[STATEMENT]
lemma iunwinding_implies_view_partitioned1:
shows iview_partitioned
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. iview_partitioned
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. iview_partitioned
[PROOF STEP]
{
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. iview_partitioned
[PROOF STEP]
fix u execs execs2 s t n
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. iview_partitioned
[PROOF STEP]
have "does_not_communicate_with_gateway u execs \<and> iequivalent_states s t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n s execs) (run n t execs2) u"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. does_not_communicate_with_gateway u execs \<and> iequivalent_states s t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n s execs) (run n t execs2) u
[PROOF STEP]
proof (induct n s execs arbitrary: t u execs2 rule: run.induct)
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. \<And>s execs t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states s t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run 0 s execs) (run 0 t execs2) u
 2. \<And>n execs t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states None t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) None execs) (run (Suc n) t execs2) u
 3. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 5. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 6. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
case (1 s execs t u execs2)
[PROOF STATE]
proof (state)
this:

goal (6 subgoals):
 1. \<And>s execs t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states s t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run 0 s execs) (run 0 t execs2) u
 2. \<And>n execs t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states None t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) None execs) (run (Suc n) t execs2) u
 3. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 5. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 6. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. does_not_communicate_with_gateway u execs \<and> iequivalent_states s t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run 0 s execs) (run 0 t execs2) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
does_not_communicate_with_gateway u execs \<and> iequivalent_states s t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run 0 s execs) (run 0 t execs2) u

goal (5 subgoals):
 1. \<And>n execs t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states None t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) None execs) (run (Suc n) t execs2) u
 2. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 5. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>n execs t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states None t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) None execs) (run (Suc n) t execs2) u
 2. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 5. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
case (2 n execs t u execs2)
[PROOF STATE]
proof (state)
this:

goal (5 subgoals):
 1. \<And>n execs t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states None t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) None execs) (run (Suc n) t execs2) u
 2. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 5. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. does_not_communicate_with_gateway u execs \<and> iequivalent_states None t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) None execs) (run (Suc n) t execs2) u
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
does_not_communicate_with_gateway u execs \<and> iequivalent_states None t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) None execs) (run (Suc n) t execs2) u

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
case (3 n s execs t u execs2)
[PROOF STATE]
proof (state)
this:
interrupt (Suc n)
does_not_communicate_with_gateway ?u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) ?t ?u \<and> ipurged_relation1 ?u execs ?execs2.0 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n ?t ?execs2.0) ?u

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume interrupt_s: "interrupt (Suc n)"
[PROOF STATE]
proof (state)
this:
interrupt (Suc n)

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume IH: "(\<And>t u execs2. does_not_communicate_with_gateway u execs \<and>
           iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow>
           iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u)"
[PROOF STATE]
proof (state)
this:
does_not_communicate_with_gateway ?u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) ?t ?u \<and> ipurged_relation1 ?u execs ?execs2.0 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n ?t ?execs2.0) ?u

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
does_not_communicate_with_gateway ?u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) ?t ?u \<and> ipurged_relation1 ?u execs ?execs2.0 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n ?t ?execs2.0) ?u

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
fix t' :: 'state_t
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume "t = Some t'"
[PROOF STATE]
proof (state)
this:
t = Some t'

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
fix rs
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume rs: "run (Suc n) (Some s) execs = Some rs"
[PROOF STATE]
proof (state)
this:
run (Suc n) (Some s) execs = Some rs

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
fix rt
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume rt: "run (Suc n) (Some t') execs2 = Some rt"
[PROOF STATE]
proof (state)
this:
run (Suc n) (Some t') execs2 = Some rt

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume no_gateway_comm: "does_not_communicate_with_gateway u execs"
[PROOF STATE]
proof (state)
this:
does_not_communicate_with_gateway u execs

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume vpeq_s_t: "\<forall> v . ifp v u \<and> \<not>intermediary v u \<longrightarrow> vpeq v s t'"
[PROOF STATE]
proof (state)
this:
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume current_s_t: "current s = current t'"
[PROOF STATE]
proof (state)
this:
current s = current t'

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume purged_a_a2: "ipurged_relation1 u execs execs2"
[PROOF STATE]
proof (state)
this:
ipurged_relation1 u execs execs2

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from current_s_t cswitch_independent_of_state
[PROOF STATE]
proof (chain)
picking this:
current s = current t'
\<forall>n s t. current s = current t \<longrightarrow> current (cswitch n s) = current (cswitch n t)
[PROOF STEP]
have current_ns_nt: "current (cswitch (Suc n) s) = current (cswitch (Suc n) t')"
[PROOF STATE]
proof (prove)
using this:
current s = current t'
\<forall>n s t. current s = current t \<longrightarrow> current (cswitch n s) = current (cswitch n t)

goal (1 subgoal):
 1. current (cswitch (Suc n) s) = current (cswitch (Suc n) t')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
current (cswitch (Suc n) s) = current (cswitch (Suc n) t')

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from cswitch_consistency vpeq_s_t
[PROOF STATE]
proof (chain)
picking this:
\<forall>u s t n. vpeq u s t \<longrightarrow> vpeq u (cswitch n s) (cswitch n t)
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'
[PROOF STEP]
have vpeq_ns_nt: "\<forall> v . ifp v u \<and> \<not>intermediary v u \<longrightarrow> vpeq v (cswitch (Suc n) s) (cswitch (Suc n) t')"
[PROOF STATE]
proof (prove)
using this:
\<forall>u s t n. vpeq u s t \<longrightarrow> vpeq u (cswitch n s) (cswitch n t)
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'

goal (1 subgoal):
 1. \<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (cswitch (Suc n) s) (cswitch (Suc n) t')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (cswitch (Suc n) s) (cswitch (Suc n) t')

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from no_gateway_comm current_ns_nt vpeq_ns_nt interrupt_s vpeq_reflexive current_s_t purged_a_a2 IH[where u=u and t="Some (cswitch (Suc n) t')" and ?execs2.0=execs2]
[PROOF STATE]
proof (chain)
picking this:
does_not_communicate_with_gateway u execs
current (cswitch (Suc n) s) = current (cswitch (Suc n) t')
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (cswitch (Suc n) s) (cswitch (Suc n) t')
interrupt (Suc n)
\<forall>a u. vpeq u a a
current s = current t'
ipurged_relation1 u execs execs2
does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) (Some (cswitch (Suc n) t')) u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n (Some (cswitch (Suc n) t')) execs2) u
[PROOF STEP]
have current_rs_rt: "current rs = current rt"
[PROOF STATE]
proof (prove)
using this:
does_not_communicate_with_gateway u execs
current (cswitch (Suc n) s) = current (cswitch (Suc n) t')
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (cswitch (Suc n) s) (cswitch (Suc n) t')
interrupt (Suc n)
\<forall>a u. vpeq u a a
current s = current t'
ipurged_relation1 u execs execs2
does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) (Some (cswitch (Suc n) t')) u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n (Some (cswitch (Suc n) t')) execs2) u

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
does_not_communicate_with_gateway u execs
current (cswitch (Suc n) s) = current (cswitch (Suc n) t')
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (cswitch (Suc n) s) (cswitch (Suc n) t')
interrupt (Suc n)
\<forall>a u. vpeq u a a
current s = current t'
ipurged_relation1 u execs execs2
does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) (Some (cswitch (Suc n) t')) u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n (Some (cswitch (Suc n) t')) execs2) u
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
fix v
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume ia: "ifp v u \<and> \<not>intermediary v u"
[PROOF STATE]
proof (state)
this:
ifp v u \<and> \<not> intermediary v u

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from no_gateway_comm interrupt_s current_ns_nt vpeq_ns_nt vpeq_reflexive ia current_s_t purged_a_a2 IH[where u=u and t="Some (cswitch (Suc n) t')" and ?execs2.0=execs2]
[PROOF STATE]
proof (chain)
picking this:
does_not_communicate_with_gateway u execs
interrupt (Suc n)
current (cswitch (Suc n) s) = current (cswitch (Suc n) t')
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (cswitch (Suc n) s) (cswitch (Suc n) t')
\<forall>a u. vpeq u a a
ifp v u \<and> \<not> intermediary v u
current s = current t'
ipurged_relation1 u execs execs2
does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) (Some (cswitch (Suc n) t')) u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n (Some (cswitch (Suc n) t')) execs2) u
[PROOF STEP]
have "vpeq v rs rt"
[PROOF STATE]
proof (prove)
using this:
does_not_communicate_with_gateway u execs
interrupt (Suc n)
current (cswitch (Suc n) s) = current (cswitch (Suc n) t')
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (cswitch (Suc n) s) (cswitch (Suc n) t')
\<forall>a u. vpeq u a a
ifp v u \<and> \<not> intermediary v u
current s = current t'
ipurged_relation1 u execs execs2
does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) (Some (cswitch (Suc n) t')) u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n (Some (cswitch (Suc n) t')) execs2) u

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
does_not_communicate_with_gateway u execs
interrupt (Suc n)
current (cswitch (Suc n) s) = current (cswitch (Suc n) t')
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (cswitch (Suc n) s) (cswitch (Suc n) t')
\<forall>a u. vpeq u a a
ifp v u \<and> \<not> intermediary v u
current s = current t'
ipurged_relation1 u execs execs2
does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) (Some (cswitch (Suc n) t')) u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n (Some (cswitch (Suc n) t')) execs2) u
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
vpeq v rs rt

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
ifp ?v2 u \<and> \<not> intermediary ?v2 u \<Longrightarrow> vpeq ?v2 rs rt

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from current_rs_rt and this
[PROOF STATE]
proof (chain)
picking this:
current rs = current rt
ifp ?v2 u \<and> \<not> intermediary ?v2 u \<Longrightarrow> vpeq ?v2 rs rt
[PROOF STEP]
have "iequivalent_states (Some rs) (Some rt) u"
[PROOF STATE]
proof (prove)
using this:
current rs = current rt
ifp ?v2 u \<and> \<not> intermediary ?v2 u \<Longrightarrow> vpeq ?v2 rs rt

goal (1 subgoal):
 1. iequivalent_states (Some rs) (Some rt) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
iequivalent_states (Some rs) (Some rt) u

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>t = Some ?t'2; run (Suc n) (Some s) execs = Some ?rs2; run (Suc n) (Some ?t'2) execs2 = Some ?rt2; does_not_communicate_with_gateway u execs; \<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s ?t'2; current s = current ?t'2; ipurged_relation1 u execs execs2\<rbrakk> \<Longrightarrow> iequivalent_states (Some ?rs2) (Some ?rt2) u

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some (cswitch (Suc n) s)) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>t = Some ?t'2; run (Suc n) (Some s) execs = Some ?rs2; run (Suc n) (Some ?t'2) execs2 = Some ?rt2; does_not_communicate_with_gateway u execs; \<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s ?t'2; current s = current ?t'2; ipurged_relation1 u execs execs2\<rbrakk> \<Longrightarrow> iequivalent_states (Some ?rs2) (Some ?rt2) u

goal (1 subgoal):
 1. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
by(simp add:option.splits,cases t,simp+)
[PROOF STATE]
proof (state)
this:
does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
case (4 n execs s t u execs2)
[PROOF STATE]
proof (state)
this:
\<not> interrupt (Suc n)
thread_empty (execs (current s))
does_not_communicate_with_gateway ?u execs \<and> iequivalent_states (Some s) ?t ?u \<and> ipurged_relation1 ?u execs ?execs2.0 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n ?t ?execs2.0) ?u

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume not_interrupt: "\<not>interrupt (Suc n)"
[PROOF STATE]
proof (state)
this:
\<not> interrupt (Suc n)

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume thread_empty_s: "thread_empty(execs (current s))"
[PROOF STATE]
proof (state)
this:
thread_empty (execs (current s))

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume IH: "(\<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u)"
[PROOF STATE]
proof (state)
this:
does_not_communicate_with_gateway ?u execs \<and> iequivalent_states (Some s) ?t ?u \<and> ipurged_relation1 ?u execs ?execs2.0 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n ?t ?execs2.0) ?u

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
does_not_communicate_with_gateway ?u execs \<and> iequivalent_states (Some s) ?t ?u \<and> ipurged_relation1 ?u execs ?execs2.0 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n ?t ?execs2.0) ?u

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
fix t'
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume t: "t = Some t'"
[PROOF STATE]
proof (state)
this:
t = Some t'

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
fix rs
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume rs: "run (Suc n) (Some s) execs = Some rs"
[PROOF STATE]
proof (state)
this:
run (Suc n) (Some s) execs = Some rs

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
fix rt
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume rt: "run (Suc n) (Some t') execs2 = Some rt"
[PROOF STATE]
proof (state)
this:
run (Suc n) (Some t') execs2 = Some rt

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume no_gateway_comm: "does_not_communicate_with_gateway u execs"
[PROOF STATE]
proof (state)
this:
does_not_communicate_with_gateway u execs

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume vpeq_s_t: "\<forall> v . ifp v u \<and> \<not>intermediary v u \<longrightarrow> vpeq v s t'"
[PROOF STATE]
proof (state)
this:
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume current_s_t: "current s = current t'"
[PROOF STATE]
proof (state)
this:
current s = current t'

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume purged_a_a2: "ipurged_relation1 u execs execs2"
[PROOF STATE]
proof (state)
this:
ipurged_relation1 u execs execs2

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from ifp_reflexive vpeq_s_t
[PROOF STATE]
proof (chain)
picking this:
\<forall>u. ifp u u
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'
[PROOF STEP]
have vpeq_u_s_t: "vpeq u s t'"
[PROOF STATE]
proof (prove)
using this:
\<forall>u. ifp u u
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'

goal (1 subgoal):
 1. vpeq u s t'
[PROOF STEP]
unfolding intermediary_def
[PROOF STATE]
proof (prove)
using this:
\<forall>u. ifp u u
\<forall>v. ifp v u \<and> (\<nexists>va. ifp\<^sup>*\<^sup>* va v \<and> ifp v u \<and> \<not> ifp va u \<and> v \<noteq> u) \<longrightarrow> vpeq v s t'

goal (1 subgoal):
 1. vpeq u s t'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vpeq u s t'

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from step_atomicity current_next_state current_s_t
[PROOF STATE]
proof (chain)
picking this:
\<forall>s a. current (kstep s a) = current s
\<forall>s execs. current (next_state s execs) = current s
current s = current t'
[PROOF STEP]
have current_s_nt: "current s = current (step (next_state t' execs2) (next_action t' execs2))"
[PROOF STATE]
proof (prove)
using this:
\<forall>s a. current (kstep s a) = current s
\<forall>s execs. current (next_state s execs) = current s
current s = current t'

goal (1 subgoal):
 1. current s = current (step (next_state t' execs2) (next_action t' execs2))
[PROOF STEP]
unfolding step_def
[PROOF STATE]
proof (prove)
using this:
\<forall>s a. current (kstep s a) = current s
\<forall>s execs. current (next_state s execs) = current s
current s = current t'

goal (1 subgoal):
 1. current s = current (case next_action t' execs2 of None \<Rightarrow> next_state t' execs2 | Some a \<Rightarrow> kstep (next_state t' execs2) a)
[PROOF STEP]
by (cases "next_action s execs",cases "next_action t' execs2",simp,simp,cases "next_action t' execs2",simp,simp)
[PROOF STATE]
proof (state)
this:
current s = current (step (next_state t' execs2) (next_action t' execs2))

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from vpeq_s_t
[PROOF STATE]
proof (chain)
picking this:
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'
[PROOF STEP]
have vpeq_curr_s_t: "ifp (current s) u \<and> \<not>intermediary (current s) u \<longrightarrow> vpeq (current s) s t'"
[PROOF STATE]
proof (prove)
using this:
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'

goal (1 subgoal):
 1. ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> vpeq (current s) s t'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> vpeq (current s) s t'

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
have "iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
proof(cases "thread_empty(execs2 (current t'))")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
 2. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
thread_empty (execs2 (current t'))

goal (2 subgoals):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
 2. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from purged_a_a2 and vpeq_s_t and current_s_t IH[where t="Some t'" and u=u and ?execs2.0=execs2] no_gateway_comm
[PROOF STATE]
proof (chain)
picking this:
ipurged_relation1 u execs execs2
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'
current s = current t'
does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) (Some t') u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n (Some t') execs2) u
does_not_communicate_with_gateway u execs
[PROOF STEP]
have "iequivalent_states (run n (Some s) execs) (run n (Some t') execs2) u"
[PROOF STATE]
proof (prove)
using this:
ipurged_relation1 u execs execs2
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'
current s = current t'
does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) (Some t') u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n (Some t') execs2) u
does_not_communicate_with_gateway u execs

goal (1 subgoal):
 1. iequivalent_states (run n (Some s) execs) (run n (Some t') execs2) u
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
ipurged_relation1 u execs execs2
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'
current s = current t'
does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) (Some t') u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n (Some t') execs2) u
does_not_communicate_with_gateway u execs
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. iequivalent_states (run n (Some s) execs) (run n (Some t') execs2) u
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
iequivalent_states (run n (Some s) execs) (run n (Some t') execs2) u

goal (2 subgoals):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
 2. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from this not_interrupt True thread_empty_s
[PROOF STATE]
proof (chain)
picking this:
iequivalent_states (run n (Some s) execs) (run n (Some t') execs2) u
\<not> interrupt (Suc n)
thread_empty (execs2 (current t'))
thread_empty (execs (current s))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
iequivalent_states (run n (Some s) execs) (run n (Some t') execs2) u
\<not> interrupt (Suc n)
thread_empty (execs2 (current t'))
thread_empty (execs (current s))

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
iequivalent_states (run n (Some s) execs) (run n (Some t') execs2) u
\<not> interrupt (Suc n)
thread_empty (execs2 (current t'))
thread_empty (execs (current s))
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> thread_empty (execs2 (current t'))

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
have prec_t: "precondition (next_state t' execs2) (next_action t' execs2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. precondition (next_state t' execs2) (next_action t' execs2)
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. precondition (next_state t' execs2) (next_action t' execs2)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. precondition (next_state t' execs2) (next_action t' execs2)
[PROOF STEP]
assume not_prec_t: "\<not>precondition (next_state t' execs2) (next_action t' execs2)"
[PROOF STATE]
proof (state)
this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)

goal (1 subgoal):
 1. precondition (next_state t' execs2) (next_action t' execs2)
[PROOF STEP]
hence "run (Suc n) (Some t') execs2 = None"
[PROOF STATE]
proof (prove)
using this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)

goal (1 subgoal):
 1. run (Suc n) (Some t') execs2 = None
[PROOF STEP]
using not_interrupt False not_prec_t
[PROOF STATE]
proof (prove)
using this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)
\<not> interrupt (Suc n)
\<not> thread_empty (execs2 (current t'))
\<not> precondition (next_state t' execs2) (next_action t' execs2)

goal (1 subgoal):
 1. run (Suc n) (Some t') execs2 = None
[PROOF STEP]
by (simp)
[PROOF STATE]
proof (state)
this:
run (Suc n) (Some t') execs2 = None

goal (1 subgoal):
 1. precondition (next_state t' execs2) (next_action t' execs2)
[PROOF STEP]
from this
[PROOF STATE]
proof (chain)
picking this:
run (Suc n) (Some t') execs2 = None
[PROOF STEP]
have "False"
[PROOF STATE]
proof (prove)
using this:
run (Suc n) (Some t') execs2 = None

goal (1 subgoal):
 1. False
[PROOF STEP]
using rt
[PROOF STATE]
proof (prove)
using this:
run (Suc n) (Some t') execs2 = None
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. False
[PROOF STEP]
by(simp add:option.splits)
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. precondition (next_state t' execs2) (next_action t' execs2)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> False

goal (1 subgoal):
 1. precondition (next_state t' execs2) (next_action t' execs2)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> False

goal (1 subgoal):
 1. precondition (next_state t' execs2) (next_action t' execs2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
precondition (next_state t' execs2) (next_action t' execs2)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
precondition (next_state t' execs2) (next_action t' execs2)

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from False purged_a_a2 thread_empty_s current_s_t
[PROOF STATE]
proof (chain)
picking this:
\<not> thread_empty (execs2 (current t'))
ipurged_relation1 u execs execs2
thread_empty (execs (current s))
current s = current t'
[PROOF STEP]
have 1: "ind_source (current t') u \<or> unrelated (current t') u"
[PROOF STATE]
proof (prove)
using this:
\<not> thread_empty (execs2 (current t'))
ipurged_relation1 u execs execs2
thread_empty (execs (current s))
current s = current t'

goal (1 subgoal):
 1. ind_source (current t') u \<or> unrelated (current t') u
[PROOF STEP]
unfolding ipurged_relation1_def intermediary_def
[PROOF STATE]
proof (prove)
using this:
\<not> thread_empty (execs2 (current t'))
\<forall>d. (ifp d u \<longrightarrow> execs d = execs2 d) \<and> ((\<exists>v. ifp\<^sup>*\<^sup>* v d \<and> ifp d u \<and> \<not> ifp v u \<and> d \<noteq> u) \<longrightarrow> execs d = [])
thread_empty (execs (current s))
current s = current t'

goal (1 subgoal):
 1. ind_source (current t') u \<or> unrelated (current t') u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
ind_source (current t') u \<or> unrelated (current t') u

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
ind_source (current t') u \<or> unrelated (current t') u

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
fix v
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
assume ifp_v: "ifp v u"
[PROOF STATE]
proof (state)
this:
ifp v u

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
assume v_not_intermediary: "\<not>intermediary v u"
[PROOF STATE]
proof (state)
this:
\<not> intermediary v u

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from 1 ifp_v v_not_intermediary
[PROOF STATE]
proof (chain)
picking this:
ind_source (current t') u \<or> unrelated (current t') u
ifp v u
\<not> intermediary v u
[PROOF STEP]
have not_ifp_curr_v: "\<not>ifp (current t') v"
[PROOF STATE]
proof (prove)
using this:
ind_source (current t') u \<or> unrelated (current t') u
ifp v u
\<not> intermediary v u

goal (1 subgoal):
 1. \<not> ifp (current t') v
[PROOF STEP]
unfolding intermediary_def
[PROOF STATE]
proof (prove)
using this:
ind_source (current t') u \<or> unrelated (current t') u
ifp v u
\<nexists>va. ifp\<^sup>*\<^sup>* va v \<and> ifp v u \<and> \<not> ifp va u \<and> v \<noteq> u

goal (1 subgoal):
 1. \<not> ifp (current t') v
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<not> ifp (current t') v

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from not_ifp_curr_v prec_t locally_respects[THEN spec,THEN spec,THEN spec,where x1="next_state t' execs2" and x=v and x2="the (next_action t' execs2)"]
               current_next_state  vpeq_reflexive
[PROOF STATE]
proof (chain)
picking this:
\<not> ifp (current t') v
precondition (next_state t' execs2) (next_action t' execs2)
\<not> ifp (current (next_state t' execs2)) v \<and> kprecondition (next_state t' execs2) (the (next_action t' execs2)) \<longrightarrow> vpeq v (next_state t' execs2) (kstep (next_state t' execs2) (the (next_action t' execs2)))
\<forall>s execs. current (next_state s execs) = current s
\<forall>a u. vpeq u a a
[PROOF STEP]
have "vpeq v (next_state t' execs2) (step (next_state t' execs2) (next_action t' execs2))"
[PROOF STATE]
proof (prove)
using this:
\<not> ifp (current t') v
precondition (next_state t' execs2) (next_action t' execs2)
\<not> ifp (current (next_state t' execs2)) v \<and> kprecondition (next_state t' execs2) (the (next_action t' execs2)) \<longrightarrow> vpeq v (next_state t' execs2) (kstep (next_state t' execs2) (the (next_action t' execs2)))
\<forall>s execs. current (next_state s execs) = current s
\<forall>a u. vpeq u a a

goal (1 subgoal):
 1. vpeq v (next_state t' execs2) (step (next_state t' execs2) (next_action t' execs2))
[PROOF STEP]
unfolding step_def precondition_def B_def
[PROOF STATE]
proof (prove)
using this:
\<not> ifp (current t') v
case next_action t' execs2 of None \<Rightarrow> True | Some a \<Rightarrow> kprecondition (next_state t' execs2) a
\<not> ifp (current (next_state t' execs2)) v \<and> kprecondition (next_state t' execs2) (the (next_action t' execs2)) \<longrightarrow> vpeq v (next_state t' execs2) (kstep (next_state t' execs2) (the (next_action t' execs2)))
\<forall>s execs. current (next_state s execs) = current s
\<forall>a u. vpeq u a a

goal (1 subgoal):
 1. vpeq v (next_state t' execs2) (case next_action t' execs2 of None \<Rightarrow> next_state t' execs2 | Some a \<Rightarrow> kstep (next_state t' execs2) a)
[PROOF STEP]
by (cases "next_action t' execs2",auto)
[PROOF STATE]
proof (state)
this:
vpeq v (next_state t' execs2) (step (next_state t' execs2) (next_action t' execs2))

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from this vpeq_transitive not_ifp_curr_v locally_respects_next_state
[PROOF STATE]
proof (chain)
picking this:
vpeq v (next_state t' execs2) (step (next_state t' execs2) (next_action t' execs2))
\<forall>a b c u. vpeq u a b \<and> vpeq u b c \<longrightarrow> vpeq u a c
\<not> ifp (current t') v
\<forall>s u execs. \<not> ifp (current s) u \<longrightarrow> vpeq u s (next_state s execs)
[PROOF STEP]
have vpeq_t_nt: "vpeq v t' (step (next_state t' execs2) (next_action t' execs2))"
[PROOF STATE]
proof (prove)
using this:
vpeq v (next_state t' execs2) (step (next_state t' execs2) (next_action t' execs2))
\<forall>a b c u. vpeq u a b \<and> vpeq u b c \<longrightarrow> vpeq u a c
\<not> ifp (current t') v
\<forall>s u execs. \<not> ifp (current s) u \<longrightarrow> vpeq u s (next_state s execs)

goal (1 subgoal):
 1. vpeq v t' (step (next_state t' execs2) (next_action t' execs2))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
vpeq v t' (step (next_state t' execs2) (next_action t' execs2))

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from vpeq_s_t ifp_v v_not_intermediary vpeq_t_nt vpeq_transitive vpeq_symmetric vpeq_reflexive
[PROOF STATE]
proof (chain)
picking this:
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'
ifp v u
\<not> intermediary v u
vpeq v t' (step (next_state t' execs2) (next_action t' execs2))
\<forall>a b c u. vpeq u a b \<and> vpeq u b c \<longrightarrow> vpeq u a c
\<forall>a b u. vpeq u a b \<longrightarrow> vpeq u b a
\<forall>a u. vpeq u a a
[PROOF STEP]
have "vpeq v s (step (next_state t' execs2) (next_action t' execs2))"
[PROOF STATE]
proof (prove)
using this:
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'
ifp v u
\<not> intermediary v u
vpeq v t' (step (next_state t' execs2) (next_action t' execs2))
\<forall>a b c u. vpeq u a b \<and> vpeq u b c \<longrightarrow> vpeq u a c
\<forall>a b u. vpeq u a b \<longrightarrow> vpeq u b a
\<forall>a u. vpeq u a a

goal (1 subgoal):
 1. vpeq v s (step (next_state t' execs2) (next_action t' execs2))
[PROOF STEP]
by (metis)
[PROOF STATE]
proof (state)
this:
vpeq v s (step (next_state t' execs2) (next_action t' execs2))

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>ifp ?v2 u; \<not> intermediary ?v2 u\<rbrakk> \<Longrightarrow> vpeq ?v2 s (step (next_state t' execs2) (next_action t' execs2))

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
hence vpeq_ns_nt: "\<forall> v . ifp v u \<and> \<not>intermediary v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>ifp ?v2 u; \<not> intermediary ?v2 u\<rbrakk> \<Longrightarrow> vpeq ?v2 s (step (next_state t' execs2) (next_action t' execs2))

goal (1 subgoal):
 1. \<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from False purged_a_a2 current_s_t thread_empty_s
[PROOF STATE]
proof (chain)
picking this:
\<not> thread_empty (execs2 (current t'))
ipurged_relation1 u execs execs2
current s = current t'
thread_empty (execs (current s))
[PROOF STEP]
have purged_a_na2: "ipurged_relation1 u execs (next_execs t' execs2)"
[PROOF STATE]
proof (prove)
using this:
\<not> thread_empty (execs2 (current t'))
ipurged_relation1 u execs execs2
current s = current t'
thread_empty (execs (current s))

goal (1 subgoal):
 1. ipurged_relation1 u execs (next_execs t' execs2)
[PROOF STEP]
unfolding ipurged_relation1_def next_execs_def
[PROOF STATE]
proof (prove)
using this:
\<not> thread_empty (execs2 (current t'))
\<forall>d. (ifp d u \<longrightarrow> execs d = execs2 d) \<and> (intermediary d u \<longrightarrow> execs d = [])
current s = current t'
thread_empty (execs (current s))

goal (1 subgoal):
 1. \<forall>d. (ifp d u \<longrightarrow> execs d = (execs2(current t' := fst (snd (control t' (current t') (execs2 (current t')))))) d) \<and> (intermediary d u \<longrightarrow> execs d = [])
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
ipurged_relation1 u execs (next_execs t' execs2)

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from vpeq_ns_nt no_gateway_comm
          and IH[where t="Some (step (next_state t' execs2) (next_action t' execs2))" and ?execs2.0="(next_execs t' execs2)" and u=u]
          and current_s_nt purged_a_na2
[PROOF STATE]
proof (chain)
picking this:
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))
does_not_communicate_with_gateway u execs
does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) (Some (step (next_state t' execs2) (next_action t' execs2))) u \<and> ipurged_relation1 u execs (next_execs t' execs2) \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
current s = current (step (next_state t' execs2) (next_action t' execs2))
ipurged_relation1 u execs (next_execs t' execs2)
[PROOF STEP]
have eq_ns_nt: "iequivalent_states (run n (Some s) execs)
                                             (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u"
[PROOF STATE]
proof (prove)
using this:
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))
does_not_communicate_with_gateway u execs
does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) (Some (step (next_state t' execs2) (next_action t' execs2))) u \<and> ipurged_relation1 u execs (next_execs t' execs2) \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
current s = current (step (next_state t' execs2) (next_action t' execs2))
ipurged_relation1 u execs (next_execs t' execs2)

goal (1 subgoal):
 1. iequivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
iequivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from prec_t  eq_ns_nt not_interrupt False thread_empty_s
[PROOF STATE]
proof (chain)
picking this:
precondition (next_state t' execs2) (next_action t' execs2)
iequivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs2 (current t'))
thread_empty (execs (current s))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
precondition (next_state t' execs2) (next_action t' execs2)
iequivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs2 (current t'))
thread_empty (execs (current s))

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
using t rs rt
[PROOF STATE]
proof (prove)
using this:
precondition (next_state t' execs2) (next_action t' execs2)
iequivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs2 (current t'))
thread_empty (execs (current s))
t = Some t'
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>t = Some ?t'2; run (Suc n) (Some s) execs = Some ?rs2; run (Suc n) (Some ?t'2) execs2 = Some ?rt2; does_not_communicate_with_gateway u execs; \<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s ?t'2; current s = current ?t'2; ipurged_relation1 u execs execs2\<rbrakk> \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some ?t'2) execs2) u

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>t = Some ?t'2; run (Suc n) (Some s) execs = Some ?rs2; run (Suc n) (Some ?t'2) execs2 = Some ?rt2; does_not_communicate_with_gateway u execs; \<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s ?t'2; current s = current ?t'2; ipurged_relation1 u execs execs2\<rbrakk> \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some ?t'2) execs2) u

goal (1 subgoal):
 1. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
by(simp add:option.splits,cases t,simp+)
[PROOF STATE]
proof (state)
this:
does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u

goal (2 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
case (5 n execs s t u execs2)
[PROOF STATE]
proof (state)
this:
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
\<not> precondition (next_state s execs) (next_action s execs)

goal (2 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume not_interrupt: "\<not>interrupt (Suc n)"
[PROOF STATE]
proof (state)
this:
\<not> interrupt (Suc n)

goal (2 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume thread_not_empty_s: "\<not>thread_empty(execs (current s))"
[PROOF STATE]
proof (state)
this:
\<not> thread_empty (execs (current s))

goal (2 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume not_prec_s: "\<not> precondition (next_state s execs) (next_action s execs)"
[PROOF STATE]
proof (state)
this:
\<not> precondition (next_state s execs) (next_action s execs)

goal (2 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
hence "run (Suc n) (Some s) execs = None"
[PROOF STATE]
proof (prove)
using this:
\<not> precondition (next_state s execs) (next_action s execs)

goal (1 subgoal):
 1. run (Suc n) (Some s) execs = None
[PROOF STEP]
using not_interrupt thread_not_empty_s
[PROOF STATE]
proof (prove)
using this:
\<not> precondition (next_state s execs) (next_action s execs)
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))

goal (1 subgoal):
 1. run (Suc n) (Some s) execs = None
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
run (Suc n) (Some s) execs = None

goal (2 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
run (Suc n) (Some s) execs = None

goal (1 subgoal):
 1. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
by(simp add:option.splits)
[PROOF STATE]
proof (state)
this:
does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
case (6 n execs s t u execs2)
[PROOF STATE]
proof (state)
this:
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
precondition (next_state s execs) (next_action s execs)
does_not_communicate_with_gateway ?u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) ?t ?u \<and> ipurged_relation1 ?u (next_execs s execs) ?execs2.0 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n ?t ?execs2.0) ?u

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume not_interrupt: "\<not>interrupt (Suc n)"
[PROOF STATE]
proof (state)
this:
\<not> interrupt (Suc n)

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume thread_not_empty_s: "\<not>thread_empty(execs (current s))"
[PROOF STATE]
proof (state)
this:
\<not> thread_empty (execs (current s))

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume prec_s: "precondition (next_state s execs) (next_action s execs)"
[PROOF STATE]
proof (state)
this:
precondition (next_state s execs) (next_action s execs)

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume IH: "(\<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and>
           iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and>
           ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow>
           iequivalent_states
            (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs))
            (run n t execs2) u)"
[PROOF STATE]
proof (state)
this:
does_not_communicate_with_gateway ?u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) ?t ?u \<and> ipurged_relation1 ?u (next_execs s execs) ?execs2.0 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n ?t ?execs2.0) ?u

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
does_not_communicate_with_gateway ?u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) ?t ?u \<and> ipurged_relation1 ?u (next_execs s execs) ?execs2.0 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n ?t ?execs2.0) ?u

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
fix t'
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume t: "t = Some t'"
[PROOF STATE]
proof (state)
this:
t = Some t'

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
fix rs
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume rs: "run (Suc n) (Some s) execs = Some rs"
[PROOF STATE]
proof (state)
this:
run (Suc n) (Some s) execs = Some rs

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
fix rt
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume rt: "run (Suc n) (Some t') execs2 = Some rt"
[PROOF STATE]
proof (state)
this:
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume no_gateway_comm: "does_not_communicate_with_gateway u execs"
[PROOF STATE]
proof (state)
this:
does_not_communicate_with_gateway u execs

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume vpeq_s_t: "\<forall> v . ifp v u \<and> \<not>intermediary v u \<longrightarrow> vpeq v s t'"
[PROOF STATE]
proof (state)
this:
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume current_s_t: "current s = current t'"
[PROOF STATE]
proof (state)
this:
current s = current t'

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume purged_a_a2: "ipurged_relation1 u execs execs2"
[PROOF STATE]
proof (state)
this:
ipurged_relation1 u execs execs2

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from ifp_reflexive vpeq_s_t
[PROOF STATE]
proof (chain)
picking this:
\<forall>u. ifp u u
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'
[PROOF STEP]
have vpeq_u_s_t: "vpeq u s t'"
[PROOF STATE]
proof (prove)
using this:
\<forall>u. ifp u u
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'

goal (1 subgoal):
 1. vpeq u s t'
[PROOF STEP]
unfolding intermediary_def
[PROOF STATE]
proof (prove)
using this:
\<forall>u. ifp u u
\<forall>v. ifp v u \<and> (\<nexists>va. ifp\<^sup>*\<^sup>* va v \<and> ifp v u \<and> \<not> ifp va u \<and> v \<noteq> u) \<longrightarrow> vpeq v s t'

goal (1 subgoal):
 1. vpeq u s t'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vpeq u s t'

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from step_atomicity and current_s_t current_next_state
[PROOF STATE]
proof (chain)
picking this:
\<forall>s a. current (kstep s a) = current s
current s = current t'
\<forall>s execs. current (next_state s execs) = current s
[PROOF STEP]
have current_ns_nt: "current (step (next_state s execs) (next_action s execs)) = current (step (next_state t' execs2) (next_action t' execs2))"
[PROOF STATE]
proof (prove)
using this:
\<forall>s a. current (kstep s a) = current s
current s = current t'
\<forall>s execs. current (next_state s execs) = current s

goal (1 subgoal):
 1. current (step (next_state s execs) (next_action s execs)) = current (step (next_state t' execs2) (next_action t' execs2))
[PROOF STEP]
unfolding step_def
[PROOF STATE]
proof (prove)
using this:
\<forall>s a. current (kstep s a) = current s
current s = current t'
\<forall>s execs. current (next_state s execs) = current s

goal (1 subgoal):
 1. current (case next_action s execs of None \<Rightarrow> next_state s execs | Some a \<Rightarrow> kstep (next_state s execs) a) = current (case next_action t' execs2 of None \<Rightarrow> next_state t' execs2 | Some a \<Rightarrow> kstep (next_state t' execs2) a)
[PROOF STEP]
by (cases "next_action s execs",cases "next_action t' execs2",simp,simp,cases "next_action t' execs2",simp,simp)
[PROOF STATE]
proof (state)
this:
current (step (next_state s execs) (next_action s execs)) = current (step (next_state t' execs2) (next_action t' execs2))

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from step_atomicity current_next_state current_s_t
[PROOF STATE]
proof (chain)
picking this:
\<forall>s a. current (kstep s a) = current s
\<forall>s execs. current (next_state s execs) = current s
current s = current t'
[PROOF STEP]
have current_ns_t: "current (step (next_state s execs) (next_action s execs)) = current t'"
[PROOF STATE]
proof (prove)
using this:
\<forall>s a. current (kstep s a) = current s
\<forall>s execs. current (next_state s execs) = current s
current s = current t'

goal (1 subgoal):
 1. current (step (next_state s execs) (next_action s execs)) = current t'
[PROOF STEP]
unfolding step_def
[PROOF STATE]
proof (prove)
using this:
\<forall>s a. current (kstep s a) = current s
\<forall>s execs. current (next_state s execs) = current s
current s = current t'

goal (1 subgoal):
 1. current (case next_action s execs of None \<Rightarrow> next_state s execs | Some a \<Rightarrow> kstep (next_state s execs) a) = current t'
[PROOF STEP]
by (cases "next_action s execs",auto)
[PROOF STATE]
proof (state)
this:
current (step (next_state s execs) (next_action s execs)) = current t'

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from vpeq_s_t
[PROOF STATE]
proof (chain)
picking this:
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'
[PROOF STEP]
have vpeq_curr_s_t: "ifp (current s) u \<and> \<not>intermediary (current s) u \<longrightarrow> vpeq (current s) s t'"
[PROOF STATE]
proof (prove)
using this:
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'

goal (1 subgoal):
 1. ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> vpeq (current s) s t'
[PROOF STEP]
unfolding intermediary_def
[PROOF STATE]
proof (prove)
using this:
\<forall>v. ifp v u \<and> (\<nexists>va. ifp\<^sup>*\<^sup>* va v \<and> ifp v u \<and> \<not> ifp va u \<and> v \<noteq> u) \<longrightarrow> vpeq v s t'

goal (1 subgoal):
 1. ifp (current s) u \<and> (\<nexists>v. ifp\<^sup>*\<^sup>* v (current s) \<and> ifp (current s) u \<and> \<not> ifp v u \<and> current s \<noteq> u) \<longrightarrow> vpeq (current s) s t'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> vpeq (current s) s t'

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from current_s_t purged_a_a2
[PROOF STATE]
proof (chain)
picking this:
current s = current t'
ipurged_relation1 u execs execs2
[PROOF STEP]
have eq_execs: "ifp (current s) u \<and> \<not>intermediary (current s) u \<longrightarrow> execs (current s) = execs2 (current s)"
[PROOF STATE]
proof (prove)
using this:
current s = current t'
ipurged_relation1 u execs execs2

goal (1 subgoal):
 1. ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> execs (current s) = execs2 (current s)
[PROOF STEP]
by(auto simp add: ipurged_relation1_def)
[PROOF STATE]
proof (state)
this:
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> execs (current s) = execs2 (current s)

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from vpeq_involved_domains no_gateway_comm vpeq_s_t vpeq_involved_domains prec_s
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>ifp (current ?s) ?u; \<not> intermediary (current ?s) ?u; does_not_communicate_with_gateway ?u ?execs; \<forall>v. ifp v ?u \<and> \<not> intermediary v ?u \<longrightarrow> vpeq v ?s ?t'; precondition (next_state ?s ?execs) (next_action ?s ?execs)\<rbrakk> \<Longrightarrow> \<forall>d\<in>involved (next_action ?s ?execs). vpeq d ?s ?t'
does_not_communicate_with_gateway u execs
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'
\<lbrakk>ifp (current ?s) ?u; \<not> intermediary (current ?s) ?u; does_not_communicate_with_gateway ?u ?execs; \<forall>v. ifp v ?u \<and> \<not> intermediary v ?u \<longrightarrow> vpeq v ?s ?t'; precondition (next_state ?s ?execs) (next_action ?s ?execs)\<rbrakk> \<Longrightarrow> \<forall>d\<in>involved (next_action ?s ?execs). vpeq d ?s ?t'
precondition (next_state s execs) (next_action s execs)
[PROOF STEP]
have vpeq_involved: "ifp (current s) u \<and> \<not>intermediary (current s) u \<longrightarrow> (\<forall> d \<in> involved (next_action s execs) . vpeq d s t')"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>ifp (current ?s) ?u; \<not> intermediary (current ?s) ?u; does_not_communicate_with_gateway ?u ?execs; \<forall>v. ifp v ?u \<and> \<not> intermediary v ?u \<longrightarrow> vpeq v ?s ?t'; precondition (next_state ?s ?execs) (next_action ?s ?execs)\<rbrakk> \<Longrightarrow> \<forall>d\<in>involved (next_action ?s ?execs). vpeq d ?s ?t'
does_not_communicate_with_gateway u execs
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'
\<lbrakk>ifp (current ?s) ?u; \<not> intermediary (current ?s) ?u; does_not_communicate_with_gateway ?u ?execs; \<forall>v. ifp v ?u \<and> \<not> intermediary v ?u \<longrightarrow> vpeq v ?s ?t'; precondition (next_state ?s ?execs) (next_action ?s ?execs)\<rbrakk> \<Longrightarrow> \<forall>d\<in>involved (next_action ?s ?execs). vpeq d ?s ?t'
precondition (next_state s execs) (next_action s execs)

goal (1 subgoal):
 1. ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> (\<forall>d\<in>involved (next_action s execs). vpeq d s t')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> (\<forall>d\<in>involved (next_action s execs). vpeq d s t')

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from current_s_t next_execs_consistent[THEN spec,THEN spec,THEN spec,where x2=s and x1=t' and x=execs] vpeq_curr_s_t vpeq_involved
[PROOF STATE]
proof (chain)
picking this:
current s = current t'
vpeq (current s) s t' \<and> (\<forall>d\<in>involved (next_action s execs). vpeq d s t') \<and> current s = current t' \<longrightarrow> fst (snd (control s (current s) (execs (current s)))) = fst (snd (control t' (current s) (execs (current s))))
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> vpeq (current s) s t'
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> (\<forall>d\<in>involved (next_action s execs). vpeq d s t')
[PROOF STEP]
have next_execs_t: "ifp (current s) u \<and> \<not>intermediary (current s) u \<longrightarrow> next_execs t' execs = next_execs s execs"
[PROOF STATE]
proof (prove)
using this:
current s = current t'
vpeq (current s) s t' \<and> (\<forall>d\<in>involved (next_action s execs). vpeq d s t') \<and> current s = current t' \<longrightarrow> fst (snd (control s (current s) (execs (current s)))) = fst (snd (control t' (current s) (execs (current s))))
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> vpeq (current s) s t'
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> (\<forall>d\<in>involved (next_action s execs). vpeq d s t')

goal (1 subgoal):
 1. ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> next_execs t' execs = next_execs s execs
[PROOF STEP]
by(auto simp add: next_execs_def)
[PROOF STATE]
proof (state)
this:
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> next_execs t' execs = next_execs s execs

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from current_s_t and purged_a_a2 and thread_not_empty_s next_action_consistent[THEN spec,THEN spec,where x1=s and x=t'] vpeq_curr_s_t vpeq_involved
[PROOF STATE]
proof (chain)
picking this:
current s = current t'
ipurged_relation1 u execs execs2
\<not> thread_empty (execs (current s))
\<forall>execs. vpeq (current s) s t' \<and> (\<forall>d\<in>involved (next_action s execs). vpeq d s t') \<and> current s = current t' \<longrightarrow> next_action s execs = next_action t' execs
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> vpeq (current s) s t'
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> (\<forall>d\<in>involved (next_action s execs). vpeq d s t')
[PROOF STEP]
have next_action_s_t: "ifp (current s) u \<and> \<not>intermediary (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs"
[PROOF STATE]
proof (prove)
using this:
current s = current t'
ipurged_relation1 u execs execs2
\<not> thread_empty (execs (current s))
\<forall>execs. vpeq (current s) s t' \<and> (\<forall>d\<in>involved (next_action s execs). vpeq d s t') \<and> current s = current t' \<longrightarrow> next_action s execs = next_action t' execs
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> vpeq (current s) s t'
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> (\<forall>d\<in>involved (next_action s execs). vpeq d s t')

goal (1 subgoal):
 1. ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs
[PROOF STEP]
by(unfold next_action_def,unfold ipurged_relation1_def,auto)
[PROOF STATE]
proof (state)
this:
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from purged_a_a2 and thread_not_empty_s and current_s_t
[PROOF STATE]
proof (chain)
picking this:
ipurged_relation1 u execs execs2
\<not> thread_empty (execs (current s))
current s = current t'
[PROOF STEP]
have thread_not_empty_t: "ifp (current s) u \<and> \<not>intermediary (current s) u \<longrightarrow> \<not>thread_empty(execs2 (current t'))"
[PROOF STATE]
proof (prove)
using this:
ipurged_relation1 u execs execs2
\<not> thread_empty (execs (current s))
current s = current t'

goal (1 subgoal):
 1. ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> \<not> thread_empty (execs2 (current t'))
[PROOF STEP]
unfolding ipurged_relation1_def
[PROOF STATE]
proof (prove)
using this:
\<forall>d. (ifp d u \<longrightarrow> execs d = execs2 d) \<and> (intermediary d u \<longrightarrow> execs d = [])
\<not> thread_empty (execs (current s))
current s = current t'

goal (1 subgoal):
 1. ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> \<not> thread_empty (execs2 (current t'))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> \<not> thread_empty (execs2 (current t'))

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
have vpeq_ns_nt_1: "\<And> a . precondition (next_state s execs) a \<and> precondition (next_state t' execs) a \<Longrightarrow> ifp (current s) u \<and> \<not>intermediary (current s) u \<Longrightarrow>  (\<forall> v . ifp v u \<and> \<not>intermediary v u \<longrightarrow> vpeq v (step (next_state s execs) a) (step (next_state t' execs) a))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>precondition (next_state s execs) a \<and> precondition (next_state t' execs) a; ifp (current s) u \<and> \<not> intermediary (current s) u\<rbrakk> \<Longrightarrow> \<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (step (next_state s execs) a) (step (next_state t' execs) a)
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>precondition (next_state s execs) a \<and> precondition (next_state t' execs) a; ifp (current s) u \<and> \<not> intermediary (current s) u\<rbrakk> \<Longrightarrow> \<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (step (next_state s execs) a) (step (next_state t' execs) a)
[PROOF STEP]
fix a
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>precondition (next_state s execs) a \<and> precondition (next_state t' execs) a; ifp (current s) u \<and> \<not> intermediary (current s) u\<rbrakk> \<Longrightarrow> \<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (step (next_state s execs) a) (step (next_state t' execs) a)
[PROOF STEP]
assume precs: "precondition (next_state s execs) a \<and> precondition (next_state t' execs) a"
[PROOF STATE]
proof (state)
this:
precondition (next_state s execs) a \<and> precondition (next_state t' execs) a

goal (1 subgoal):
 1. \<And>a. \<lbrakk>precondition (next_state s execs) a \<and> precondition (next_state t' execs) a; ifp (current s) u \<and> \<not> intermediary (current s) u\<rbrakk> \<Longrightarrow> \<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (step (next_state s execs) a) (step (next_state t' execs) a)
[PROOF STEP]
assume ifp_curr: "ifp (current s) u \<and> \<not>intermediary (current s) u"
[PROOF STATE]
proof (state)
this:
ifp (current s) u \<and> \<not> intermediary (current s) u

goal (1 subgoal):
 1. \<And>a. \<lbrakk>precondition (next_state s execs) a \<and> precondition (next_state t' execs) a; ifp (current s) u \<and> \<not> intermediary (current s) u\<rbrakk> \<Longrightarrow> \<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (step (next_state s execs) a) (step (next_state t' execs) a)
[PROOF STEP]
from ifp_curr precs
          next_state_consistent[THEN spec,THEN spec,where x1=s and x=t'] vpeq_curr_s_t vpeq_s_t
          current_next_state current_s_t weakly_step_consistent[THEN spec,THEN spec,THEN spec,THEN spec,where x3="next_state s execs" and x2="next_state t' execs" and x="the a"]
[PROOF STATE]
proof (chain)
picking this:
ifp (current s) u \<and> \<not> intermediary (current s) u
precondition (next_state s execs) a \<and> precondition (next_state t' execs) a
\<forall>u execs. vpeq (current s) s t' \<and> vpeq u s t' \<and> current s = current t' \<longrightarrow> vpeq u (next_state s execs) (next_state t' execs)
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> vpeq (current s) s t'
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'
\<forall>s execs. current (next_state s execs) = current s
current s = current t'
vpeq ?x1 (next_state s execs) (next_state t' execs) \<and> vpeq (current (next_state s execs)) (next_state s execs) (next_state t' execs) \<and> kprecondition (next_state s execs) (the a) \<and> kprecondition (next_state t' execs) (the a) \<and> current (next_state s execs) = current (next_state t' execs) \<longrightarrow> vpeq ?x1 (kstep (next_state s execs) (the a)) (kstep (next_state t' execs) (the a))
[PROOF STEP]
show "\<forall> v . ifp v u \<and> \<not>intermediary v u \<longrightarrow> vpeq v (step (next_state s execs) a) (step (next_state t' execs) a)"
[PROOF STATE]
proof (prove)
using this:
ifp (current s) u \<and> \<not> intermediary (current s) u
precondition (next_state s execs) a \<and> precondition (next_state t' execs) a
\<forall>u execs. vpeq (current s) s t' \<and> vpeq u s t' \<and> current s = current t' \<longrightarrow> vpeq u (next_state s execs) (next_state t' execs)
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> vpeq (current s) s t'
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'
\<forall>s execs. current (next_state s execs) = current s
current s = current t'
vpeq ?x1 (next_state s execs) (next_state t' execs) \<and> vpeq (current (next_state s execs)) (next_state s execs) (next_state t' execs) \<and> kprecondition (next_state s execs) (the a) \<and> kprecondition (next_state t' execs) (the a) \<and> current (next_state s execs) = current (next_state t' execs) \<longrightarrow> vpeq ?x1 (kstep (next_state s execs) (the a)) (kstep (next_state t' execs) (the a))

goal (1 subgoal):
 1. \<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (step (next_state s execs) a) (step (next_state t' execs) a)
[PROOF STEP]
unfolding step_def precondition_def B_def
[PROOF STATE]
proof (prove)
using this:
ifp (current s) u \<and> \<not> intermediary (current s) u
(case a of None \<Rightarrow> True | Some a \<Rightarrow> kprecondition (next_state s execs) a) \<and> (case a of None \<Rightarrow> True | Some a \<Rightarrow> kprecondition (next_state t' execs) a)
\<forall>u execs. vpeq (current s) s t' \<and> vpeq u s t' \<and> current s = current t' \<longrightarrow> vpeq u (next_state s execs) (next_state t' execs)
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> vpeq (current s) s t'
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'
\<forall>s execs. current (next_state s execs) = current s
current s = current t'
vpeq ?x1 (next_state s execs) (next_state t' execs) \<and> vpeq (current (next_state s execs)) (next_state s execs) (next_state t' execs) \<and> kprecondition (next_state s execs) (the a) \<and> kprecondition (next_state t' execs) (the a) \<and> current (next_state s execs) = current (next_state t' execs) \<longrightarrow> vpeq ?x1 (kstep (next_state s execs) (the a)) (kstep (next_state t' execs) (the a))

goal (1 subgoal):
 1. \<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (case a of None \<Rightarrow> next_state s execs | Some a \<Rightarrow> kstep (next_state s execs) a) (case a of None \<Rightarrow> next_state t' execs | Some a \<Rightarrow> kstep (next_state t' execs) a)
[PROOF STEP]
by (cases a,auto)
[PROOF STATE]
proof (state)
this:
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (step (next_state s execs) a) (step (next_state t' execs) a)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>precondition (next_state s execs) ?a \<and> precondition (next_state t' execs) ?a; ifp (current s) u \<and> \<not> intermediary (current s) u\<rbrakk> \<Longrightarrow> \<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (step (next_state s execs) ?a) (step (next_state t' execs) ?a)

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
have no_gateway_comm_na: "does_not_communicate_with_gateway u (next_execs s execs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. does_not_communicate_with_gateway u (next_execs s execs)
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. does_not_communicate_with_gateway u (next_execs s execs)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. does_not_communicate_with_gateway u (next_execs s execs)
[PROOF STEP]
fix a
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. does_not_communicate_with_gateway u (next_execs s execs)
[PROOF STEP]
assume "a \<in> actions_in_execution (next_execs s execs u)"
[PROOF STATE]
proof (state)
this:
a \<in> actions_in_execution (next_execs s execs u)

goal (1 subgoal):
 1. does_not_communicate_with_gateway u (next_execs s execs)
[PROOF STEP]
from this no_gateway_comm[unfolded does_not_communicate_with_gateway_def,THEN spec,where x=a]
               next_execs_subset[THEN spec,THEN spec,THEN spec,where x2=s and x1=execs and x0=u]
[PROOF STATE]
proof (chain)
picking this:
a \<in> actions_in_execution (next_execs s execs u)
a \<in> actions_in_execution (execs u) \<longrightarrow> (\<forall>v. intermediary v u \<longrightarrow> v \<notin> involved (Some a))
actions_in_execution (next_execs s execs u) \<subseteq> actions_in_execution (execs u)
[PROOF STEP]
have "\<forall>v. intermediary v u \<longrightarrow> v \<notin> involved (Some a)"
[PROOF STATE]
proof (prove)
using this:
a \<in> actions_in_execution (next_execs s execs u)
a \<in> actions_in_execution (execs u) \<longrightarrow> (\<forall>v. intermediary v u \<longrightarrow> v \<notin> involved (Some a))
actions_in_execution (next_execs s execs u) \<subseteq> actions_in_execution (execs u)

goal (1 subgoal):
 1. \<forall>v. intermediary v u \<longrightarrow> v \<notin> involved (Some a)
[PROOF STEP]
unfolding  actions_in_execution_def
[PROOF STATE]
proof (prove)
using this:
a \<in> {a. \<exists>aseq\<in>set (next_execs s execs u). a \<in> set aseq}
a \<in> {a. \<exists>aseq\<in>set (execs u). a \<in> set aseq} \<longrightarrow> (\<forall>v. intermediary v u \<longrightarrow> v \<notin> involved (Some a))
{a. \<exists>aseq\<in>set (next_execs s execs u). a \<in> set aseq} \<subseteq> {a. \<exists>aseq\<in>set (execs u). a \<in> set aseq}

goal (1 subgoal):
 1. \<forall>v. intermediary v u \<longrightarrow> v \<notin> involved (Some a)
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
\<forall>v. intermediary v u \<longrightarrow> v \<notin> involved (Some a)

goal (1 subgoal):
 1. does_not_communicate_with_gateway u (next_execs s execs)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
?a2 \<in> actions_in_execution (next_execs s execs u) \<Longrightarrow> \<forall>v. intermediary v u \<longrightarrow> v \<notin> involved (Some ?a2)

goal (1 subgoal):
 1. does_not_communicate_with_gateway u (next_execs s execs)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
?a2 \<in> actions_in_execution (next_execs s execs u) \<Longrightarrow> \<forall>v. intermediary v u \<longrightarrow> v \<notin> involved (Some ?a2)

goal (1 subgoal):
 1. does_not_communicate_with_gateway u (next_execs s execs)
[PROOF STEP]
unfolding does_not_communicate_with_gateway_def
[PROOF STATE]
proof (prove)
using this:
?a2 \<in> actions_in_execution (next_execs s execs u) \<Longrightarrow> \<forall>v. intermediary v u \<longrightarrow> v \<notin> involved (Some ?a2)

goal (1 subgoal):
 1. \<forall>a. a \<in> actions_in_execution (next_execs s execs u) \<longrightarrow> (\<forall>v. intermediary v u \<longrightarrow> v \<notin> involved (Some a))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
does_not_communicate_with_gateway u (next_execs s execs)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
does_not_communicate_with_gateway u (next_execs s execs)

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
have "iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
proof (cases "ifp (current s) u \<and> \<not>intermediary (current s) u" rule :case_split[case_names T F])
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. ifp (current s) u \<and> \<not> intermediary (current s) u \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
 2. \<not> (ifp (current s) u \<and> \<not> intermediary (current s) u) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
case T
[PROOF STATE]
proof (state)
this:
ifp (current s) u \<and> \<not> intermediary (current s) u

goal (2 subgoals):
 1. ifp (current s) u \<and> \<not> intermediary (current s) u \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
 2. \<not> (ifp (current s) u \<and> \<not> intermediary (current s) u) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
proof (cases "thread_empty(execs2 (current t'))" rule :case_split[case_names T2 F2])
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
 2. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
case F2
[PROOF STATE]
proof (state)
this:
\<not> thread_empty (execs2 (current t'))

goal (2 subgoals):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
 2. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
proof (cases "precondition (next_state t' execs2) (next_action t' execs2)" rule :case_split[case_names T3 F3])
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
case T3
[PROOF STATE]
proof (state)
this:
precondition (next_state t' execs2) (next_action t' execs2)

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from T purged_a_a2 current_s_t
              next_execs_consistent[THEN spec,THEN spec,where x1=s and x=t'] vpeq_curr_s_t vpeq_involved
[PROOF STATE]
proof (chain)
picking this:
ifp (current s) u \<and> \<not> intermediary (current s) u
ipurged_relation1 u execs execs2
current s = current t'
\<forall>execs. vpeq (current s) s t' \<and> (\<forall>d\<in>involved (next_action s execs). vpeq d s t') \<and> current s = current t' \<longrightarrow> fst (snd (control s (current s) (execs (current s)))) = fst (snd (control t' (current s) (execs (current s))))
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> vpeq (current s) s t'
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> (\<forall>d\<in>involved (next_action s execs). vpeq d s t')
[PROOF STEP]
have purged_na_na2: "ipurged_relation1 u (next_execs s execs) (next_execs t' execs2)"
[PROOF STATE]
proof (prove)
using this:
ifp (current s) u \<and> \<not> intermediary (current s) u
ipurged_relation1 u execs execs2
current s = current t'
\<forall>execs. vpeq (current s) s t' \<and> (\<forall>d\<in>involved (next_action s execs). vpeq d s t') \<and> current s = current t' \<longrightarrow> fst (snd (control s (current s) (execs (current s)))) = fst (snd (control t' (current s) (execs (current s))))
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> vpeq (current s) s t'
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> (\<forall>d\<in>involved (next_action s execs). vpeq d s t')

goal (1 subgoal):
 1. ipurged_relation1 u (next_execs s execs) (next_execs t' execs2)
[PROOF STEP]
unfolding ipurged_relation1_def next_execs_def
[PROOF STATE]
proof (prove)
using this:
ifp (current s) u \<and> \<not> intermediary (current s) u
\<forall>d. (ifp d u \<longrightarrow> execs d = execs2 d) \<and> (intermediary d u \<longrightarrow> execs d = [])
current s = current t'
\<forall>execs. vpeq (current s) s t' \<and> (\<forall>d\<in>involved (next_action s execs). vpeq d s t') \<and> current s = current t' \<longrightarrow> fst (snd (control s (current s) (execs (current s)))) = fst (snd (control t' (current s) (execs (current s))))
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> vpeq (current s) s t'
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> (\<forall>d\<in>involved (next_action s execs). vpeq d s t')

goal (1 subgoal):
 1. \<forall>d. (ifp d u \<longrightarrow> (execs(current s := fst (snd (control s (current s) (execs (current s)))))) d = (execs2(current t' := fst (snd (control t' (current t') (execs2 (current t')))))) d) \<and> (intermediary d u \<longrightarrow> (execs(current s := fst (snd (control s (current s) (execs (current s)))))) d = [])
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
ipurged_relation1 u (next_execs s execs) (next_execs t' execs2)

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from IH[where t="Some (step (next_state t' execs2) (next_action t' execs2))" and ?execs2.0="next_execs t' execs2" and u=u]
              purged_na_na2 current_ns_nt vpeq_ns_nt_1[where a="(next_action s execs)"] T T3 prec_s
              next_action_s_t  eq_execs current_s_t no_gateway_comm_na
[PROOF STATE]
proof (chain)
picking this:
does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some (step (next_state t' execs2) (next_action t' execs2))) u \<and> ipurged_relation1 u (next_execs s execs) (next_execs t' execs2) \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
ipurged_relation1 u (next_execs s execs) (next_execs t' execs2)
current (step (next_state s execs) (next_action s execs)) = current (step (next_state t' execs2) (next_action t' execs2))
\<lbrakk>precondition (next_state s execs) (next_action s execs) \<and> precondition (next_state t' execs) (next_action s execs); ifp (current s) u \<and> \<not> intermediary (current s) u\<rbrakk> \<Longrightarrow> \<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (step (next_state s execs) (next_action s execs)) (step (next_state t' execs) (next_action s execs))
ifp (current s) u \<and> \<not> intermediary (current s) u
precondition (next_state t' execs2) (next_action t' execs2)
precondition (next_state s execs) (next_action s execs)
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> execs (current s) = execs2 (current s)
current s = current t'
does_not_communicate_with_gateway u (next_execs s execs)
[PROOF STEP]
have eq_ns_nt: "iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs))
                                                 (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u"
[PROOF STATE]
proof (prove)
using this:
does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some (step (next_state t' execs2) (next_action t' execs2))) u \<and> ipurged_relation1 u (next_execs s execs) (next_execs t' execs2) \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
ipurged_relation1 u (next_execs s execs) (next_execs t' execs2)
current (step (next_state s execs) (next_action s execs)) = current (step (next_state t' execs2) (next_action t' execs2))
\<lbrakk>precondition (next_state s execs) (next_action s execs) \<and> precondition (next_state t' execs) (next_action s execs); ifp (current s) u \<and> \<not> intermediary (current s) u\<rbrakk> \<Longrightarrow> \<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (step (next_state s execs) (next_action s execs)) (step (next_state t' execs) (next_action s execs))
ifp (current s) u \<and> \<not> intermediary (current s) u
precondition (next_state t' execs2) (next_action t' execs2)
precondition (next_state s execs) (next_action s execs)
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> execs (current s) = execs2 (current s)
current s = current t'
does_not_communicate_with_gateway u (next_execs s execs)

goal (1 subgoal):
 1. iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
[PROOF STEP]
unfolding next_state_def
[PROOF STATE]
proof (prove)
using this:
does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (snd (snd (control s (current s) (execs (current s))))) (next_action s execs))) (Some (step (snd (snd (control t' (current t') (execs2 (current t'))))) (next_action t' execs2))) u \<and> ipurged_relation1 u (next_execs s execs) (next_execs t' execs2) \<longrightarrow> iequivalent_states (run n (Some (step (snd (snd (control s (current s) (execs (current s))))) (next_action s execs))) (next_execs s execs)) (run n (Some (step (snd (snd (control t' (current t') (execs2 (current t'))))) (next_action t' execs2))) (next_execs t' execs2)) u
ipurged_relation1 u (next_execs s execs) (next_execs t' execs2)
current (step (snd (snd (control s (current s) (execs (current s))))) (next_action s execs)) = current (step (snd (snd (control t' (current t') (execs2 (current t'))))) (next_action t' execs2))
\<lbrakk>precondition (snd (snd (control s (current s) (execs (current s))))) (next_action s execs) \<and> precondition (snd (snd (control t' (current t') (execs (current t'))))) (next_action s execs); ifp (current s) u \<and> \<not> intermediary (current s) u\<rbrakk> \<Longrightarrow> \<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (step (snd (snd (control s (current s) (execs (current s))))) (next_action s execs)) (step (snd (snd (control t' (current t') (execs (current t'))))) (next_action s execs))
ifp (current s) u \<and> \<not> intermediary (current s) u
precondition (snd (snd (control t' (current t') (execs2 (current t'))))) (next_action t' execs2)
precondition (snd (snd (control s (current s) (execs (current s))))) (next_action s execs)
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> execs (current s) = execs2 (current s)
current s = current t'
does_not_communicate_with_gateway u (next_execs s execs)

goal (1 subgoal):
 1. iequivalent_states (run n (Some (step (snd (snd (control s (current s) (execs (current s))))) (next_action s execs))) (next_execs s execs)) (run n (Some (step (snd (snd (control t' (current t') (execs2 (current t'))))) (next_action t' execs2))) (next_execs t' execs2)) u
[PROOF STEP]
by (auto,metis)
[PROOF STATE]
proof (state)
this:
iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from this not_interrupt thread_not_empty_s prec_s F2 T3
[PROOF STATE]
proof (chain)
picking this:
iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
precondition (next_state s execs) (next_action s execs)
\<not> thread_empty (execs2 (current t'))
precondition (next_state t' execs2) (next_action t' execs2)
[PROOF STEP]
have current_rs_rt: "current rs = current rt"
[PROOF STATE]
proof (prove)
using this:
iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
precondition (next_state s execs) (next_action s execs)
\<not> thread_empty (execs2 (current t'))
precondition (next_state t' execs2) (next_action t' execs2)

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
precondition (next_state s execs) (next_action s execs)
\<not> thread_empty (execs2 (current t'))
precondition (next_state t' execs2) (next_action t' execs2)
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
fix v
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
assume ia: "ifp v u \<and> \<not>intermediary v u"
[PROOF STATE]
proof (state)
this:
ifp v u \<and> \<not> intermediary v u

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from this eq_ns_nt not_interrupt thread_not_empty_s prec_s F2 T3
[PROOF STATE]
proof (chain)
picking this:
ifp v u \<and> \<not> intermediary v u
iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
precondition (next_state s execs) (next_action s execs)
\<not> thread_empty (execs2 (current t'))
precondition (next_state t' execs2) (next_action t' execs2)
[PROOF STEP]
have "vpeq v rs rt"
[PROOF STATE]
proof (prove)
using this:
ifp v u \<and> \<not> intermediary v u
iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
precondition (next_state s execs) (next_action s execs)
\<not> thread_empty (execs2 (current t'))
precondition (next_state t' execs2) (next_action t' execs2)

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
ifp v u \<and> \<not> intermediary v u
iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
precondition (next_state s execs) (next_action s execs)
\<not> thread_empty (execs2 (current t'))
precondition (next_state t' execs2) (next_action t' execs2)
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vpeq v rs rt

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
ifp ?v2 u \<and> \<not> intermediary ?v2 u \<Longrightarrow> vpeq ?v2 rs rt

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from this and current_rs_rt
[PROOF STATE]
proof (chain)
picking this:
ifp ?v2 u \<and> \<not> intermediary ?v2 u \<Longrightarrow> vpeq ?v2 rs rt
current rs = current rt
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ifp ?v2 u \<and> \<not> intermediary ?v2 u \<Longrightarrow> vpeq ?v2 rs rt
current rs = current rt

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
ifp ?v2 u \<and> \<not> intermediary ?v2 u \<Longrightarrow> vpeq ?v2 rs rt
current rs = current rt
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u

goal (1 subgoal):
 1. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
case F3
[PROOF STATE]
proof (state)
this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)

goal (1 subgoal):
 1. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from F3 F2 not_interrupt
[PROOF STATE]
proof (chain)
picking this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)
\<not> thread_empty (execs2 (current t'))
\<not> interrupt (Suc n)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)
\<not> thread_empty (execs2 (current t'))
\<not> interrupt (Suc n)

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
using rt
[PROOF STATE]
proof (prove)
using this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)
\<not> thread_empty (execs2 (current t'))
\<not> interrupt (Suc n)
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u

goal (1 subgoal):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
case T2
[PROOF STATE]
proof (state)
this:
thread_empty (execs2 (current t'))

goal (1 subgoal):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from T2 T purged_a_a2 thread_not_empty_s current_s_t prec_s next_action_s_t vpeq_u_s_t
[PROOF STATE]
proof (chain)
picking this:
thread_empty (execs2 (current t'))
ifp (current s) u \<and> \<not> intermediary (current s) u
ipurged_relation1 u execs execs2
\<not> thread_empty (execs (current s))
current s = current t'
precondition (next_state s execs) (next_action s execs)
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs
vpeq u s t'
[PROOF STEP]
have ind_source: "False"
[PROOF STATE]
proof (prove)
using this:
thread_empty (execs2 (current t'))
ifp (current s) u \<and> \<not> intermediary (current s) u
ipurged_relation1 u execs execs2
\<not> thread_empty (execs (current s))
current s = current t'
precondition (next_state s execs) (next_action s execs)
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs
vpeq u s t'

goal (1 subgoal):
 1. False
[PROOF STEP]
unfolding  ipurged_relation1_def
[PROOF STATE]
proof (prove)
using this:
thread_empty (execs2 (current t'))
ifp (current s) u \<and> \<not> intermediary (current s) u
\<forall>d. (ifp d u \<longrightarrow> execs d = execs2 d) \<and> (intermediary d u \<longrightarrow> execs d = [])
\<not> thread_empty (execs (current s))
current s = current t'
precondition (next_state s execs) (next_action s execs)
ifp (current s) u \<and> \<not> intermediary (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs
vpeq u s t'

goal (1 subgoal):
 1. False
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
False

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u

goal (1 subgoal):
 1. \<not> (ifp (current s) u \<and> \<not> intermediary (current s) u) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> (ifp (current s) u \<and> \<not> intermediary (current s) u) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
case F
[PROOF STATE]
proof (state)
this:
\<not> (ifp (current s) u \<and> \<not> intermediary (current s) u)

goal (1 subgoal):
 1. \<not> (ifp (current s) u \<and> \<not> intermediary (current s) u) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
hence 1: "ind_source (current s) u \<or> unrelated (current s) u \<or> intermediary (current s) u"
[PROOF STATE]
proof (prove)
using this:
\<not> (ifp (current s) u \<and> \<not> intermediary (current s) u)

goal (1 subgoal):
 1. ind_source (current s) u \<or> unrelated (current s) u \<or> intermediary (current s) u
[PROOF STEP]
unfolding intermediary_def
[PROOF STATE]
proof (prove)
using this:
\<not> (ifp (current s) u \<and> (\<nexists>v. ifp\<^sup>*\<^sup>* v (current s) \<and> ifp (current s) u \<and> \<not> ifp v u \<and> current s \<noteq> u))

goal (1 subgoal):
 1. ind_source (current s) u \<or> unrelated (current s) u \<or> (\<exists>v. ifp\<^sup>*\<^sup>* v (current s) \<and> ifp (current s) u \<and> \<not> ifp v u \<and> current s \<noteq> u)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
ind_source (current s) u \<or> unrelated (current s) u \<or> intermediary (current s) u

goal (1 subgoal):
 1. \<not> (ifp (current s) u \<and> \<not> intermediary (current s) u) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from purged_a_a2 and thread_not_empty_s
[PROOF STATE]
proof (chain)
picking this:
ipurged_relation1 u execs execs2
\<not> thread_empty (execs (current s))
[PROOF STEP]
have 2: "\<not>intermediary (current s) u"
[PROOF STATE]
proof (prove)
using this:
ipurged_relation1 u execs execs2
\<not> thread_empty (execs (current s))

goal (1 subgoal):
 1. \<not> intermediary (current s) u
[PROOF STEP]
unfolding ipurged_relation1_def
[PROOF STATE]
proof (prove)
using this:
\<forall>d. (ifp d u \<longrightarrow> execs d = execs2 d) \<and> (intermediary d u \<longrightarrow> execs d = [])
\<not> thread_empty (execs (current s))

goal (1 subgoal):
 1. \<not> intermediary (current s) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<not> intermediary (current s) u

goal (1 subgoal):
 1. \<not> (ifp (current s) u \<and> \<not> intermediary (current s) u) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
let ?nt = "if thread_empty(execs2 (current t'))  then t' else step (next_state t' execs2) (next_action t' execs2)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> (ifp (current s) u \<and> \<not> intermediary (current s) u) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
let ?na2 = "if thread_empty(execs2 (current t')) then execs2 else next_execs t' execs2"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> (ifp (current s) u \<and> \<not> intermediary (current s) u) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
have prec_t: "\<not>thread_empty(execs2 (current t')) \<Longrightarrow> precondition (next_state t' execs2) (next_action t' execs2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> precondition (next_state t' execs2) (next_action t' execs2)
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> precondition (next_state t' execs2) (next_action t' execs2)
[PROOF STEP]
assume thread_not_empty_t: "\<not>thread_empty(execs2 (current t'))"
[PROOF STATE]
proof (state)
this:
\<not> thread_empty (execs2 (current t'))

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> precondition (next_state t' execs2) (next_action t' execs2)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
\<not> thread_empty (execs2 (current t'))

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> precondition (next_state t' execs2) (next_action t' execs2)
[PROOF STEP]
assume not_prec_t: "\<not>precondition (next_state t' execs2) (next_action t' execs2)"
[PROOF STATE]
proof (state)
this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> precondition (next_state t' execs2) (next_action t' execs2)
[PROOF STEP]
hence "run (Suc n) (Some t') execs2 = None"
[PROOF STATE]
proof (prove)
using this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)

goal (1 subgoal):
 1. run (Suc n) (Some t') execs2 = None
[PROOF STEP]
using not_interrupt thread_not_empty_t not_prec_t
[PROOF STATE]
proof (prove)
using this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)
\<not> interrupt (Suc n)
\<not> thread_empty (execs2 (current t'))
\<not> precondition (next_state t' execs2) (next_action t' execs2)

goal (1 subgoal):
 1. run (Suc n) (Some t') execs2 = None
[PROOF STEP]
by (simp)
[PROOF STATE]
proof (state)
this:
run (Suc n) (Some t') execs2 = None

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> precondition (next_state t' execs2) (next_action t' execs2)
[PROOF STEP]
from this
[PROOF STATE]
proof (chain)
picking this:
run (Suc n) (Some t') execs2 = None
[PROOF STEP]
have "False"
[PROOF STATE]
proof (prove)
using this:
run (Suc n) (Some t') execs2 = None

goal (1 subgoal):
 1. False
[PROOF STEP]
using rt
[PROOF STATE]
proof (prove)
using this:
run (Suc n) (Some t') execs2 = None
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. False
[PROOF STEP]
by(simp add:option.splits)
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> precondition (next_state t' execs2) (next_action t' execs2)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> False

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> precondition (next_state t' execs2) (next_action t' execs2)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> False

goal (1 subgoal):
 1. precondition (next_state t' execs2) (next_action t' execs2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
precondition (next_state t' execs2) (next_action t' execs2)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<not> thread_empty (execs2 (current t')) \<Longrightarrow> precondition (next_state t' execs2) (next_action t' execs2)

goal (1 subgoal):
 1. \<not> (ifp (current s) u \<and> \<not> intermediary (current s) u) \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
{
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
fix v
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
assume ifp_v: "ifp v u"
[PROOF STATE]
proof (state)
this:
ifp v u

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
assume v_not_intermediary: "\<not>intermediary v u"
[PROOF STATE]
proof (state)
this:
\<not> intermediary v u

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
have not_ifp_curr_v: "\<not>ifp (current s) v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> ifp (current s) v
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. ifp (current s) v \<Longrightarrow> False
[PROOF STEP]
assume ifp_curr_v: "ifp (current s) v"
[PROOF STATE]
proof (state)
this:
ifp (current s) v

goal (1 subgoal):
 1. ifp (current s) v \<Longrightarrow> False
[PROOF STEP]
thus False
[PROOF STATE]
proof (prove)
using this:
ifp (current s) v

goal (1 subgoal):
 1. False
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. ifp (current s) v \<Longrightarrow> False
[PROOF STEP]
{
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. ifp (current s) v \<Longrightarrow> False
[PROOF STEP]
assume "ind_source (current s) u"
[PROOF STATE]
proof (state)
this:
ind_source (current s) u

goal (1 subgoal):
 1. ifp (current s) v \<Longrightarrow> False
[PROOF STEP]
from this ifp_curr_v ifp_v
[PROOF STATE]
proof (chain)
picking this:
ind_source (current s) u
ifp (current s) v
ifp v u
[PROOF STEP]
have "intermediary v u"
[PROOF STATE]
proof (prove)
using this:
ind_source (current s) u
ifp (current s) v
ifp v u

goal (1 subgoal):
 1. intermediary v u
[PROOF STEP]
unfolding intermediary_def
[PROOF STATE]
proof (prove)
using this:
ind_source (current s) u
ifp (current s) v
ifp v u

goal (1 subgoal):
 1. \<exists>va. ifp\<^sup>*\<^sup>* va v \<and> ifp v u \<and> \<not> ifp va u \<and> v \<noteq> u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
intermediary v u

goal (1 subgoal):
 1. ifp (current s) v \<Longrightarrow> False
[PROOF STEP]
from this v_not_intermediary
[PROOF STATE]
proof (chain)
picking this:
intermediary v u
\<not> intermediary v u
[PROOF STEP]
have False
[PROOF STATE]
proof (prove)
using this:
intermediary v u
\<not> intermediary v u

goal (1 subgoal):
 1. False
[PROOF STEP]
unfolding intermediary_def
[PROOF STATE]
proof (prove)
using this:
\<exists>va. ifp\<^sup>*\<^sup>* va v \<and> ifp v u \<and> \<not> ifp va u \<and> v \<noteq> u
\<nexists>va. ifp\<^sup>*\<^sup>* va v \<and> ifp v u \<and> \<not> ifp va u \<and> v \<noteq> u

goal (1 subgoal):
 1. False
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. ifp (current s) v \<Longrightarrow> False
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
ind_source (current s) u \<Longrightarrow> False

goal (1 subgoal):
 1. ifp (current s) v \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ind_source (current s) u \<Longrightarrow> False

goal (1 subgoal):
 1. ifp (current s) v \<Longrightarrow> False
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
ind_source (current s) u \<Longrightarrow> False

goal (1 subgoal):
 1. ifp (current s) v \<Longrightarrow> False
[PROOF STEP]
assume unrelated: "unrelated (current s) u"
[PROOF STATE]
proof (state)
this:
unrelated (current s) u

goal (1 subgoal):
 1. ifp (current s) v \<Longrightarrow> False
[PROOF STEP]
from this ifp_v ifp_curr_v
[PROOF STATE]
proof (chain)
picking this:
unrelated (current s) u
ifp v u
ifp (current s) v
[PROOF STEP]
have "False"
[PROOF STATE]
proof (prove)
using this:
unrelated (current s) u
ifp v u
ifp (current s) v

goal (1 subgoal):
 1. False
[PROOF STEP]
using rtranclp_trans r_into_rtranclp
[PROOF STATE]
proof (prove)
using this:
unrelated (current s) u
ifp v u
ifp (current s) v
\<lbrakk>?r\<^sup>*\<^sup>* ?x ?y; ?r\<^sup>*\<^sup>* ?y ?z\<rbrakk> \<Longrightarrow> ?r\<^sup>*\<^sup>* ?x ?z
?r ?x ?y \<Longrightarrow> ?r\<^sup>*\<^sup>* ?x ?y

goal (1 subgoal):
 1. False
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. ifp (current s) v \<Longrightarrow> False
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
unrelated (current s) u \<Longrightarrow> False

goal (1 subgoal):
 1. ifp (current s) v \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ind_source (current s) u \<Longrightarrow> False
unrelated (current s) u \<Longrightarrow> False
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ind_source (current s) u \<Longrightarrow> False
unrelated (current s) u \<Longrightarrow> False

goal (1 subgoal):
 1. False
[PROOF STEP]
using 1 2
[PROOF STATE]
proof (prove)
using this:
ind_source (current s) u \<Longrightarrow> False
unrelated (current s) u \<Longrightarrow> False
ind_source (current s) u \<or> unrelated (current s) u \<or> intermediary (current s) u
\<not> intermediary (current s) u

goal (1 subgoal):
 1. False
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<not> ifp (current s) v

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from this current_next_state[THEN spec,THEN spec,where x1=s and x=execs] prec_s
             locally_respects[THEN spec,THEN spec,where x="next_state s execs"] vpeq_reflexive
[PROOF STATE]
proof (chain)
picking this:
\<not> ifp (current s) v
current (next_state s execs) = current s
precondition (next_state s execs) (next_action s execs)
\<forall>u. \<not> ifp (current (next_state s execs)) u \<and> kprecondition (next_state s execs) ?x1 \<longrightarrow> vpeq u (next_state s execs) (kstep (next_state s execs) ?x1)
\<forall>a u. vpeq u a a
[PROOF STEP]
have "vpeq v (next_state s execs) (step (next_state s execs) (next_action s execs))"
[PROOF STATE]
proof (prove)
using this:
\<not> ifp (current s) v
current (next_state s execs) = current s
precondition (next_state s execs) (next_action s execs)
\<forall>u. \<not> ifp (current (next_state s execs)) u \<and> kprecondition (next_state s execs) ?x1 \<longrightarrow> vpeq u (next_state s execs) (kstep (next_state s execs) ?x1)
\<forall>a u. vpeq u a a

goal (1 subgoal):
 1. vpeq v (next_state s execs) (step (next_state s execs) (next_action s execs))
[PROOF STEP]
unfolding step_def precondition_def B_def
[PROOF STATE]
proof (prove)
using this:
\<not> ifp (current s) v
current (next_state s execs) = current s
case next_action s execs of None \<Rightarrow> True | Some a \<Rightarrow> kprecondition (next_state s execs) a
\<forall>u. \<not> ifp (current (next_state s execs)) u \<and> kprecondition (next_state s execs) ?x1 \<longrightarrow> vpeq u (next_state s execs) (kstep (next_state s execs) ?x1)
\<forall>a u. vpeq u a a

goal (1 subgoal):
 1. vpeq v (next_state s execs) (case next_action s execs of None \<Rightarrow> next_state s execs | Some a \<Rightarrow> kstep (next_state s execs) a)
[PROOF STEP]
by (cases "next_action s execs",auto)
[PROOF STATE]
proof (state)
this:
vpeq v (next_state s execs) (step (next_state s execs) (next_action s execs))

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from not_ifp_curr_v this locally_respects_next_state vpeq_transitive
[PROOF STATE]
proof (chain)
picking this:
\<not> ifp (current s) v
vpeq v (next_state s execs) (step (next_state s execs) (next_action s execs))
\<forall>s u execs. \<not> ifp (current s) u \<longrightarrow> vpeq u s (next_state s execs)
\<forall>a b c u. vpeq u a b \<and> vpeq u b c \<longrightarrow> vpeq u a c
[PROOF STEP]
have vpeq_s_ns: "vpeq v s (step (next_state s execs) (next_action s execs))"
[PROOF STATE]
proof (prove)
using this:
\<not> ifp (current s) v
vpeq v (next_state s execs) (step (next_state s execs) (next_action s execs))
\<forall>s u execs. \<not> ifp (current s) u \<longrightarrow> vpeq u s (next_state s execs)
\<forall>a b c u. vpeq u a b \<and> vpeq u b c \<longrightarrow> vpeq u a c

goal (1 subgoal):
 1. vpeq v s (step (next_state s execs) (next_action s execs))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
vpeq v s (step (next_state s execs) (next_action s execs))

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from not_ifp_curr_v current_s_t current_next_state[THEN spec,THEN spec,where x1=t' and x=execs2] prec_t
             locally_respects[THEN spec,THEN spec,where x="next_state t' execs2"]
             F vpeq_reflexive
[PROOF STATE]
proof (chain)
picking this:
\<not> ifp (current s) v
current s = current t'
current (next_state t' execs2) = current t'
\<not> thread_empty (execs2 (current t')) \<Longrightarrow> precondition (next_state t' execs2) (next_action t' execs2)
\<forall>u. \<not> ifp (current (next_state t' execs2)) u \<and> kprecondition (next_state t' execs2) ?x1 \<longrightarrow> vpeq u (next_state t' execs2) (kstep (next_state t' execs2) ?x1)
\<not> (ifp (current s) u \<and> \<not> intermediary (current s) u)
\<forall>a u. vpeq u a a
[PROOF STEP]
have 0: "\<not> thread_empty (execs2 (current t')) \<longrightarrow> vpeq v (next_state t' execs2) (step (next_state t' execs2) (next_action t' execs2))"
[PROOF STATE]
proof (prove)
using this:
\<not> ifp (current s) v
current s = current t'
current (next_state t' execs2) = current t'
\<not> thread_empty (execs2 (current t')) \<Longrightarrow> precondition (next_state t' execs2) (next_action t' execs2)
\<forall>u. \<not> ifp (current (next_state t' execs2)) u \<and> kprecondition (next_state t' execs2) ?x1 \<longrightarrow> vpeq u (next_state t' execs2) (kstep (next_state t' execs2) ?x1)
\<not> (ifp (current s) u \<and> \<not> intermediary (current s) u)
\<forall>a u. vpeq u a a

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<longrightarrow> vpeq v (next_state t' execs2) (step (next_state t' execs2) (next_action t' execs2))
[PROOF STEP]
unfolding step_def precondition_def B_def
[PROOF STATE]
proof (prove)
using this:
\<not> ifp (current s) v
current s = current t'
current (next_state t' execs2) = current t'
\<not> thread_empty (execs2 (current t')) \<Longrightarrow> case next_action t' execs2 of None \<Rightarrow> True | Some a \<Rightarrow> kprecondition (next_state t' execs2) a
\<forall>u. \<not> ifp (current (next_state t' execs2)) u \<and> kprecondition (next_state t' execs2) ?x1 \<longrightarrow> vpeq u (next_state t' execs2) (kstep (next_state t' execs2) ?x1)
\<not> (ifp (current s) u \<and> \<not> intermediary (current s) u)
\<forall>a u. vpeq u a a

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<longrightarrow> vpeq v (next_state t' execs2) (case next_action t' execs2 of None \<Rightarrow> next_state t' execs2 | Some a \<Rightarrow> kstep (next_state t' execs2) a)
[PROOF STEP]
by (cases "next_action t' execs2",auto)
[PROOF STATE]
proof (state)
this:
\<not> thread_empty (execs2 (current t')) \<longrightarrow> vpeq v (next_state t' execs2) (step (next_state t' execs2) (next_action t' execs2))

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from 0 not_ifp_curr_v current_s_t locally_respects_next_state[THEN spec,THEN spec,THEN spec,where x2="t'" and x1=v and x="execs2"]
             vpeq_transitive
[PROOF STATE]
proof (chain)
picking this:
\<not> thread_empty (execs2 (current t')) \<longrightarrow> vpeq v (next_state t' execs2) (step (next_state t' execs2) (next_action t' execs2))
\<not> ifp (current s) v
current s = current t'
\<not> ifp (current t') v \<longrightarrow> vpeq v t' (next_state t' execs2)
\<forall>a b c u. vpeq u a b \<and> vpeq u b c \<longrightarrow> vpeq u a c
[PROOF STEP]
have vpeq_t_nt: "\<not> thread_empty (execs2 (current t')) \<longrightarrow> vpeq v t' (step (next_state t' execs2) (next_action t' execs2))"
[PROOF STATE]
proof (prove)
using this:
\<not> thread_empty (execs2 (current t')) \<longrightarrow> vpeq v (next_state t' execs2) (step (next_state t' execs2) (next_action t' execs2))
\<not> ifp (current s) v
current s = current t'
\<not> ifp (current t') v \<longrightarrow> vpeq v t' (next_state t' execs2)
\<forall>a b c u. vpeq u a b \<and> vpeq u b c \<longrightarrow> vpeq u a c

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<longrightarrow> vpeq v t' (step (next_state t' execs2) (next_action t' execs2))
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
\<not> thread_empty (execs2 (current t')) \<longrightarrow> vpeq v t' (step (next_state t' execs2) (next_action t' execs2))

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from this vpeq_reflexive
[PROOF STATE]
proof (chain)
picking this:
\<not> thread_empty (execs2 (current t')) \<longrightarrow> vpeq v t' (step (next_state t' execs2) (next_action t' execs2))
\<forall>a u. vpeq u a a
[PROOF STEP]
have vpeq_t_nt: "vpeq v t' ?nt"
[PROOF STATE]
proof (prove)
using this:
\<not> thread_empty (execs2 (current t')) \<longrightarrow> vpeq v t' (step (next_state t' execs2) (next_action t' execs2))
\<forall>a u. vpeq u a a

goal (1 subgoal):
 1. vpeq v t' (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vpeq v t' (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from vpeq_s_t ifp_v v_not_intermediary
[PROOF STATE]
proof (chain)
picking this:
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'
ifp v u
\<not> intermediary v u
[PROOF STEP]
have "vpeq v s t'"
[PROOF STATE]
proof (prove)
using this:
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'
ifp v u
\<not> intermediary v u

goal (1 subgoal):
 1. vpeq v s t'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vpeq v s t'

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from this vpeq_s_ns vpeq_t_nt vpeq_transitive vpeq_symmetric vpeq_reflexive
[PROOF STATE]
proof (chain)
picking this:
vpeq v s t'
vpeq v s (step (next_state s execs) (next_action s execs))
vpeq v t' (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))
\<forall>a b c u. vpeq u a b \<and> vpeq u b c \<longrightarrow> vpeq u a c
\<forall>a b u. vpeq u a b \<longrightarrow> vpeq u b a
\<forall>a u. vpeq u a a
[PROOF STEP]
have "vpeq v (step (next_state s execs) (next_action s execs)) ?nt"
[PROOF STATE]
proof (prove)
using this:
vpeq v s t'
vpeq v s (step (next_state s execs) (next_action s execs))
vpeq v t' (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))
\<forall>a b c u. vpeq u a b \<and> vpeq u b c \<longrightarrow> vpeq u a c
\<forall>a b u. vpeq u a b \<longrightarrow> vpeq u b a
\<forall>a u. vpeq u a a

goal (1 subgoal):
 1. vpeq v (step (next_state s execs) (next_action s execs)) (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))
[PROOF STEP]
by (metis (opaque_lifting, no_types))
[PROOF STATE]
proof (state)
this:
vpeq v (step (next_state s execs) (next_action s execs)) (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>ifp ?v2 u; \<not> intermediary ?v2 u\<rbrakk> \<Longrightarrow> vpeq ?v2 (step (next_state s execs) (next_action s execs)) (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
hence vpeq_ns_nt: "\<forall> v . ifp v u \<and> \<not>intermediary v u \<longrightarrow> vpeq v (step (next_state s execs) (next_action s execs)) ?nt"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>ifp ?v2 u; \<not> intermediary ?v2 u\<rbrakk> \<Longrightarrow> vpeq ?v2 (step (next_state s execs) (next_action s execs)) (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))

goal (1 subgoal):
 1. \<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (step (next_state s execs) (next_action s execs)) (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (step (next_state s execs) (next_action s execs)) (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from vpeq_s_t 2 F purged_a_a2 current_s_t thread_not_empty_s
[PROOF STATE]
proof (chain)
picking this:
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'
\<not> intermediary (current s) u
\<not> (ifp (current s) u \<and> \<not> intermediary (current s) u)
ipurged_relation1 u execs execs2
current s = current t'
\<not> thread_empty (execs (current s))
[PROOF STEP]
have purged_na_na2: "ipurged_relation1 u (next_execs s execs) ?na2"
[PROOF STATE]
proof (prove)
using this:
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s t'
\<not> intermediary (current s) u
\<not> (ifp (current s) u \<and> \<not> intermediary (current s) u)
ipurged_relation1 u execs execs2
current s = current t'
\<not> thread_empty (execs (current s))

goal (1 subgoal):
 1. ipurged_relation1 u (next_execs s execs) (if thread_empty (execs2 (current t')) then execs2 else next_execs t' execs2)
[PROOF STEP]
unfolding ipurged_relation1_def next_execs_def intermediary_def
[PROOF STATE]
proof (prove)
using this:
\<forall>v. ifp v u \<and> (\<nexists>va. ifp\<^sup>*\<^sup>* va v \<and> ifp v u \<and> \<not> ifp va u \<and> v \<noteq> u) \<longrightarrow> vpeq v s t'
\<nexists>v. ifp\<^sup>*\<^sup>* v (current s) \<and> ifp (current s) u \<and> \<not> ifp v u \<and> current s \<noteq> u
\<not> (ifp (current s) u \<and> (\<nexists>v. ifp\<^sup>*\<^sup>* v (current s) \<and> ifp (current s) u \<and> \<not> ifp v u \<and> current s \<noteq> u))
\<forall>d. (ifp d u \<longrightarrow> execs d = execs2 d) \<and> ((\<exists>v. ifp\<^sup>*\<^sup>* v d \<and> ifp d u \<and> \<not> ifp v u \<and> d \<noteq> u) \<longrightarrow> execs d = [])
current s = current t'
\<not> thread_empty (execs (current s))

goal (1 subgoal):
 1. \<forall>d. (ifp d u \<longrightarrow> (execs(current s := fst (snd (control s (current s) (execs (current s)))))) d = (if thread_empty (execs2 (current t')) then execs2 else execs2(current t' := fst (snd (control t' (current t') (execs2 (current t')))))) d) \<and> ((\<exists>v. ifp\<^sup>*\<^sup>* v d \<and> ifp d u \<and> \<not> ifp v u \<and> d \<noteq> u) \<longrightarrow> (execs(current s := fst (snd (control s (current s) (execs (current s)))))) d = [])
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
ipurged_relation1 u (next_execs s execs) (if thread_empty (execs2 (current t')) then execs2 else next_execs t' execs2)

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from current_ns_nt current_ns_t current_next_state
[PROOF STATE]
proof (chain)
picking this:
current (step (next_state s execs) (next_action s execs)) = current (step (next_state t' execs2) (next_action t' execs2))
current (step (next_state s execs) (next_action s execs)) = current t'
\<forall>s execs. current (next_state s execs) = current s
[PROOF STEP]
have current_ns_nt:
            "current (step (next_state s execs) (next_action s execs)) = current ?nt"
[PROOF STATE]
proof (prove)
using this:
current (step (next_state s execs) (next_action s execs)) = current (step (next_state t' execs2) (next_action t' execs2))
current (step (next_state s execs) (next_action s execs)) = current t'
\<forall>s execs. current (next_state s execs) = current s

goal (1 subgoal):
 1. current (step (next_state s execs) (next_action s execs)) = current (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
current (step (next_state s execs) (next_action s execs)) = current (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from prec_s vpeq_ns_nt no_gateway_comm_na
            and IH[where t="Some ?nt" and ?execs2.0="?na2" and u=u]
            and current_ns_nt purged_na_na2
[PROOF STATE]
proof (chain)
picking this:
precondition (next_state s execs) (next_action s execs)
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (step (next_state s execs) (next_action s execs)) (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))
does_not_communicate_with_gateway u (next_execs s execs)
does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))) u \<and> ipurged_relation1 u (next_execs s execs) (if thread_empty (execs2 (current t')) then execs2 else next_execs t' execs2) \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))) (if thread_empty (execs2 (current t')) then execs2 else next_execs t' execs2)) u
current (step (next_state s execs) (next_action s execs)) = current (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))
ipurged_relation1 u (next_execs s execs) (if thread_empty (execs2 (current t')) then execs2 else next_execs t' execs2)
[PROOF STEP]
have eq_ns_nt: "iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs))
                                               (run n (Some ?nt) ?na2) u"
[PROOF STATE]
proof (prove)
using this:
precondition (next_state s execs) (next_action s execs)
\<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v (step (next_state s execs) (next_action s execs)) (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))
does_not_communicate_with_gateway u (next_execs s execs)
does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))) u \<and> ipurged_relation1 u (next_execs s execs) (if thread_empty (execs2 (current t')) then execs2 else next_execs t' execs2) \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))) (if thread_empty (execs2 (current t')) then execs2 else next_execs t' execs2)) u
current (step (next_state s execs) (next_action s execs)) = current (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))
ipurged_relation1 u (next_execs s execs) (if thread_empty (execs2 (current t')) then execs2 else next_execs t' execs2)

goal (1 subgoal):
 1. iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))) (if thread_empty (execs2 (current t')) then execs2 else next_execs t' execs2)) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))) (if thread_empty (execs2 (current t')) then execs2 else next_execs t' execs2)) u

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from this not_interrupt thread_not_empty_s prec_t prec_s
[PROOF STATE]
proof (chain)
picking this:
iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))) (if thread_empty (execs2 (current t')) then execs2 else next_execs t' execs2)) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
\<not> thread_empty (execs2 (current t')) \<Longrightarrow> precondition (next_state t' execs2) (next_action t' execs2)
precondition (next_state s execs) (next_action s execs)
[PROOF STEP]
have current_rs_rt: "current rs = current rt"
[PROOF STATE]
proof (prove)
using this:
iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))) (if thread_empty (execs2 (current t')) then execs2 else next_execs t' execs2)) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
\<not> thread_empty (execs2 (current t')) \<Longrightarrow> precondition (next_state t' execs2) (next_action t' execs2)
precondition (next_state s execs) (next_action s execs)

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))) (if thread_empty (execs2 (current t')) then execs2 else next_execs t' execs2)) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
\<not> thread_empty (execs2 (current t')) \<Longrightarrow> precondition (next_state t' execs2) (next_action t' execs2)
precondition (next_state s execs) (next_action s execs)
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
by (cases "thread_empty (execs2 (current t'))",simp,simp)
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
fix v
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
assume ia: "ifp v u \<and> \<not>intermediary v u"
[PROOF STATE]
proof (state)
this:
ifp v u \<and> \<not> intermediary v u

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from this eq_ns_nt not_interrupt thread_not_empty_s prec_s prec_t
[PROOF STATE]
proof (chain)
picking this:
ifp v u \<and> \<not> intermediary v u
iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))) (if thread_empty (execs2 (current t')) then execs2 else next_execs t' execs2)) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
precondition (next_state s execs) (next_action s execs)
\<not> thread_empty (execs2 (current t')) \<Longrightarrow> precondition (next_state t' execs2) (next_action t' execs2)
[PROOF STEP]
have "vpeq v rs rt"
[PROOF STATE]
proof (prove)
using this:
ifp v u \<and> \<not> intermediary v u
iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))) (if thread_empty (execs2 (current t')) then execs2 else next_execs t' execs2)) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
precondition (next_state s execs) (next_action s execs)
\<not> thread_empty (execs2 (current t')) \<Longrightarrow> precondition (next_state t' execs2) (next_action t' execs2)

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
ifp v u \<and> \<not> intermediary v u
iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (if thread_empty (execs2 (current t')) then t' else step (next_state t' execs2) (next_action t' execs2))) (if thread_empty (execs2 (current t')) then execs2 else next_execs t' execs2)) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
precondition (next_state s execs) (next_action s execs)
\<not> thread_empty (execs2 (current t')) \<Longrightarrow> precondition (next_state t' execs2) (next_action t' execs2)
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
by (cases "thread_empty(execs2 (current t'))",simp,simp)
[PROOF STATE]
proof (state)
this:
vpeq v rs rt

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
ifp ?v2 u \<and> \<not> intermediary ?v2 u \<Longrightarrow> vpeq ?v2 rs rt

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
from current_rs_rt and this
[PROOF STATE]
proof (chain)
picking this:
current rs = current rt
ifp ?v2 u \<and> \<not> intermediary ?v2 u \<Longrightarrow> vpeq ?v2 rs rt
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
current rs = current rt
ifp ?v2 u \<and> \<not> intermediary ?v2 u \<Longrightarrow> vpeq ?v2 rs rt

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
current rs = current rt
ifp ?v2 u \<and> \<not> intermediary ?v2 u \<Longrightarrow> vpeq ?v2 rs rt
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some t') execs2) u

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>t = Some ?t'2; run (Suc n) (Some s) execs = Some ?rs2; run (Suc n) (Some ?t'2) execs2 = Some ?rt2; does_not_communicate_with_gateway u execs; \<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s ?t'2; current s = current ?t'2; ipurged_relation1 u execs execs2\<rbrakk> \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some ?t'2) execs2) u

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. does_not_communicate_with_gateway u (next_execs s execs) \<and> iequivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> ipurged_relation1 u (next_execs s execs) execs2 \<longrightarrow> iequivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>t = Some ?t'2; run (Suc n) (Some s) execs = Some ?rs2; run (Suc n) (Some ?t'2) execs2 = Some ?rt2; does_not_communicate_with_gateway u execs; \<forall>v. ifp v u \<and> \<not> intermediary v u \<longrightarrow> vpeq v s ?t'2; current s = current ?t'2; ipurged_relation1 u execs execs2\<rbrakk> \<Longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) (Some ?t'2) execs2) u

goal (1 subgoal):
 1. does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
by(simp add:option.splits,cases t,simp+)
[PROOF STATE]
proof (state)
this:
does_not_communicate_with_gateway u execs \<and> iequivalent_states (Some s) t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
does_not_communicate_with_gateway u execs \<and> iequivalent_states s t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n s execs) (run n t execs2) u

goal (1 subgoal):
 1. iview_partitioned
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
does_not_communicate_with_gateway ?u2 ?execs2 \<and> iequivalent_states ?s2 ?t2 ?u2 \<and> ipurged_relation1 ?u2 ?execs2 ?execs2.2 \<longrightarrow> iequivalent_states (run ?n2 ?s2 ?execs2) (run ?n2 ?t2 ?execs2.2) ?u2

goal (1 subgoal):
 1. iview_partitioned
[PROOF STEP]
hence iview_partitioned_inductive: "\<forall> u s t execs execs2 n. does_not_communicate_with_gateway u execs \<and> iequivalent_states s t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n s execs) (run n t execs2) u"
[PROOF STATE]
proof (prove)
using this:
does_not_communicate_with_gateway ?u2 ?execs2 \<and> iequivalent_states ?s2 ?t2 ?u2 \<and> ipurged_relation1 ?u2 ?execs2 ?execs2.2 \<longrightarrow> iequivalent_states (run ?n2 ?s2 ?execs2) (run ?n2 ?t2 ?execs2.2) ?u2

goal (1 subgoal):
 1. \<forall>u s t execs execs2 n. does_not_communicate_with_gateway u execs \<and> iequivalent_states s t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n s execs) (run n t execs2) u
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<forall>u s t execs execs2 n. does_not_communicate_with_gateway u execs \<and> iequivalent_states s t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n s execs) (run n t execs2) u

goal (1 subgoal):
 1. iview_partitioned
[PROOF STEP]
have ipurged_relation: "\<forall> u execs . ipurged_relation1 u (ipurge_l execs u) (ipurge_r execs u)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>u execs. ipurged_relation1 u (ipurge_l execs u) (ipurge_r execs u)
[PROOF STEP]
by(unfold ipurged_relation1_def,unfold ipurge_l_def,unfold ipurge_r_def,auto)
[PROOF STATE]
proof (state)
this:
\<forall>u execs. ipurged_relation1 u (ipurge_l execs u) (ipurge_r execs u)

goal (1 subgoal):
 1. iview_partitioned
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
\<forall>u execs. ipurged_relation1 u (ipurge_l execs u) (ipurge_r execs u)

goal (1 subgoal):
 1. iview_partitioned
[PROOF STEP]
fix execs s t n u
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. iview_partitioned
[PROOF STEP]
assume 1: "iequivalent_states s t u"
[PROOF STATE]
proof (state)
this:
iequivalent_states s t u

goal (1 subgoal):
 1. iview_partitioned
[PROOF STEP]
from ifp_reflexive
[PROOF STATE]
proof (chain)
picking this:
\<forall>u. ifp u u
[PROOF STEP]
have dir_source: "\<forall> u . ifp u u \<and> \<not>intermediary u u"
[PROOF STATE]
proof (prove)
using this:
\<forall>u. ifp u u

goal (1 subgoal):
 1. \<forall>u. ifp u u \<and> \<not> intermediary u u
[PROOF STEP]
unfolding intermediary_def
[PROOF STATE]
proof (prove)
using this:
\<forall>u. ifp u u

goal (1 subgoal):
 1. \<forall>u. ifp u u \<and> (\<nexists>v. ifp\<^sup>*\<^sup>* v u \<and> ifp u u \<and> \<not> ifp v u \<and> u \<noteq> u)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>u. ifp u u \<and> \<not> intermediary u u

goal (1 subgoal):
 1. iview_partitioned
[PROOF STEP]
from ipurge_l_removes_gateway_communications
[PROOF STATE]
proof (chain)
picking this:
does_not_communicate_with_gateway ?u (ipurge_l ?execs ?u)
[PROOF STEP]
have "does_not_communicate_with_gateway u (ipurge_l execs u)"
[PROOF STATE]
proof (prove)
using this:
does_not_communicate_with_gateway ?u (ipurge_l ?execs ?u)

goal (1 subgoal):
 1. does_not_communicate_with_gateway u (ipurge_l execs u)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
does_not_communicate_with_gateway u (ipurge_l execs u)

goal (1 subgoal):
 1. iview_partitioned
[PROOF STEP]
from 1 this iview_partitioned_inductive ipurged_relation
[PROOF STATE]
proof (chain)
picking this:
iequivalent_states s t u
does_not_communicate_with_gateway u (ipurge_l execs u)
\<forall>u s t execs execs2 n. does_not_communicate_with_gateway u execs \<and> iequivalent_states s t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n s execs) (run n t execs2) u
\<forall>u execs. ipurged_relation1 u (ipurge_l execs u) (ipurge_r execs u)
[PROOF STEP]
have "iequivalent_states (run n s (ipurge_l execs u)) (run n t (ipurge_r execs u)) u"
[PROOF STATE]
proof (prove)
using this:
iequivalent_states s t u
does_not_communicate_with_gateway u (ipurge_l execs u)
\<forall>u s t execs execs2 n. does_not_communicate_with_gateway u execs \<and> iequivalent_states s t u \<and> ipurged_relation1 u execs execs2 \<longrightarrow> iequivalent_states (run n s execs) (run n t execs2) u
\<forall>u execs. ipurged_relation1 u (ipurge_l execs u) (ipurge_r execs u)

goal (1 subgoal):
 1. iequivalent_states (run n s (ipurge_l execs u)) (run n t (ipurge_r execs u)) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
iequivalent_states (run n s (ipurge_l execs u)) (run n t (ipurge_r execs u)) u

goal (1 subgoal):
 1. iview_partitioned
[PROOF STEP]
from this dir_source
[PROOF STATE]
proof (chain)
picking this:
iequivalent_states (run n s (ipurge_l execs u)) (run n t (ipurge_r execs u)) u
\<forall>u. ifp u u \<and> \<not> intermediary u u
[PROOF STEP]
have "run n s (ipurge_l execs u) \<parallel> run n t (ipurge_r execs u) \<rightharpoonup> (\<lambda>rs rt. vpeq u rs rt \<and> current rs = current rt)"
[PROOF STATE]
proof (prove)
using this:
iequivalent_states (run n s (ipurge_l execs u)) (run n t (ipurge_r execs u)) u
\<forall>u. ifp u u \<and> \<not> intermediary u u

goal (1 subgoal):
 1. B2 (run n s (ipurge_l execs u)) (run n t (ipurge_r execs u)) (\<lambda>rs rt. vpeq u rs rt \<and> current rs = current rt)
[PROOF STEP]
using r_into_rtranclp
[PROOF STATE]
proof (prove)
using this:
iequivalent_states (run n s (ipurge_l execs u)) (run n t (ipurge_r execs u)) u
\<forall>u. ifp u u \<and> \<not> intermediary u u
?r ?x ?y \<Longrightarrow> ?r\<^sup>*\<^sup>* ?x ?y

goal (1 subgoal):
 1. B2 (run n s (ipurge_l execs u)) (run n t (ipurge_r execs u)) (\<lambda>rs rt. vpeq u rs rt \<and> current rs = current rt)
[PROOF STEP]
unfolding B_def
[PROOF STATE]
proof (prove)
using this:
iequivalent_states (run n s (ipurge_l execs u)) (run n t (ipurge_r execs u)) u
\<forall>u. ifp u u \<and> \<not> intermediary u u
?r ?x ?y \<Longrightarrow> ?r\<^sup>*\<^sup>* ?x ?y

goal (1 subgoal):
 1. B2 (run n s (ipurge_l execs u)) (run n t (ipurge_r execs u)) (\<lambda>rs rt. vpeq u rs rt \<and> current rs = current rt)
[PROOF STEP]
by(cases "run n s (ipurge_l execs u)",simp,cases "run n t (ipurge_r execs u)",simp,auto)
[PROOF STATE]
proof (state)
this:
B2 (run n s (ipurge_l execs u)) (run n t (ipurge_r execs u)) (\<lambda>rs rt. vpeq u rs rt \<and> current rs = current rt)

goal (1 subgoal):
 1. iview_partitioned
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
iequivalent_states ?s2 ?t2 ?u2 \<Longrightarrow> B2 (run ?n2 ?s2 (ipurge_l ?execs2 ?u2)) (run ?n2 ?t2 (ipurge_r ?execs2 ?u2)) (\<lambda>rs rt. vpeq ?u2 rs rt \<and> current rs = current rt)

goal (1 subgoal):
 1. iview_partitioned
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
iequivalent_states ?s2 ?t2 ?u2 \<Longrightarrow> B2 (run ?n2 ?s2 (ipurge_l ?execs2 ?u2)) (run ?n2 ?t2 (ipurge_r ?execs2 ?u2)) (\<lambda>rs rt. vpeq ?u2 rs rt \<and> current rs = current rt)

goal (1 subgoal):
 1. iview_partitioned
[PROOF STEP]
unfolding iview_partitioned_def Let_def
[PROOF STATE]
proof (prove)
using this:
iequivalent_states ?s2 ?t2 ?u2 \<Longrightarrow> B2 (run ?n2 ?s2 (ipurge_l ?execs2 ?u2)) (run ?n2 ?t2 (ipurge_r ?execs2 ?u2)) (\<lambda>rs rt. vpeq ?u2 rs rt \<and> current rs = current rt)

goal (1 subgoal):
 1. \<forall>execs ms mt n u. iequivalent_states ms mt u \<longrightarrow> B2 (run n ms (ipurge_l execs u)) (run n mt (ipurge_r execs u)) (\<lambda>rs rt. vpeq u rs rt \<and> current rs = current rt)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
iview_partitioned

goal:
No subgoals!
[PROOF STEP]
qed