \<gamma>' @ [(x, y)]
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<gamma> = \<gamma>' @ [(x, y)]

goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
have *: "{\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} = {u @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} = {u @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
{\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} = {u @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}

goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
have "length (\<gamma>' @ [(x, y)]) \<le> l"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length (\<gamma>' @ [(x, y)]) \<le> l
[PROOF STEP]
using assm
[PROOF STATE]
proof (prove)
using this:
length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t)

goal (1 subgoal):
 1. length (\<gamma>' @ [(x, y)]) \<le> l
[PROOF STEP]
unfolding l_def \<open>\<gamma> = \<gamma>'@[(x,y)]\<close>
[PROOF STATE]
proof (prove)
using this:
length (\<gamma>' @ [(x, y)]) \<le> m - size_r M1 \<and> list.set (\<gamma>' @ [(x, y)]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast (\<gamma>' @ [(x, y)]) \<in> LS M1 (t_target t)

goal (1 subgoal):
 1. length (\<gamma>' @ [(x, y)]) \<le> m - size_r M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
length (\<gamma>' @ [(x, y)]) \<le> l

goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
length (\<gamma>' @ [(x, y)]) \<le> l

goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
have "\<gamma>' \<in> LS M1 (t_target t)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<gamma>' \<in> LS M1 (t_target t)
[PROOF STEP]
using assm
[PROOF STATE]
proof (prove)
using this:
length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t)

goal (1 subgoal):
 1. \<gamma>' \<in> LS M1 (t_target t)
[PROOF STEP]
unfolding l_def \<open>\<gamma> = \<gamma>'@[(x,y)]\<close>
[PROOF STATE]
proof (prove)
using this:
length (\<gamma>' @ [(x, y)]) \<le> m - size_r M1 \<and> list.set (\<gamma>' @ [(x, y)]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast (\<gamma>' @ [(x, y)]) \<in> LS M1 (t_target t)

goal (1 subgoal):
 1. \<gamma>' \<in> LS M1 (t_target t)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<gamma>' \<in> LS M1 (t_target t)

goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<gamma>' \<in> LS M1 (t_target t)

goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
have "x \<in> FSM.inputs M1" and "y \<in> FSM.outputs M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<in> FSM.inputs M1 &&& y \<in> FSM.outputs M1
[PROOF STEP]
using assm
[PROOF STATE]
proof (prove)
using this:
length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t)

goal (1 subgoal):
 1. x \<in> FSM.inputs M1 &&& y \<in> FSM.outputs M1
[PROOF STEP]
unfolding \<open>\<gamma> = \<gamma>'@[(x,y)]\<close>
[PROOF STATE]
proof (prove)
using this:
length (\<gamma>' @ [(x, y)]) \<le> m - size_r M1 \<and> list.set (\<gamma>' @ [(x, y)]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast (\<gamma>' @ [(x, y)]) \<in> LS M1 (t_target t)

goal (1 subgoal):
 1. x \<in> FSM.inputs M1 &&& y \<in> FSM.outputs M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1

goal (1 subgoal):
 1. \<And>ys y. \<gamma> = ys @ [y] \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
length (\<gamma>' @ [(x, y)]) \<le> l
\<gamma>' \<in> LS M1 (t_target t)
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
length (\<gamma>' @ [(x, y)]) \<le> l
\<gamma>' \<in> LS M1 (t_target t)
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1

goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
using cons_prop[of \<gamma>' x y]
[PROOF STATE]
proof (prove)
using this:
length (\<gamma>' @ [(x, y)]) \<le> l
\<gamma>' \<in> LS M1 (t_target t)
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1
\<lbrakk>length (\<gamma>' @ [(x, y)]) \<le> l; \<gamma>' \<in> LS M1 (t_target t); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma>' @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma>' @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, u} \<and> \<omega>' \<in> list.set (prefixes (\<gamma>' @ [(x, y)]))})

goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
unfolding \<open>\<gamma> = \<gamma>'@[(x,y)]\<close>[symmetric] u_def[symmetric] \<open>list.set rstates = V ` reachable_states M1\<close> *
[PROOF STATE]
proof (prove)
using this:
length \<gamma> \<le> l
\<gamma>' \<in> LS M1 (t_target t)
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1
\<lbrakk>length \<gamma> \<le> l; \<gamma>' \<in> LS M1 (t_target t); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {u @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {u @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {u @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})

goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {u @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {u @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {u @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
length ?\<gamma> \<le> m - size_r M1 \<and> list.set ?\<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast ?\<gamma> \<in> LS M1 (t_target t) \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)})

goal (1 subgoal):
 1. \<not> d M1 V t X' l \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
length ?\<gamma> \<le> m - size_r M1 \<and> list.set ?\<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast ?\<gamma> \<in> LS M1 (t_target t) \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)})
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
length ?\<gamma> \<le> m - size_r M1 \<and> list.set ?\<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast ?\<gamma> \<in> LS M1 (t_target t) \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)})

goal (1 subgoal):
 1. (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
using \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd ?TG)\<close>
[PROOF STATE]
proof (prove)
using this:
length ?\<gamma> \<le> m - size_r M1 \<and> list.set ?\<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast ?\<gamma> \<in> LS M1 (t_target t) \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes ?\<gamma>)})
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))

goal (1 subgoal):
 1. (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
(\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))

goal (1 subgoal):
 1. \<And>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
show "?P T G m t X"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
using * ** ***
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
finite_tree T \<Longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))
\<lbrakk>observable M1; observable M2; minimal M1; minimal M2; size_r M1 \<le> m; FSM.size M2 \<le> m; FSM.inputs M2 = FSM.inputs M1; FSM.outputs M2 = FSM.outputs M1; is_state_cover_assignment M1 V; preserves_divergence M1 M2 (V ` reachable_states M1); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); convergence_graph_lookup_invar M1 M2 cg_lookup G; convergence_graph_insert_invar M1 M2 cg_lookup cg_insert; convergence_graph_merge_invar M1 M2 cg_lookup cg_merge; L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))); Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V ?T ?G cg_insert cg_lookup cg_merge ?m ?t ?X))) \<and> (finite_tree ?T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V ?T ?G cg_insert cg_lookup cg_merge ?m ?t ?X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> ?m \<longrightarrow> FSM.size M2 \<le> ?m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set ?T \<longrightarrow> ?t \<in> FSM.transitions M1 \<longrightarrow> t_source ?t \<in> reachable_states M1 \<longrightarrow> V (t_source ?t) @ [(t_input ?t, t_output ?t)] \<noteq> V (t_target ?t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup ?G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V ?T ?G cg_insert cg_lookup cg_merge ?m ?t ?X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V ?T ?G cg_insert cg_lookup cg_merge ?m ?t ?X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set ?T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> ?m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target ?t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source ?t) @ [(t_input ?t, t_output ?t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source ?t) @ [(t_input ?t, t_output ?t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source ?t) @ [(t_input ?t, t_output ?t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V ?T ?G cg_insert cg_lookup cg_merge ?m ?t ?X))))

goal (1 subgoal):
 1. handles_transition (handleUT_dynamic b c dist_fun d) M1 M2 V T0 cg_insert cg_lookup cg_merge
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V ?T ?G cg_insert cg_lookup cg_merge ?m ?t ?X))) \<and> (finite_tree ?T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V ?T ?G cg_insert cg_lookup cg_merge ?m ?t ?X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> ?m \<longrightarrow> FSM.size M2 \<le> ?m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set ?T \<longrightarrow> ?t \<in> FSM.transitions M1 \<longrightarrow> t_source ?t \<in> reachable_states M1 \<longrightarrow> V (t_source ?t) @ [(t_input ?t, t_output ?t)] \<noteq> V (t_target ?t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup ?G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V ?T ?G cg_insert cg_lookup cg_merge ?m ?t ?X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V ?T ?G cg_insert cg_lookup cg_merge ?m ?t ?X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set ?T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> ?m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target ?t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source ?t) @ [(t_input ?t, t_output ?t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source ?t) @ [(t_input ?t, t_output ?t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source ?t) @ [(t_input ?t, t_output ?t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V ?T ?G cg_insert cg_lookup cg_merge ?m ?t ?X))))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V ?T ?G cg_insert cg_lookup cg_merge ?m ?t ?X))) \<and> (finite_tree ?T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V ?T ?G cg_insert cg_lookup cg_merge ?m ?t ?X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> ?m \<longrightarrow> FSM.size M2 \<le> ?m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set ?T \<longrightarrow> ?t \<in> FSM.transitions M1 \<longrightarrow> t_source ?t \<in> reachable_states M1 \<longrightarrow> V (t_source ?t) @ [(t_input ?t, t_output ?t)] \<noteq> V (t_target ?t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup ?G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V ?T ?G cg_insert cg_lookup cg_merge ?m ?t ?X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V ?T ?G cg_insert cg_lookup cg_merge ?m ?t ?X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set ?T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> ?m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target ?t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source ?t) @ [(t_input ?t, t_output ?t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source ?t) @ [(t_input ?t, t_output ?t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source ?t) @ [(t_input ?t, t_output ?t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V ?T ?G cg_insert cg_lookup cg_merge ?m ?t ?X))))

goal (1 subgoal):
 1. handles_transition (handleUT_dynamic b c dist_fun d) M1 M2 V T0 cg_insert cg_lookup cg_merge
[PROOF STEP]
unfolding handles_transition_def
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V ?T ?G cg_insert cg_lookup cg_merge ?m ?t ?X))) \<and> (finite_tree ?T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V ?T ?G cg_insert cg_lookup cg_merge ?m ?t ?X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> ?m \<longrightarrow> FSM.size M2 \<le> ?m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set ?T \<longrightarrow> ?t \<in> FSM.transitions M1 \<longrightarrow> t_source ?t \<in> reachable_states M1 \<longrightarrow> V (t_source ?t) @ [(t_input ?t, t_output ?t)] \<noteq> V (t_target ?t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup ?G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V ?T ?G cg_insert cg_lookup cg_merge ?m ?t ?X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V ?T ?G cg_insert cg_lookup cg_merge ?m ?t ?X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set ?T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> ?m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target ?t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source ?t) @ [(t_input ?t, t_output ?t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source ?t) @ [(t_input ?t, t_output ?t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source ?t) @ [(t_input ?t, t_output ?t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V ?T ?G cg_insert cg_lookup cg_merge ?m ?t ?X))))

goal (1 subgoal):
 1. \<forall>T G m t X. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X)))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_merge_invar M1 M2 cg_lookup cg_merge \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) = L M2 \<inter> Prefix_Tree.set (fst (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))) \<longrightarrow> Prefix_Tree.set T0 \<subseteq> Prefix_Tree.set T \<longrightarrow> (\<forall>\<gamma>. length \<gamma> \<le> m - size_r M1 \<and> list.set \<gamma> \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1 \<and> butlast \<gamma> \<in> LS M1 (t_target t) \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) = L M2 \<inter> (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {(V (t_source t) @ [(t_input t, t_output t)]) @ \<omega>' |\<omega>'. \<omega>' \<in> list.set (prefixes \<gamma>)})) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (snd (handleUT_dynamic b c dist_fun d M1 V T G cg_insert cg_lookup cg_merge m t X))))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
handles_transition (handleUT_dynamic b c dist_fun d) M1 M2 V T0 cg_insert cg_lookup cg_merge

goal:
No subgoals!
[PROOF STEP]
qed