[STATEMENT]
lemma makes_compatible_invariant:
  assumes sound_modes: "sound_mode_use (cms\<^sub>1, mem\<^sub>1)"
                      "sound_mode_use (cms\<^sub>2, mem\<^sub>2)"
  assumes compat: "makes_compatible (cms\<^sub>1, mem\<^sub>1) (cms\<^sub>2, mem\<^sub>2) mems"
  assumes modes_eq: "map snd cms\<^sub>1 = map snd cms\<^sub>2"
  assumes eval: "(cms\<^sub>1, mem\<^sub>1) \<rightarrow> (cms\<^sub>1', mem\<^sub>1')"
  obtains cms\<^sub>2' mem\<^sub>2' mems' where
      "map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and>
       (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and>
       makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
let ?X = "\<lambda> i. differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
from sound_modes compat modes_eq
[PROOF STATE]
proof (chain)
picking this:
sound_mode_use (cms\<^sub>1, mem\<^sub>1)
sound_mode_use (cms\<^sub>2, mem\<^sub>2)
makes_compatible (cms\<^sub>1, mem\<^sub>1) (cms\<^sub>2, mem\<^sub>2) mems
map snd cms\<^sub>1 = map snd cms\<^sub>2
[PROOF STEP]
have
    a: "\<forall> i < length cms\<^sub>1. \<forall> x \<in> (?X i). doesnt_read (fst (cms\<^sub>1 ! i)) x \<and>
                                          doesnt_read (fst (cms\<^sub>2 ! i)) x"
[PROOF STATE]
proof (prove)
using this:
sound_mode_use (cms\<^sub>1, mem\<^sub>1)
sound_mode_use (cms\<^sub>2, mem\<^sub>2)
makes_compatible (cms\<^sub>1, mem\<^sub>1) (cms\<^sub>2, mem\<^sub>2) mems
map snd cms\<^sub>1 = map snd cms\<^sub>2

goal (1 subgoal):
 1. \<forall>i<length cms\<^sub>1. \<forall>x\<in>differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i. doesnt_read (fst (cms\<^sub>1 ! i)) x \<and> doesnt_read (fst (cms\<^sub>2 ! i)) x
[PROOF STEP]
by (metis compatible_different_no_read)
[PROOF STATE]
proof (state)
this:
\<forall>i<length cms\<^sub>1. \<forall>x\<in>differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i. doesnt_read (fst (cms\<^sub>1 ! i)) x \<and> doesnt_read (fst (cms\<^sub>2 ! i)) x

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
from eval
[PROOF STATE]
proof (chain)
picking this:
(cms\<^sub>1, mem\<^sub>1) \<rightarrow> (cms\<^sub>1', mem\<^sub>1')
[PROOF STEP]
obtain k where
    b: "k < length cms\<^sub>1 \<and> (cms\<^sub>1 ! k, mem\<^sub>1) \<leadsto> (cms\<^sub>1' ! k, mem\<^sub>1') \<and>
        cms\<^sub>1' = cms\<^sub>1 [k := cms\<^sub>1' ! k]"
[PROOF STATE]
proof (prove)
using this:
(cms\<^sub>1, mem\<^sub>1) \<rightarrow> (cms\<^sub>1', mem\<^sub>1')

goal (1 subgoal):
 1. (\<And>k. k \<sqsubset> length cms\<^sub>1 \<and> (cms\<^sub>1 ! k, mem\<^sub>1) \<leadsto> (cms\<^sub>1' ! k, mem\<^sub>1') \<and> cms\<^sub>1' = cms\<^sub>1[k := cms\<^sub>1' ! k] \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis meval_elim nth_list_update_eq)
[PROOF STATE]
proof (state)
this:
k \<sqsubset> length cms\<^sub>1 \<and> (cms\<^sub>1 ! k, mem\<^sub>1) \<leadsto> (cms\<^sub>1' ! k, mem\<^sub>1') \<and> cms\<^sub>1' = cms\<^sub>1[k := cms\<^sub>1' ! k]

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
from modes_eq
[PROOF STATE]
proof (chain)
picking this:
map snd cms\<^sub>1 = map snd cms\<^sub>2
[PROOF STEP]
have equal_size: "length cms\<^sub>1 = length cms\<^sub>2"
[PROOF STATE]
proof (prove)
using this:
map snd cms\<^sub>1 = map snd cms\<^sub>2

goal (1 subgoal):
 1. length cms\<^sub>1 = length cms\<^sub>2
[PROOF STEP]
by (metis length_map)
[PROOF STATE]
proof (state)
this:
length cms\<^sub>1 = length cms\<^sub>2

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
let ?mds\<^sub>k = "snd (cms\<^sub>1 ! k)" and
      ?mds\<^sub>k' = "snd (cms\<^sub>1' ! k)" and
      ?mems\<^sub>1k = "fst (mems ! k)" and
      ?mems\<^sub>2k = "snd (mems ! k)" and
      ?n = "length cms\<^sub>1"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
have "finite (?X k)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k)
[PROOF STEP]
by (metis differing_lists_finite)
[PROOF STATE]
proof (state)
this:
finite (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k)

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
(* Obtaining cms' and mem\<^sub>2' is not in a proof block, since we
     need some of the following statements later: *)
[PROOF STATE]
proof (state)
this:
finite (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k)

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
finite (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k)
[PROOF STEP]
obtain g1 where
    c: "change_respecting (cms\<^sub>1 ! k, mem\<^sub>1) (cms\<^sub>1' ! k, mem\<^sub>1') (?X k) g1"
[PROOF STATE]
proof (prove)
using this:
finite (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k)

goal (1 subgoal):
 1. (\<And>g1. change_respecting (cms\<^sub>1 ! k, mem\<^sub>1) (cms\<^sub>1' ! k, mem\<^sub>1') (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g1 \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using noread_exists_change_respecting b a
[PROOF STATE]
proof (prove)
using this:
finite (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k)
\<lbrakk>finite ?X; \<langle>?c, ?mds, ?mem\<rangle> \<leadsto> \<langle>?c', ?mds', ?mem'\<rangle>; \<forall>x\<in>?X. doesnt_read ?c x\<rbrakk> \<Longrightarrow> \<exists>g. change_respecting \<langle>?c, ?mds, ?mem\<rangle> \<langle>?c', ?mds', ?mem'\<rangle> ?X g
k \<sqsubset> length cms\<^sub>1 \<and> (cms\<^sub>1 ! k, mem\<^sub>1) \<leadsto> (cms\<^sub>1' ! k, mem\<^sub>1') \<and> cms\<^sub>1' = cms\<^sub>1[k := cms\<^sub>1' ! k]
\<forall>i<length cms\<^sub>1. \<forall>x\<in>differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i. doesnt_read (fst (cms\<^sub>1 ! i)) x \<and> doesnt_read (fst (cms\<^sub>2 ! i)) x

goal (1 subgoal):
 1. (\<And>g1. change_respecting (cms\<^sub>1 ! k, mem\<^sub>1) (cms\<^sub>1' ! k, mem\<^sub>1') (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g1 \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis surjective_pairing)
[PROOF STATE]
proof (state)
this:
change_respecting (cms\<^sub>1 ! k, mem\<^sub>1) (cms\<^sub>1' ! k, mem\<^sub>1') (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g1

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
from compat
[PROOF STATE]
proof (chain)
picking this:
makes_compatible (cms\<^sub>1, mem\<^sub>1) (cms\<^sub>2, mem\<^sub>2) mems
[PROOF STEP]
have "\<And> \<sigma>. dom \<sigma> = ?X k \<Longrightarrow> ?mems\<^sub>1k [\<mapsto> \<sigma>] = mem\<^sub>1 [\<mapsto> \<sigma>]"
[PROOF STATE]
proof (prove)
using this:
makes_compatible (cms\<^sub>1, mem\<^sub>1) (cms\<^sub>2, mem\<^sub>2) mems

goal (1 subgoal):
 1. \<And>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> subst \<sigma> (fst (mems ! k)) = subst \<sigma> mem\<^sub>1
[PROOF STEP]
by (metis (no_types) Un_upper1 differing_vars_lists_def differing_vars_subst)
[PROOF STATE]
proof (state)
this:
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> subst ?\<sigma>5 (fst (mems ! k)) = subst ?\<sigma>5 mem\<^sub>1

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
with b and c
[PROOF STATE]
proof (chain)
picking this:
k \<sqsubset> length cms\<^sub>1 \<and> (cms\<^sub>1 ! k, mem\<^sub>1) \<leadsto> (cms\<^sub>1' ! k, mem\<^sub>1') \<and> cms\<^sub>1' = cms\<^sub>1[k := cms\<^sub>1' ! k]
change_respecting (cms\<^sub>1 ! k, mem\<^sub>1) (cms\<^sub>1' ! k, mem\<^sub>1') (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g1
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> subst ?\<sigma>5 (fst (mems ! k)) = subst ?\<sigma>5 mem\<^sub>1
[PROOF STEP]
have
    eval\<^sub>\<sigma>: "\<And> \<sigma>. dom \<sigma> = ?X k \<Longrightarrow> (cms\<^sub>1 ! k, ?mems\<^sub>1k [\<mapsto> \<sigma>]) \<leadsto> (cms\<^sub>1' ! k, mem\<^sub>1' [\<mapsto> g1 \<sigma>])"
[PROOF STATE]
proof (prove)
using this:
k \<sqsubset> length cms\<^sub>1 \<and> (cms\<^sub>1 ! k, mem\<^sub>1) \<leadsto> (cms\<^sub>1' ! k, mem\<^sub>1') \<and> cms\<^sub>1' = cms\<^sub>1[k := cms\<^sub>1' ! k]
change_respecting (cms\<^sub>1 ! k, mem\<^sub>1) (cms\<^sub>1' ! k, mem\<^sub>1') (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g1
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> subst ?\<sigma>5 (fst (mems ! k)) = subst ?\<sigma>5 mem\<^sub>1

goal (1 subgoal):
 1. \<And>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> (cms\<^sub>1 ! k, subst \<sigma> (fst (mems ! k))) \<leadsto> (cms\<^sub>1' ! k, subst (g1 \<sigma>) mem\<^sub>1')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> (cms\<^sub>1 ! k, subst ?\<sigma>5 (fst (mems ! k))) \<leadsto> (cms\<^sub>1' ! k, subst (g1 ?\<sigma>5) mem\<^sub>1')

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> (cms\<^sub>1 ! k, subst ?\<sigma>5 (fst (mems ! k))) \<leadsto> (cms\<^sub>1' ! k, subst (g1 ?\<sigma>5) mem\<^sub>1')

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
with b and compat
[PROOF STATE]
proof (chain)
picking this:
k \<sqsubset> length cms\<^sub>1 \<and> (cms\<^sub>1 ! k, mem\<^sub>1) \<leadsto> (cms\<^sub>1' ! k, mem\<^sub>1') \<and> cms\<^sub>1' = cms\<^sub>1[k := cms\<^sub>1' ! k]
makes_compatible (cms\<^sub>1, mem\<^sub>1) (cms\<^sub>2, mem\<^sub>2) mems
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> (cms\<^sub>1 ! k, subst ?\<sigma>5 (fst (mems ! k))) \<leadsto> (cms\<^sub>1' ! k, subst (g1 ?\<sigma>5) mem\<^sub>1')
[PROOF STEP]
have
    bisim\<^sub>\<sigma>: "\<And> \<sigma>. dom \<sigma> = ?X k \<Longrightarrow> (cms\<^sub>1 ! k, ?mems\<^sub>1k [\<mapsto> \<sigma>]) \<approx> (cms\<^sub>2 ! k, ?mems\<^sub>2k [\<mapsto> \<sigma>])"
[PROOF STATE]
proof (prove)
using this:
k \<sqsubset> length cms\<^sub>1 \<and> (cms\<^sub>1 ! k, mem\<^sub>1) \<leadsto> (cms\<^sub>1' ! k, mem\<^sub>1') \<and> cms\<^sub>1' = cms\<^sub>1[k := cms\<^sub>1' ! k]
makes_compatible (cms\<^sub>1, mem\<^sub>1) (cms\<^sub>2, mem\<^sub>2) mems
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> (cms\<^sub>1 ! k, subst ?\<sigma>5 (fst (mems ! k))) \<leadsto> (cms\<^sub>1' ! k, subst (g1 ?\<sigma>5) mem\<^sub>1')

goal (1 subgoal):
 1. \<And>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> (cms\<^sub>1 ! k, subst \<sigma> (fst (mems ! k))) \<approx> (cms\<^sub>2 ! k, subst \<sigma> (snd (mems ! k)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> (cms\<^sub>1 ! k, subst ?\<sigma>5 (fst (mems ! k))) \<approx> (cms\<^sub>2 ! k, subst ?\<sigma>5 (snd (mems ! k)))

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> (cms\<^sub>1 ! k, subst ?\<sigma>5 (fst (mems ! k))) \<approx> (cms\<^sub>2 ! k, subst ?\<sigma>5 (snd (mems ! k)))

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
have "snd (cms\<^sub>1 ! k) = snd (cms\<^sub>2 ! k)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd (cms\<^sub>1 ! k) = snd (cms\<^sub>2 ! k)
[PROOF STEP]
by (metis b equal_size modes_eq nth_map)
[PROOF STATE]
proof (state)
this:
snd (cms\<^sub>1 ! k) = snd (cms\<^sub>2 ! k)

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> (cms\<^sub>1 ! k, subst ?\<sigma>5 (fst (mems ! k))) \<leadsto> (cms\<^sub>1' ! k, subst (g1 ?\<sigma>5) mem\<^sub>1')
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> (cms\<^sub>1 ! k, subst ?\<sigma>5 (fst (mems ! k))) \<approx> (cms\<^sub>2 ! k, subst ?\<sigma>5 (snd (mems ! k)))
snd (cms\<^sub>1 ! k) = snd (cms\<^sub>2 ! k)
[PROOF STEP]
have d: "\<And> \<sigma>. dom \<sigma> = ?X k \<Longrightarrow> \<exists> c\<^sub>f' mem\<^sub>f'.
    (cms\<^sub>2 ! k, ?mems\<^sub>2k [\<mapsto> \<sigma>]) \<leadsto> \<langle> c\<^sub>f', ?mds\<^sub>k', mem\<^sub>f' \<rangle> \<and>
    (cms\<^sub>1' ! k, mem\<^sub>1' [\<mapsto> g1 \<sigma>]) \<approx> \<langle> c\<^sub>f', ?mds\<^sub>k', mem\<^sub>f' \<rangle>"
[PROOF STATE]
proof (prove)
using this:
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> (cms\<^sub>1 ! k, subst ?\<sigma>5 (fst (mems ! k))) \<leadsto> (cms\<^sub>1' ! k, subst (g1 ?\<sigma>5) mem\<^sub>1')
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> (cms\<^sub>1 ! k, subst ?\<sigma>5 (fst (mems ! k))) \<approx> (cms\<^sub>2 ! k, subst ?\<sigma>5 (snd (mems ! k)))
snd (cms\<^sub>1 ! k) = snd (cms\<^sub>2 ! k)

goal (1 subgoal):
 1. \<And>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> \<exists>c\<^sub>f' mem\<^sub>f'. (cms\<^sub>2 ! k, subst \<sigma> (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>f', snd (cms\<^sub>1' ! k), mem\<^sub>f'\<rangle> \<and> (cms\<^sub>1' ! k, subst (g1 \<sigma>) mem\<^sub>1') \<approx> \<langle>c\<^sub>f', snd (cms\<^sub>1' ! k), mem\<^sub>f'\<rangle>
[PROOF STEP]
by (metis mm_equiv_step)
[PROOF STATE]
proof (state)
this:
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> \<exists>c\<^sub>f' mem\<^sub>f'. (cms\<^sub>2 ! k, subst ?\<sigma>5 (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>f', snd (cms\<^sub>1' ! k), mem\<^sub>f'\<rangle> \<and> (cms\<^sub>1' ! k, subst (g1 ?\<sigma>5) mem\<^sub>1') \<approx> \<langle>c\<^sub>f', snd (cms\<^sub>1' ! k), mem\<^sub>f'\<rangle>

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
obtain h :: "'Var \<rightharpoonup> 'Val" where domh: "dom h = ?X k"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>h. dom h = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis dom_restrict_total)
[PROOF STATE]
proof (state)
this:
dom h = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
dom h = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
[PROOF STEP]
obtain c\<^sub>h mem\<^sub>h where h_prop:
    "(cms\<^sub>2 ! k, ?mems\<^sub>2k [\<mapsto> h]) \<leadsto> \<langle> c\<^sub>h, ?mds\<^sub>k', mem\<^sub>h \<rangle> \<and>
    (cms\<^sub>1' ! k, mem\<^sub>1' [\<mapsto> g1 h]) \<approx> \<langle> c\<^sub>h, ?mds\<^sub>k', mem\<^sub>h \<rangle>"
[PROOF STATE]
proof (prove)
using this:
dom h = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (1 subgoal):
 1. (\<And>c\<^sub>h mem\<^sub>h. (cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> \<and> (cms\<^sub>1' ! k, subst (g1 h) mem\<^sub>1') \<approx> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using d
[PROOF STATE]
proof (prove)
using this:
dom h = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> \<exists>c\<^sub>f' mem\<^sub>f'. (cms\<^sub>2 ! k, subst ?\<sigma>5 (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>f', snd (cms\<^sub>1' ! k), mem\<^sub>f'\<rangle> \<and> (cms\<^sub>1' ! k, subst (g1 ?\<sigma>5) mem\<^sub>1') \<approx> \<langle>c\<^sub>f', snd (cms\<^sub>1' ! k), mem\<^sub>f'\<rangle>

goal (1 subgoal):
 1. (\<And>c\<^sub>h mem\<^sub>h. (cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> \<and> (cms\<^sub>1' ! k, subst (g1 h) mem\<^sub>1') \<approx> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
(cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> \<and> (cms\<^sub>1' ! k, subst (g1 h) mem\<^sub>1') \<approx> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle>

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> \<and> (cms\<^sub>1' ! k, subst (g1 h) mem\<^sub>1') \<approx> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle>
[PROOF STEP]
obtain g2 where e:
    "change_respecting (cms\<^sub>2 ! k, ?mems\<^sub>2k [\<mapsto> h]) \<langle> c\<^sub>h, ?mds\<^sub>k', mem\<^sub>h \<rangle> (?X k) g2"
[PROOF STATE]
proof (prove)
using this:
(cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> \<and> (cms\<^sub>1' ! k, subst (g1 h) mem\<^sub>1') \<approx> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle>

goal (1 subgoal):
 1. (\<And>g2. change_respecting (cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g2 \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using a b noread_exists_change_respecting
[PROOF STATE]
proof (prove)
using this:
(cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> \<and> (cms\<^sub>1' ! k, subst (g1 h) mem\<^sub>1') \<approx> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle>
\<forall>i<length cms\<^sub>1. \<forall>x\<in>differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i. doesnt_read (fst (cms\<^sub>1 ! i)) x \<and> doesnt_read (fst (cms\<^sub>2 ! i)) x
k \<sqsubset> length cms\<^sub>1 \<and> (cms\<^sub>1 ! k, mem\<^sub>1) \<leadsto> (cms\<^sub>1' ! k, mem\<^sub>1') \<and> cms\<^sub>1' = cms\<^sub>1[k := cms\<^sub>1' ! k]
\<lbrakk>finite ?X; \<langle>?c, ?mds, ?mem\<rangle> \<leadsto> \<langle>?c', ?mds', ?mem'\<rangle>; \<forall>x\<in>?X. doesnt_read ?c x\<rbrakk> \<Longrightarrow> \<exists>g. change_respecting \<langle>?c, ?mds, ?mem\<rangle> \<langle>?c', ?mds', ?mem'\<rangle> ?X g

goal (1 subgoal):
 1. (\<And>g2. change_respecting (cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g2 \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis differing_lists_finite surjective_pairing)

  \<comment> \<open>The following statements are universally quantified
      since they are reused later:\<close>
[PROOF STATE]
proof (state)
this:
change_respecting (cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g2

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
with h_prop
[PROOF STATE]
proof (chain)
picking this:
(cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> \<and> (cms\<^sub>1' ! k, subst (g1 h) mem\<^sub>1') \<approx> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle>
change_respecting (cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g2
[PROOF STEP]
have
    "\<forall> \<sigma>. dom \<sigma> = ?X k \<longrightarrow>
      (cms\<^sub>2 ! k, ?mems\<^sub>2k [\<mapsto> h] [\<mapsto> \<sigma>]) \<leadsto> \<langle> c\<^sub>h, ?mds\<^sub>k', mem\<^sub>h [\<mapsto> g2 \<sigma>] \<rangle>"
[PROOF STATE]
proof (prove)
using this:
(cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> \<and> (cms\<^sub>1' ! k, subst (g1 h) mem\<^sub>1') \<approx> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle>
change_respecting (cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g2

goal (1 subgoal):
 1. \<forall>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<longrightarrow> (cms\<^sub>2 ! k, subst \<sigma> (subst h (snd (mems ! k)))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 \<sigma>) mem\<^sub>h\<rangle>
[PROOF STEP]
unfolding change_respecting.simps
[PROOF STATE]
proof (prove)
using this:
(cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> \<and> (cms\<^sub>1' ! k, subst (g1 h) mem\<^sub>1') \<approx> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle>
(cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> \<and> (\<forall>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<longrightarrow> g2 \<sigma> \<preceq> \<sigma>) \<and> (\<forall>\<sigma> \<sigma>'. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<and> dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<longrightarrow> dom (g2 \<sigma>) = dom (g2 \<sigma>')) \<and> (\<forall>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<longrightarrow> (cms\<^sub>2 ! k, subst \<sigma> (subst h (snd (mems ! k)))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 \<sigma>) mem\<^sub>h\<rangle>)

goal (1 subgoal):
 1. \<forall>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<longrightarrow> (cms\<^sub>2 ! k, subst \<sigma> (subst h (snd (mems ! k)))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 \<sigma>) mem\<^sub>h\<rangle>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<longrightarrow> (cms\<^sub>2 ! k, subst \<sigma> (subst h (snd (mems ! k)))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 \<sigma>) mem\<^sub>h\<rangle>

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
with domh
[PROOF STATE]
proof (chain)
picking this:
dom h = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
\<forall>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<longrightarrow> (cms\<^sub>2 ! k, subst \<sigma> (subst h (snd (mems ! k)))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 \<sigma>) mem\<^sub>h\<rangle>
[PROOF STEP]
have f:
    "\<forall> \<sigma>. dom \<sigma> = ?X k \<longrightarrow>
      (cms\<^sub>2 ! k, ?mems\<^sub>2k [\<mapsto> \<sigma>]) \<leadsto> \<langle> c\<^sub>h, ?mds\<^sub>k', mem\<^sub>h [\<mapsto> g2 \<sigma>] \<rangle>"
[PROOF STATE]
proof (prove)
using this:
dom h = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
\<forall>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<longrightarrow> (cms\<^sub>2 ! k, subst \<sigma> (subst h (snd (mems ! k)))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 \<sigma>) mem\<^sub>h\<rangle>

goal (1 subgoal):
 1. \<forall>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<longrightarrow> (cms\<^sub>2 ! k, subst \<sigma> (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 \<sigma>) mem\<^sub>h\<rangle>
[PROOF STEP]
by (auto simp: subst_overrides)
[PROOF STATE]
proof (state)
this:
\<forall>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<longrightarrow> (cms\<^sub>2 ! k, subst \<sigma> (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 \<sigma>) mem\<^sub>h\<rangle>

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
from d and f
[PROOF STATE]
proof (chain)
picking this:
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> \<exists>c\<^sub>f' mem\<^sub>f'. (cms\<^sub>2 ! k, subst ?\<sigma>5 (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>f', snd (cms\<^sub>1' ! k), mem\<^sub>f'\<rangle> \<and> (cms\<^sub>1' ! k, subst (g1 ?\<sigma>5) mem\<^sub>1') \<approx> \<langle>c\<^sub>f', snd (cms\<^sub>1' ! k), mem\<^sub>f'\<rangle>
\<forall>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<longrightarrow> (cms\<^sub>2 ! k, subst \<sigma> (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 \<sigma>) mem\<^sub>h\<rangle>
[PROOF STEP]
have g: "\<And> \<sigma>. dom \<sigma> = ?X k \<Longrightarrow>
    (cms\<^sub>2 ! k, ?mems\<^sub>2k [\<mapsto> \<sigma>]) \<leadsto> \<langle> c\<^sub>h, ?mds\<^sub>k', mem\<^sub>h [\<mapsto> g2 \<sigma>] \<rangle> \<and>
    (cms\<^sub>1' ! k, mem\<^sub>1' [\<mapsto> g1 \<sigma>]) \<approx> \<langle> c\<^sub>h, ?mds\<^sub>k', mem\<^sub>h [\<mapsto> g2 \<sigma>] \<rangle>"
[PROOF STATE]
proof (prove)
using this:
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> \<exists>c\<^sub>f' mem\<^sub>f'. (cms\<^sub>2 ! k, subst ?\<sigma>5 (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>f', snd (cms\<^sub>1' ! k), mem\<^sub>f'\<rangle> \<and> (cms\<^sub>1' ! k, subst (g1 ?\<sigma>5) mem\<^sub>1') \<approx> \<langle>c\<^sub>f', snd (cms\<^sub>1' ! k), mem\<^sub>f'\<rangle>
\<forall>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<longrightarrow> (cms\<^sub>2 ! k, subst \<sigma> (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 \<sigma>) mem\<^sub>h\<rangle>

goal (1 subgoal):
 1. \<And>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> (cms\<^sub>2 ! k, subst \<sigma> (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 \<sigma>) mem\<^sub>h\<rangle> \<and> (cms\<^sub>1' ! k, subst (g1 \<sigma>) mem\<^sub>1') \<approx> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 \<sigma>) mem\<^sub>h\<rangle>
[PROOF STEP]
using h_prop
[PROOF STATE]
proof (prove)
using this:
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> \<exists>c\<^sub>f' mem\<^sub>f'. (cms\<^sub>2 ! k, subst ?\<sigma>5 (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>f', snd (cms\<^sub>1' ! k), mem\<^sub>f'\<rangle> \<and> (cms\<^sub>1' ! k, subst (g1 ?\<sigma>5) mem\<^sub>1') \<approx> \<langle>c\<^sub>f', snd (cms\<^sub>1' ! k), mem\<^sub>f'\<rangle>
\<forall>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<longrightarrow> (cms\<^sub>2 ! k, subst \<sigma> (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 \<sigma>) mem\<^sub>h\<rangle>
(cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> \<and> (cms\<^sub>1' ! k, subst (g1 h) mem\<^sub>1') \<approx> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle>

goal (1 subgoal):
 1. \<And>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> (cms\<^sub>2 ! k, subst \<sigma> (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 \<sigma>) mem\<^sub>h\<rangle> \<and> (cms\<^sub>1' ! k, subst (g1 \<sigma>) mem\<^sub>1') \<approx> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 \<sigma>) mem\<^sub>h\<rangle>
[PROOF STEP]
by (metis deterministic)
[PROOF STATE]
proof (state)
this:
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> (cms\<^sub>2 ! k, subst ?\<sigma>5 (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 ?\<sigma>5) mem\<^sub>h\<rangle> \<and> (cms\<^sub>1' ! k, subst (g1 ?\<sigma>5) mem\<^sub>1') \<approx> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 ?\<sigma>5) mem\<^sub>h\<rangle>

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
let ?\<sigma>_mem\<^sub>2 = "to_partial mem\<^sub>2 |` ?X k"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
define mem\<^sub>2' where "mem\<^sub>2' = mem\<^sub>h [\<mapsto> g2 ?\<sigma>_mem\<^sub>2]"
[PROOF STATE]
proof (state)
this:
mem\<^sub>2' = subst (g2 (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k)) mem\<^sub>h

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
define c\<^sub>2' where "c\<^sub>2' = c\<^sub>h"
[PROOF STATE]
proof (state)
this:
c\<^sub>2' = c\<^sub>h

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
have dom\<sigma>_mem\<^sub>2: "dom ?\<sigma>_mem\<^sub>2 = ?X k"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dom (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
[PROOF STEP]
by (metis dom_restrict_total)
[PROOF STATE]
proof (state)
this:
dom (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
have "mem\<^sub>2 = ?mems\<^sub>2k [\<mapsto> ?\<sigma>_mem\<^sub>2]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mem\<^sub>2 = subst (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) (snd (mems ! k))
[PROOF STEP]
proof (rule ext)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. mem\<^sub>2 x = subst (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) (snd (mems ! k)) x
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. mem\<^sub>2 x = subst (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) (snd (mems ! k)) x
[PROOF STEP]
show "mem\<^sub>2 x = ?mems\<^sub>2k [\<mapsto> ?\<sigma>_mem\<^sub>2] x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mem\<^sub>2 x = subst (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) (snd (mems ! k)) x
[PROOF STEP]
using dom\<sigma>_mem\<^sub>2
[PROOF STATE]
proof (prove)
using this:
dom (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (1 subgoal):
 1. mem\<^sub>2 x = subst (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) (snd (mems ! k)) x
[PROOF STEP]
unfolding to_partial_def subst_def
[PROOF STATE]
proof (prove)
using this:
dom ((\<lambda>x. Some (mem\<^sub>2 x)) |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (1 subgoal):
 1. mem\<^sub>2 x = (case ((\<lambda>x. Some (mem\<^sub>2 x)) |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) x of None \<Rightarrow> snd (mems ! k) x | Some v \<Rightarrow> v)
[PROOF STEP]
apply (cases "x \<in> ?X k")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>dom ((\<lambda>x. Some (mem\<^sub>2 x)) |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k\<rbrakk> \<Longrightarrow> mem\<^sub>2 x = (case ((\<lambda>x. Some (mem\<^sub>2 x)) |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) x of None \<Rightarrow> snd (mems ! k) x | Some v \<Rightarrow> v)
 2. \<lbrakk>dom ((\<lambda>x. Some (mem\<^sub>2 x)) |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k\<rbrakk> \<Longrightarrow> mem\<^sub>2 x = (case ((\<lambda>x. Some (mem\<^sub>2 x)) |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) x of None \<Rightarrow> snd (mems ! k) x | Some v \<Rightarrow> v)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> mem\<^sub>2 x = snd (mems ! k) x
[PROOF STEP]
by (metis differing_vars_neg)
[PROOF STATE]
proof (state)
this:
mem\<^sub>2 x = subst (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) (snd (mems ! k)) x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
mem\<^sub>2 = subst (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) (snd (mems ! k))

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
with f dom\<sigma>_mem\<^sub>2
[PROOF STATE]
proof (chain)
picking this:
\<forall>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<longrightarrow> (cms\<^sub>2 ! k, subst \<sigma> (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 \<sigma>) mem\<^sub>h\<rangle>
dom (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
mem\<^sub>2 = subst (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) (snd (mems ! k))
[PROOF STEP]
have i: "(cms\<^sub>2 ! k, mem\<^sub>2) \<leadsto> \<langle> c\<^sub>2', ?mds\<^sub>k', mem\<^sub>2' \<rangle>"
[PROOF STATE]
proof (prove)
using this:
\<forall>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<longrightarrow> (cms\<^sub>2 ! k, subst \<sigma> (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 \<sigma>) mem\<^sub>h\<rangle>
dom (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
mem\<^sub>2 = subst (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) (snd (mems ! k))

goal (1 subgoal):
 1. (cms\<^sub>2 ! k, mem\<^sub>2) \<leadsto> \<langle>c\<^sub>2', snd (cms\<^sub>1' ! k), mem\<^sub>2'\<rangle>
[PROOF STEP]
unfolding mem\<^sub>2'_def c\<^sub>2'_def
[PROOF STATE]
proof (prove)
using this:
\<forall>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<longrightarrow> (cms\<^sub>2 ! k, subst \<sigma> (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 \<sigma>) mem\<^sub>h\<rangle>
dom (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
mem\<^sub>2 = subst (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) (snd (mems ! k))

goal (1 subgoal):
 1. (cms\<^sub>2 ! k, mem\<^sub>2) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k)) mem\<^sub>h\<rangle>
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
(cms\<^sub>2 ! k, mem\<^sub>2) \<leadsto> \<langle>c\<^sub>2', snd (cms\<^sub>1' ! k), mem\<^sub>2'\<rangle>

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
define cms\<^sub>2' where "cms\<^sub>2' = cms\<^sub>2 [k := (c\<^sub>2', ?mds\<^sub>k')]"
[PROOF STATE]
proof (state)
this:
cms\<^sub>2' = cms\<^sub>2[k := (c\<^sub>2', snd (cms\<^sub>1' ! k))]

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
with i b equal_size
[PROOF STATE]
proof (chain)
picking this:
(cms\<^sub>2 ! k, mem\<^sub>2) \<leadsto> \<langle>c\<^sub>2', snd (cms\<^sub>1' ! k), mem\<^sub>2'\<rangle>
k \<sqsubset> length cms\<^sub>1 \<and> (cms\<^sub>1 ! k, mem\<^sub>1) \<leadsto> (cms\<^sub>1' ! k, mem\<^sub>1') \<and> cms\<^sub>1' = cms\<^sub>1[k := cms\<^sub>1' ! k]
length cms\<^sub>1 = length cms\<^sub>2
cms\<^sub>2' = cms\<^sub>2[k := (c\<^sub>2', snd (cms\<^sub>1' ! k))]
[PROOF STEP]
have "(cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2')"
[PROOF STATE]
proof (prove)
using this:
(cms\<^sub>2 ! k, mem\<^sub>2) \<leadsto> \<langle>c\<^sub>2', snd (cms\<^sub>1' ! k), mem\<^sub>2'\<rangle>
k \<sqsubset> length cms\<^sub>1 \<and> (cms\<^sub>1 ! k, mem\<^sub>1) \<leadsto> (cms\<^sub>1' ! k, mem\<^sub>1') \<and> cms\<^sub>1' = cms\<^sub>1[k := cms\<^sub>1' ! k]
length cms\<^sub>1 = length cms\<^sub>2
cms\<^sub>2' = cms\<^sub>2[k := (c\<^sub>2', snd (cms\<^sub>1' ! k))]

goal (1 subgoal):
 1. (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2')
[PROOF STEP]
by (metis meval_intro)
[PROOF STATE]
proof (state)
this:
(cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2')

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2')

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
from equal_size
[PROOF STATE]
proof (chain)
picking this:
length cms\<^sub>1 = length cms\<^sub>2
[PROOF STEP]
have new_length: "length cms\<^sub>1' = length cms\<^sub>2'"
[PROOF STATE]
proof (prove)
using this:
length cms\<^sub>1 = length cms\<^sub>2

goal (1 subgoal):
 1. length cms\<^sub>1' = length cms\<^sub>2'
[PROOF STEP]
unfolding cms\<^sub>2'_def
[PROOF STATE]
proof (prove)
using this:
length cms\<^sub>1 = length cms\<^sub>2

goal (1 subgoal):
 1. length cms\<^sub>1' = length (cms\<^sub>2[k := (c\<^sub>2', snd (cms\<^sub>1' ! k))])
[PROOF STEP]
by (metis eval length_list_update meval_elim)
[PROOF STATE]
proof (state)
this:
length cms\<^sub>1' = length cms\<^sub>2'

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
with modes_eq
[PROOF STATE]
proof (chain)
picking this:
map snd cms\<^sub>1 = map snd cms\<^sub>2
length cms\<^sub>1' = length cms\<^sub>2'
[PROOF STEP]
have "map snd cms\<^sub>1' = map snd cms\<^sub>2'"
[PROOF STATE]
proof (prove)
using this:
map snd cms\<^sub>1 = map snd cms\<^sub>2
length cms\<^sub>1' = length cms\<^sub>2'

goal (1 subgoal):
 1. map snd cms\<^sub>1' = map snd cms\<^sub>2'
[PROOF STEP]
unfolding cms\<^sub>2'_def
[PROOF STATE]
proof (prove)
using this:
map snd cms\<^sub>1 = map snd cms\<^sub>2
length cms\<^sub>1' = length (cms\<^sub>2[k := (c\<^sub>2', snd (cms\<^sub>1' ! k))])

goal (1 subgoal):
 1. map snd cms\<^sub>1' = map snd (cms\<^sub>2[k := (c\<^sub>2', snd (cms\<^sub>1' ! k))])
[PROOF STEP]
by (metis b map_update snd_conv)
[PROOF STATE]
proof (state)
this:
map snd cms\<^sub>1' = map snd cms\<^sub>2'

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
map snd cms\<^sub>1' = map snd cms\<^sub>2'

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
from c and e
[PROOF STATE]
proof (chain)
picking this:
change_respecting (cms\<^sub>1 ! k, mem\<^sub>1) (cms\<^sub>1' ! k, mem\<^sub>1') (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g1
change_respecting (cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g2
[PROOF STEP]
obtain dom_g1 dom_g2 where
    dom_uniq: "\<And> \<sigma>. dom \<sigma> = ?X k \<Longrightarrow> dom_g1 = dom (g1 \<sigma>)"
              "\<And> \<sigma>. dom \<sigma> = ?X k \<Longrightarrow> dom_g2 = dom (g2 \<sigma>)"
[PROOF STATE]
proof (prove)
using this:
change_respecting (cms\<^sub>1 ! k, mem\<^sub>1) (cms\<^sub>1' ! k, mem\<^sub>1') (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g1
change_respecting (cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g2

goal (1 subgoal):
 1. (\<And>dom_g1 dom_g2. \<lbrakk>\<And>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> dom_g1 = dom (g1 \<sigma>); \<And>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> dom_g2 = dom (g2 \<sigma>)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis change_respecting.simps domh)

  \<comment> \<open>This is the complicated part of the proof.\<close>
[PROOF STATE]
proof (state)
this:
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> dom_g1 = dom (g1 ?\<sigma>5)
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> dom_g2 = dom (g2 ?\<sigma>5)

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
obtain mems' where "makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>mems'. makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<And>mems'. makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') ?mems'12
[PROOF STEP]
define mems'_k
      where "mems'_k x =
      (if x \<notin> ?X k
       then (mem\<^sub>1' x, mem\<^sub>2' x)
       else if (x \<notin> dom_g1) \<or> (x \<notin> dom_g2)
       then (mem\<^sub>1' x, mem\<^sub>2' x)
       else (?mems\<^sub>1k x, ?mems\<^sub>2k x))" for x
    \<comment> \<open>This is used in two of the following cases, so we prove it beforehand:\<close>
[PROOF STATE]
proof (state)
this:
mems'_k ?x = (if ?x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then (mem\<^sub>1' ?x, mem\<^sub>2' ?x) else if ?x \<notin> dom_g1 \<or> ?x \<notin> dom_g2 then (mem\<^sub>1' ?x, mem\<^sub>2' ?x) else (fst (mems ! k) ?x, snd (mems ! k) ?x))

goal (1 subgoal):
 1. (\<And>mems'. makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') ?mems'12
[PROOF STEP]
have x_unchanged: "\<And> x. \<lbrakk> x \<in> ?X k; x \<in> dom_g1; x \<in> dom_g2 \<rbrakk> \<Longrightarrow>
      mem\<^sub>1 x = mem\<^sub>1' x \<and> mem\<^sub>2 x = mem\<^sub>2' x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2\<rbrakk> \<Longrightarrow> mem\<^sub>1 x = mem\<^sub>1' x \<and> mem\<^sub>2 x = mem\<^sub>2' x
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2\<rbrakk> \<Longrightarrow> mem\<^sub>1 x = mem\<^sub>1' x
 2. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2\<rbrakk> \<Longrightarrow> mem\<^sub>2 x = mem\<^sub>2' x
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2\<rbrakk> \<Longrightarrow> mem\<^sub>1 x = mem\<^sub>1' x
 2. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2\<rbrakk> \<Longrightarrow> mem\<^sub>2 x = mem\<^sub>2' x
[PROOF STEP]
assume "x \<in> ?X k" and "x \<in> dom_g1"
[PROOF STATE]
proof (state)
this:
x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
x \<in> dom_g1

goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2\<rbrakk> \<Longrightarrow> mem\<^sub>1 x = mem\<^sub>1' x
 2. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2\<rbrakk> \<Longrightarrow> mem\<^sub>2 x = mem\<^sub>2' x
[PROOF STEP]
thus "mem\<^sub>1 x = mem\<^sub>1' x"
[PROOF STATE]
proof (prove)
using this:
x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
x \<in> dom_g1

goal (1 subgoal):
 1. mem\<^sub>1 x = mem\<^sub>1' x
[PROOF STEP]
using a b c
[PROOF STATE]
proof (prove)
using this:
x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
x \<in> dom_g1
\<forall>i<length cms\<^sub>1. \<forall>x\<in>differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i. doesnt_read (fst (cms\<^sub>1 ! i)) x \<and> doesnt_read (fst (cms\<^sub>2 ! i)) x
k \<sqsubset> length cms\<^sub>1 \<and> (cms\<^sub>1 ! k, mem\<^sub>1) \<leadsto> (cms\<^sub>1' ! k, mem\<^sub>1') \<and> cms\<^sub>1' = cms\<^sub>1[k := cms\<^sub>1' ! k]
change_respecting (cms\<^sub>1 ! k, mem\<^sub>1) (cms\<^sub>1' ! k, mem\<^sub>1') (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g1

goal (1 subgoal):
 1. mem\<^sub>1 x = mem\<^sub>1' x
[PROOF STEP]
by (metis change_respecting_doesnt_modify dom_uniq(1) domh)
[PROOF STATE]
proof (state)
this:
mem\<^sub>1 x = mem\<^sub>1' x

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2\<rbrakk> \<Longrightarrow> mem\<^sub>2 x = mem\<^sub>2' x
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2\<rbrakk> \<Longrightarrow> mem\<^sub>2 x = mem\<^sub>2' x
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2\<rbrakk> \<Longrightarrow> mem\<^sub>2 x = mem\<^sub>2' x
[PROOF STEP]
assume "x \<in> ?X k" and "x \<in> dom_g2"
[PROOF STATE]
proof (state)
this:
x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
x \<in> dom_g2

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2\<rbrakk> \<Longrightarrow> mem\<^sub>2 x = mem\<^sub>2' x
[PROOF STEP]
hence eq_mem\<^sub>2: "?\<sigma>_mem\<^sub>2 x = Some (mem\<^sub>2 x)"
[PROOF STATE]
proof (prove)
using this:
x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
x \<in> dom_g2

goal (1 subgoal):
 1. (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) x = Some (mem\<^sub>2 x)
[PROOF STEP]
by (metis restrict_in to_partial_def)
[PROOF STATE]
proof (state)
this:
(to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) x = Some (mem\<^sub>2 x)

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2\<rbrakk> \<Longrightarrow> mem\<^sub>2 x = mem\<^sub>2' x
[PROOF STEP]
hence "?mems\<^sub>2k [\<mapsto> h] [\<mapsto> ?\<sigma>_mem\<^sub>2] x = mem\<^sub>2 x"
[PROOF STATE]
proof (prove)
using this:
(to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) x = Some (mem\<^sub>2 x)

goal (1 subgoal):
 1. subst (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) (subst h (snd (mems ! k))) x = mem\<^sub>2 x
[PROOF STEP]
by (auto simp: subst_def)
[PROOF STATE]
proof (state)
this:
subst (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) (subst h (snd (mems ! k))) x = mem\<^sub>2 x

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2\<rbrakk> \<Longrightarrow> mem\<^sub>2 x = mem\<^sub>2' x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
subst (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) (subst h (snd (mems ! k))) x = mem\<^sub>2 x

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2\<rbrakk> \<Longrightarrow> mem\<^sub>2 x = mem\<^sub>2' x
[PROOF STEP]
from \<open>x \<in> dom_g2\<close> dom_uniq e
[PROOF STATE]
proof (chain)
picking this:
x \<in> dom_g2
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> dom_g1 = dom (g1 ?\<sigma>5)
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> dom_g2 = dom (g2 ?\<sigma>5)
change_respecting (cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g2
[PROOF STEP]
have g_eq: "g2 ?\<sigma>_mem\<^sub>2 x = Some (mem\<^sub>2 x)"
[PROOF STATE]
proof (prove)
using this:
x \<in> dom_g2
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> dom_g1 = dom (g1 ?\<sigma>5)
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> dom_g2 = dom (g2 ?\<sigma>5)
change_respecting (cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g2

goal (1 subgoal):
 1. g2 (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) x = Some (mem\<^sub>2 x)
[PROOF STEP]
unfolding change_respecting.simps func_le_def
[PROOF STATE]
proof (prove)
using this:
x \<in> dom_g2
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> dom_g1 = dom (g1 ?\<sigma>5)
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> dom_g2 = dom (g2 ?\<sigma>5)
(cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> \<and> (\<forall>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<longrightarrow> (\<forall>x\<in>dom (g2 \<sigma>). g2 \<sigma> x = \<sigma> x)) \<and> (\<forall>\<sigma> \<sigma>'. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<and> dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<longrightarrow> dom (g2 \<sigma>) = dom (g2 \<sigma>')) \<and> (\<forall>\<sigma>. dom \<sigma> = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<longrightarrow> (cms\<^sub>2 ! k, subst \<sigma> (subst h (snd (mems ! k)))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 \<sigma>) mem\<^sub>h\<rangle>)

goal (1 subgoal):
 1. g2 (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) x = Some (mem\<^sub>2 x)
[PROOF STEP]
by (metis dom_restrict_total eq_mem\<^sub>2)
[PROOF STATE]
proof (state)
this:
g2 (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) x = Some (mem\<^sub>2 x)

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2\<rbrakk> \<Longrightarrow> mem\<^sub>2 x = mem\<^sub>2' x
[PROOF STEP]
hence "mem\<^sub>h [\<mapsto> g2 ?\<sigma>_mem\<^sub>2] x = mem\<^sub>2 x"
[PROOF STATE]
proof (prove)
using this:
g2 (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) x = Some (mem\<^sub>2 x)

goal (1 subgoal):
 1. subst (g2 (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k)) mem\<^sub>h x = mem\<^sub>2 x
[PROOF STEP]
by (auto simp: subst_def)
[PROOF STATE]
proof (state)
this:
subst (g2 (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k)) mem\<^sub>h x = mem\<^sub>2 x

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2\<rbrakk> \<Longrightarrow> mem\<^sub>2 x = mem\<^sub>2' x
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
subst (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) (subst h (snd (mems ! k))) x = mem\<^sub>2 x
subst (g2 (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k)) mem\<^sub>h x = mem\<^sub>2 x
[PROOF STEP]
have "?mems\<^sub>2k [\<mapsto> h] [\<mapsto> ?\<sigma>_mem\<^sub>2] x = mem\<^sub>h [\<mapsto> g2 ?\<sigma>_mem\<^sub>2] x"
[PROOF STATE]
proof (prove)
using this:
subst (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) (subst h (snd (mems ! k))) x = mem\<^sub>2 x
subst (g2 (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k)) mem\<^sub>h x = mem\<^sub>2 x

goal (1 subgoal):
 1. subst (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) (subst h (snd (mems ! k))) x = subst (g2 (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k)) mem\<^sub>h x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
subst (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) (subst h (snd (mems ! k))) x = subst (g2 (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k)) mem\<^sub>h x

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2\<rbrakk> \<Longrightarrow> mem\<^sub>2 x = mem\<^sub>2' x
[PROOF STEP]
thus "mem\<^sub>2 x = mem\<^sub>2' x"
[PROOF STATE]
proof (prove)
using this:
subst (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) (subst h (snd (mems ! k))) x = subst (g2 (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k)) mem\<^sub>h x

goal (1 subgoal):
 1. mem\<^sub>2 x = mem\<^sub>2' x
[PROOF STEP]
by (metis \<open>mem\<^sub>2 = ?mems\<^sub>2k [\<mapsto> ?\<sigma>_mem\<^sub>2]\<close> dom\<sigma>_mem\<^sub>2 domh mem\<^sub>2'_def subst_overrides)
[PROOF STATE]
proof (state)
this:
mem\<^sub>2 x = mem\<^sub>2' x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>?x5 \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; ?x5 \<in> dom_g1; ?x5 \<in> dom_g2\<rbrakk> \<Longrightarrow> mem\<^sub>1 ?x5 = mem\<^sub>1' ?x5 \<and> mem\<^sub>2 ?x5 = mem\<^sub>2' ?x5

goal (1 subgoal):
 1. (\<And>mems'. makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') ?mems'12
[PROOF STEP]
define mems'_i
      where "mems'_i i x =
       (if ((mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and>
          (mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High))
         then (mem\<^sub>1' x, mem\<^sub>2' x)
         else if ((mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and>
                  (mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low))
              then (some_val, some_val)
              else (fst (mems ! i) x, snd (mems ! i) x))" for i x
[PROOF STATE]
proof (state)
this:
mems'_i ?i ?x = (if (mem\<^sub>1 ?x \<noteq> mem\<^sub>1' ?x \<or> mem\<^sub>2 ?x \<noteq> mem\<^sub>2' ?x) \<and> (mem\<^sub>1' ?x = mem\<^sub>2' ?x \<or> dma ?x = High) then (mem\<^sub>1' ?x, mem\<^sub>2' ?x) else if (mem\<^sub>1 ?x \<noteq> mem\<^sub>1' ?x \<or> mem\<^sub>2 ?x \<noteq> mem\<^sub>2' ?x) \<and> mem\<^sub>1' ?x \<noteq> mem\<^sub>2' ?x \<and> dma ?x = Low then (some_val, some_val) else (fst (mems ! ?i) ?x, snd (mems ! ?i) ?x))

goal (1 subgoal):
 1. (\<And>mems'. makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') ?mems'12
[PROOF STEP]
define mems'
      where "mems' =
       map (\<lambda> i.
            if i = k
            then (fst \<circ> mems'_k, snd \<circ> mems'_k)
            else (fst \<circ> mems'_i i, snd \<circ> mems'_i i))
      [0..< length cms\<^sub>1]"
[PROOF STATE]
proof (state)
this:
mems' = map (\<lambda>i. if i = k then (fst \<circ> mems'_k, snd \<circ> mems'_k) else (fst \<circ> mems'_i i, snd \<circ> mems'_i i)) [0..<length cms\<^sub>1]

goal (1 subgoal):
 1. (\<And>mems'. makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') ?mems'12
[PROOF STEP]
from b
[PROOF STATE]
proof (chain)
picking this:
k \<sqsubset> length cms\<^sub>1 \<and> (cms\<^sub>1 ! k, mem\<^sub>1) \<leadsto> (cms\<^sub>1' ! k, mem\<^sub>1') \<and> cms\<^sub>1' = cms\<^sub>1[k := cms\<^sub>1' ! k]
[PROOF STEP]
have mems'_k_simp: "mems' ! k = (fst \<circ> mems'_k, snd \<circ> mems'_k)"
[PROOF STATE]
proof (prove)
using this:
k \<sqsubset> length cms\<^sub>1 \<and> (cms\<^sub>1 ! k, mem\<^sub>1) \<leadsto> (cms\<^sub>1' ! k, mem\<^sub>1') \<and> cms\<^sub>1' = cms\<^sub>1[k := cms\<^sub>1' ! k]

goal (1 subgoal):
 1. mems' ! k = (fst \<circ> mems'_k, snd \<circ> mems'_k)
[PROOF STEP]
unfolding mems'_def
[PROOF STATE]
proof (prove)
using this:
k \<sqsubset> length cms\<^sub>1 \<and> (cms\<^sub>1 ! k, mem\<^sub>1) \<leadsto> (cms\<^sub>1' ! k, mem\<^sub>1') \<and> cms\<^sub>1' = cms\<^sub>1[k := cms\<^sub>1' ! k]

goal (1 subgoal):
 1. map (\<lambda>i. if i = k then (fst \<circ> mems'_k, snd \<circ> mems'_k) else (fst \<circ> mems'_i i, snd \<circ> mems'_i i)) [0..<length cms\<^sub>1] ! k = (fst \<circ> mems'_k, snd \<circ> mems'_k)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
mems' ! k = (fst \<circ> mems'_k, snd \<circ> mems'_k)

goal (1 subgoal):
 1. (\<And>mems'. makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') ?mems'12
[PROOF STEP]
have mems'_simp2: "\<lbrakk> i \<noteq> k; i < length cms\<^sub>1 \<rbrakk> \<Longrightarrow>
      mems' ! i = (fst \<circ> mems'_i i, snd \<circ> mems'_i i)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>i \<noteq> k; i \<sqsubset> length cms\<^sub>1\<rbrakk> \<Longrightarrow> mems' ! i = (fst \<circ> mems'_i i, snd \<circ> mems'_i i)
[PROOF STEP]
unfolding mems'_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>i \<noteq> k; i \<sqsubset> length cms\<^sub>1\<rbrakk> \<Longrightarrow> map (\<lambda>i. if i = k then (fst \<circ> mems'_k, snd \<circ> mems'_k) else (fst \<circ> mems'_i i, snd \<circ> mems'_i i)) [0..<length cms\<^sub>1] ! i = (fst \<circ> mems'_i i, snd \<circ> mems'_i i)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>i \<noteq> k; i \<sqsubset> length cms\<^sub>1\<rbrakk> \<Longrightarrow> mems' ! i = (fst \<circ> mems'_i i, snd \<circ> mems'_i i)

goal (1 subgoal):
 1. (\<And>mems'. makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') ?mems'12
[PROOF STEP]
(* Some auxiliary statements to allow reasoning about these definitions as if they were given
       by cases instead of nested if clauses. *)
[PROOF STATE]
proof (state)
this:
\<lbrakk>i \<noteq> k; i \<sqsubset> length cms\<^sub>1\<rbrakk> \<Longrightarrow> mems' ! i = (fst \<circ> mems'_i i, snd \<circ> mems'_i i)

goal (1 subgoal):
 1. (\<And>mems'. makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') ?mems'12
[PROOF STEP]
have mems'_k_1 [simp]: "\<And> x. \<lbrakk> x \<notin> ?X k \<rbrakk> \<Longrightarrow>
      fst (mems' ! k) x = mem\<^sub>1' x \<and> snd (mems' ! k) x = mem\<^sub>2' x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> fst (mems' ! k) x = mem\<^sub>1' x \<and> snd (mems' ! k) x = mem\<^sub>2' x
[PROOF STEP]
unfolding mems'_k_simp mems'_k_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> fst (fst \<circ> (\<lambda>x. if x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then (mem\<^sub>1' x, mem\<^sub>2' x) else if x \<notin> dom_g1 \<or> x \<notin> dom_g2 then (mem\<^sub>1' x, mem\<^sub>2' x) else (fst (mems ! k) x, snd (mems ! k) x)), snd \<circ> (\<lambda>x. if x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then (mem\<^sub>1' x, mem\<^sub>2' x) else if x \<notin> dom_g1 \<or> x \<notin> dom_g2 then (mem\<^sub>1' x, mem\<^sub>2' x) else (fst (mems ! k) x, snd (mems ! k) x))) x = mem\<^sub>1' x \<and> snd (fst \<circ> (\<lambda>x. if x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then (mem\<^sub>1' x, mem\<^sub>2' x) else if x \<notin> dom_g1 \<or> x \<notin> dom_g2 then (mem\<^sub>1' x, mem\<^sub>2' x) else (fst (mems ! k) x, snd (mems ! k) x)), snd \<circ> (\<lambda>x. if x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then (mem\<^sub>1' x, mem\<^sub>2' x) else if x \<notin> dom_g1 \<or> x \<notin> dom_g2 then (mem\<^sub>1' x, mem\<^sub>2' x) else (fst (mems ! k) x, snd (mems ! k) x))) x = mem\<^sub>2' x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?x5 \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> fst (mems' ! k) ?x5 = mem\<^sub>1' ?x5 \<and> snd (mems' ! k) ?x5 = mem\<^sub>2' ?x5

goal (1 subgoal):
 1. (\<And>mems'. makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') ?mems'12
[PROOF STEP]
have mems'_k_2 [simp]: "\<And> x. \<lbrakk> x \<in> ?X k; x \<notin> dom_g1 \<or> x \<notin> dom_g2 \<rbrakk> \<Longrightarrow>
      fst (mems' ! k) x = mem\<^sub>1' x \<and> snd (mems' ! k) x = mem\<^sub>2' x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<notin> dom_g1 \<or> x \<notin> dom_g2\<rbrakk> \<Longrightarrow> fst (mems' ! k) x = mem\<^sub>1' x \<and> snd (mems' ! k) x = mem\<^sub>2' x
[PROOF STEP]
unfolding mems'_k_simp mems'_k_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<notin> dom_g1 \<or> x \<notin> dom_g2\<rbrakk> \<Longrightarrow> fst (fst \<circ> (\<lambda>x. if x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then (mem\<^sub>1' x, mem\<^sub>2' x) else if x \<notin> dom_g1 \<or> x \<notin> dom_g2 then (mem\<^sub>1' x, mem\<^sub>2' x) else (fst (mems ! k) x, snd (mems ! k) x)), snd \<circ> (\<lambda>x. if x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then (mem\<^sub>1' x, mem\<^sub>2' x) else if x \<notin> dom_g1 \<or> x \<notin> dom_g2 then (mem\<^sub>1' x, mem\<^sub>2' x) else (fst (mems ! k) x, snd (mems ! k) x))) x = mem\<^sub>1' x \<and> snd (fst \<circ> (\<lambda>x. if x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then (mem\<^sub>1' x, mem\<^sub>2' x) else if x \<notin> dom_g1 \<or> x \<notin> dom_g2 then (mem\<^sub>1' x, mem\<^sub>2' x) else (fst (mems ! k) x, snd (mems ! k) x)), snd \<circ> (\<lambda>x. if x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then (mem\<^sub>1' x, mem\<^sub>2' x) else if x \<notin> dom_g1 \<or> x \<notin> dom_g2 then (mem\<^sub>1' x, mem\<^sub>2' x) else (fst (mems ! k) x, snd (mems ! k) x))) x = mem\<^sub>2' x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>?x5 \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; ?x5 \<notin> dom_g1 \<or> ?x5 \<notin> dom_g2\<rbrakk> \<Longrightarrow> fst (mems' ! k) ?x5 = mem\<^sub>1' ?x5 \<and> snd (mems' ! k) ?x5 = mem\<^sub>2' ?x5

goal (1 subgoal):
 1. (\<And>mems'. makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') ?mems'12
[PROOF STEP]
have mems'_k_3 [simp]: "\<And> x. \<lbrakk> x \<in> ?X k; x \<in> dom_g1; x \<in> dom_g2 \<rbrakk> \<Longrightarrow>
      fst (mems' ! k) x = fst (mems ! k) x \<and> snd (mems' ! k) x = snd (mems ! k) x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2\<rbrakk> \<Longrightarrow> fst (mems' ! k) x = fst (mems ! k) x \<and> snd (mems' ! k) x = snd (mems ! k) x
[PROOF STEP]
unfolding mems'_k_simp mems'_k_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2\<rbrakk> \<Longrightarrow> fst (fst \<circ> (\<lambda>x. if x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then (mem\<^sub>1' x, mem\<^sub>2' x) else if x \<notin> dom_g1 \<or> x \<notin> dom_g2 then (mem\<^sub>1' x, mem\<^sub>2' x) else (fst (mems ! k) x, snd (mems ! k) x)), snd \<circ> (\<lambda>x. if x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then (mem\<^sub>1' x, mem\<^sub>2' x) else if x \<notin> dom_g1 \<or> x \<notin> dom_g2 then (mem\<^sub>1' x, mem\<^sub>2' x) else (fst (mems ! k) x, snd (mems ! k) x))) x = fst (mems ! k) x \<and> snd (fst \<circ> (\<lambda>x. if x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then (mem\<^sub>1' x, mem\<^sub>2' x) else if x \<notin> dom_g1 \<or> x \<notin> dom_g2 then (mem\<^sub>1' x, mem\<^sub>2' x) else (fst (mems ! k) x, snd (mems ! k) x)), snd \<circ> (\<lambda>x. if x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then (mem\<^sub>1' x, mem\<^sub>2' x) else if x \<notin> dom_g1 \<or> x \<notin> dom_g2 then (mem\<^sub>1' x, mem\<^sub>2' x) else (fst (mems ! k) x, snd (mems ! k) x))) x = snd (mems ! k) x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>?x5 \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; ?x5 \<in> dom_g1; ?x5 \<in> dom_g2\<rbrakk> \<Longrightarrow> fst (mems' ! k) ?x5 = fst (mems ! k) ?x5 \<and> snd (mems' ! k) ?x5 = snd (mems ! k) ?x5

goal (1 subgoal):
 1. (\<And>mems'. makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') ?mems'12
[PROOF STEP]
have mems'_k_cases:
      "\<And> P x.
        \<lbrakk>
         \<lbrakk> x \<notin> ?X k \<or> x \<notin> dom_g1 \<or> x \<notin> dom_g2;
           fst (mems' ! k) x = mem\<^sub>1' x;
           snd (mems' ! k) x = mem\<^sub>2' x \<rbrakk> \<Longrightarrow> P x;
         \<lbrakk> x \<in> ?X k; x \<in> dom_g1; x \<in> dom_g2;
           fst (mems' ! k) x = fst (mems ! k) x;
           snd (mems' ! k) x = snd (mems ! k) x \<rbrakk> \<Longrightarrow> P x \<rbrakk> \<Longrightarrow> P x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>P x. \<lbrakk>\<lbrakk>x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<or> x \<notin> dom_g1 \<or> x \<notin> dom_g2; fst (mems' ! k) x = mem\<^sub>1' x; snd (mems' ! k) x = mem\<^sub>2' x\<rbrakk> \<Longrightarrow> P x; \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2; fst (mems' ! k) x = fst (mems ! k) x; snd (mems' ! k) x = snd (mems ! k) x\<rbrakk> \<Longrightarrow> P x\<rbrakk> \<Longrightarrow> P x
[PROOF STEP]
using mems'_k_1 mems'_k_2 mems'_k_3
[PROOF STATE]
proof (prove)
using this:
?x5 \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> fst (mems' ! k) ?x5 = mem\<^sub>1' ?x5 \<and> snd (mems' ! k) ?x5 = mem\<^sub>2' ?x5
\<lbrakk>?x5 \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; ?x5 \<notin> dom_g1 \<or> ?x5 \<notin> dom_g2\<rbrakk> \<Longrightarrow> fst (mems' ! k) ?x5 = mem\<^sub>1' ?x5 \<and> snd (mems' ! k) ?x5 = mem\<^sub>2' ?x5
\<lbrakk>?x5 \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; ?x5 \<in> dom_g1; ?x5 \<in> dom_g2\<rbrakk> \<Longrightarrow> fst (mems' ! k) ?x5 = fst (mems ! k) ?x5 \<and> snd (mems' ! k) ?x5 = snd (mems ! k) ?x5

goal (1 subgoal):
 1. \<And>P x. \<lbrakk>\<lbrakk>x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<or> x \<notin> dom_g1 \<or> x \<notin> dom_g2; fst (mems' ! k) x = mem\<^sub>1' x; snd (mems' ! k) x = mem\<^sub>2' x\<rbrakk> \<Longrightarrow> P x; \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2; fst (mems' ! k) x = fst (mems ! k) x; snd (mems' ! k) x = snd (mems ! k) x\<rbrakk> \<Longrightarrow> P x\<rbrakk> \<Longrightarrow> P x
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<lbrakk>?x5 \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<or> ?x5 \<notin> dom_g1 \<or> ?x5 \<notin> dom_g2; fst (mems' ! k) ?x5 = mem\<^sub>1' ?x5; snd (mems' ! k) ?x5 = mem\<^sub>2' ?x5\<rbrakk> \<Longrightarrow> ?P5 ?x5; \<lbrakk>?x5 \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; ?x5 \<in> dom_g1; ?x5 \<in> dom_g2; fst (mems' ! k) ?x5 = fst (mems ! k) ?x5; snd (mems' ! k) ?x5 = snd (mems ! k) ?x5\<rbrakk> \<Longrightarrow> ?P5 ?x5\<rbrakk> \<Longrightarrow> ?P5 ?x5

goal (1 subgoal):
 1. (\<And>mems'. makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') ?mems'12
[PROOF STEP]
have mems'_i_simp:
      "\<And> i. \<lbrakk> i < length cms\<^sub>1; i \<noteq> k \<rbrakk> \<Longrightarrow> mems' ! i = (fst \<circ> mems'_i i, snd \<circ> mems'_i i)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i. \<lbrakk>i \<sqsubset> length cms\<^sub>1; i \<noteq> k\<rbrakk> \<Longrightarrow> mems' ! i = (fst \<circ> mems'_i i, snd \<circ> mems'_i i)
[PROOF STEP]
unfolding mems'_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i. \<lbrakk>i \<sqsubset> length cms\<^sub>1; i \<noteq> k\<rbrakk> \<Longrightarrow> map (\<lambda>i. if i = k then (fst \<circ> mems'_k, snd \<circ> mems'_k) else (fst \<circ> mems'_i i, snd \<circ> mems'_i i)) [0..<length cms\<^sub>1] ! i = (fst \<circ> mems'_i i, snd \<circ> mems'_i i)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>?i5 \<sqsubset> length cms\<^sub>1; ?i5 \<noteq> k\<rbrakk> \<Longrightarrow> mems' ! ?i5 = (fst \<circ> mems'_i ?i5, snd \<circ> mems'_i ?i5)

goal (1 subgoal):
 1. (\<And>mems'. makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') ?mems'12
[PROOF STEP]
have mems'_i_1 [simp]:
      "\<And> i x. \<lbrakk> i \<noteq> k; i < length cms\<^sub>1;
                 mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x;
                 mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High \<rbrakk> \<Longrightarrow>
               fst (mems' ! i) x = mem\<^sub>1' x \<and> snd (mems' ! i) x = mem\<^sub>2' x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i x. \<lbrakk>i \<noteq> k; i \<sqsubset> length cms\<^sub>1; mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High\<rbrakk> \<Longrightarrow> fst (mems' ! i) x = mem\<^sub>1' x \<and> snd (mems' ! i) x = mem\<^sub>2' x
[PROOF STEP]
unfolding mems'_i_def mems'_i_simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i x. \<lbrakk>i \<noteq> k; i \<sqsubset> length cms\<^sub>1; mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High\<rbrakk> \<Longrightarrow> fst (fst \<circ> (\<lambda>x. if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> (mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High) then (mem\<^sub>1' x, mem\<^sub>2' x) else if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low then (some_val, some_val) else (fst (mems ! i) x, snd (mems ! i) x)), snd \<circ> (\<lambda>x. if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> (mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High) then (mem\<^sub>1' x, mem\<^sub>2' x) else if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low then (some_val, some_val) else (fst (mems ! i) x, snd (mems ! i) x))) x = mem\<^sub>1' x \<and> snd (fst \<circ> (\<lambda>x. if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> (mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High) then (mem\<^sub>1' x, mem\<^sub>2' x) else if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low then (some_val, some_val) else (fst (mems ! i) x, snd (mems ! i) x)), snd \<circ> (\<lambda>x. if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> (mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High) then (mem\<^sub>1' x, mem\<^sub>2' x) else if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low then (some_val, some_val) else (fst (mems ! i) x, snd (mems ! i) x))) x = mem\<^sub>2' x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>?i5 \<noteq> k; ?i5 \<sqsubset> length cms\<^sub>1; mem\<^sub>1 ?x5 \<noteq> mem\<^sub>1' ?x5 \<or> mem\<^sub>2 ?x5 \<noteq> mem\<^sub>2' ?x5; mem\<^sub>1' ?x5 = mem\<^sub>2' ?x5 \<or> dma ?x5 = High\<rbrakk> \<Longrightarrow> fst (mems' ! ?i5) ?x5 = mem\<^sub>1' ?x5 \<and> snd (mems' ! ?i5) ?x5 = mem\<^sub>2' ?x5

goal (1 subgoal):
 1. (\<And>mems'. makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') ?mems'12
[PROOF STEP]
have mems'_i_2 [simp]:
      "\<And> i x. \<lbrakk> i \<noteq> k; i < length cms\<^sub>1;
                 mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x;
                 mem\<^sub>1' x \<noteq> mem\<^sub>2' x; dma x = Low \<rbrakk> \<Longrightarrow>
              fst (mems' ! i) x = some_val \<and> snd (mems' ! i) x = some_val"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i x. \<lbrakk>i \<noteq> k; i \<sqsubset> length cms\<^sub>1; mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x; mem\<^sub>1' x \<noteq> mem\<^sub>2' x; dma x = Low\<rbrakk> \<Longrightarrow> fst (mems' ! i) x = some_val \<and> snd (mems' ! i) x = some_val
[PROOF STEP]
unfolding mems'_i_def mems'_i_simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i x. \<lbrakk>i \<noteq> k; i \<sqsubset> length cms\<^sub>1; mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x; mem\<^sub>1' x \<noteq> mem\<^sub>2' x; dma x = Low\<rbrakk> \<Longrightarrow> fst (fst \<circ> (\<lambda>x. if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> (mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High) then (mem\<^sub>1' x, mem\<^sub>2' x) else if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low then (some_val, some_val) else (fst (mems ! i) x, snd (mems ! i) x)), snd \<circ> (\<lambda>x. if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> (mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High) then (mem\<^sub>1' x, mem\<^sub>2' x) else if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low then (some_val, some_val) else (fst (mems ! i) x, snd (mems ! i) x))) x = some_val \<and> snd (fst \<circ> (\<lambda>x. if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> (mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High) then (mem\<^sub>1' x, mem\<^sub>2' x) else if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low then (some_val, some_val) else (fst (mems ! i) x, snd (mems ! i) x)), snd \<circ> (\<lambda>x. if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> (mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High) then (mem\<^sub>1' x, mem\<^sub>2' x) else if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low then (some_val, some_val) else (fst (mems ! i) x, snd (mems ! i) x))) x = some_val
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>?i5 \<noteq> k; ?i5 \<sqsubset> length cms\<^sub>1; mem\<^sub>1 ?x5 \<noteq> mem\<^sub>1' ?x5 \<or> mem\<^sub>2 ?x5 \<noteq> mem\<^sub>2' ?x5; mem\<^sub>1' ?x5 \<noteq> mem\<^sub>2' ?x5; dma ?x5 = Low\<rbrakk> \<Longrightarrow> fst (mems' ! ?i5) ?x5 = some_val \<and> snd (mems' ! ?i5) ?x5 = some_val

goal (1 subgoal):
 1. (\<And>mems'. makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') ?mems'12
[PROOF STEP]
have mems'_i_3 [simp]:
      "\<And> i x. \<lbrakk> i \<noteq> k; i < length cms\<^sub>1;
                 mem\<^sub>1 x = mem\<^sub>1' x; mem\<^sub>2 x = mem\<^sub>2' x \<rbrakk> \<Longrightarrow>
              fst (mems' ! i) x = fst (mems ! i) x \<and> snd (mems' ! i) x = snd (mems ! i) x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i x. \<lbrakk>i \<noteq> k; i \<sqsubset> length cms\<^sub>1; mem\<^sub>1 x = mem\<^sub>1' x; mem\<^sub>2 x = mem\<^sub>2' x\<rbrakk> \<Longrightarrow> fst (mems' ! i) x = fst (mems ! i) x \<and> snd (mems' ! i) x = snd (mems ! i) x
[PROOF STEP]
unfolding mems'_i_def mems'_i_simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i x. \<lbrakk>i \<noteq> k; i \<sqsubset> length cms\<^sub>1; mem\<^sub>1 x = mem\<^sub>1' x; mem\<^sub>2 x = mem\<^sub>2' x\<rbrakk> \<Longrightarrow> fst (fst \<circ> (\<lambda>x. if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> (mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High) then (mem\<^sub>1' x, mem\<^sub>2' x) else if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low then (some_val, some_val) else (fst (mems ! i) x, snd (mems ! i) x)), snd \<circ> (\<lambda>x. if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> (mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High) then (mem\<^sub>1' x, mem\<^sub>2' x) else if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low then (some_val, some_val) else (fst (mems ! i) x, snd (mems ! i) x))) x = fst (mems ! i) x \<and> snd (fst \<circ> (\<lambda>x. if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> (mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High) then (mem\<^sub>1' x, mem\<^sub>2' x) else if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low then (some_val, some_val) else (fst (mems ! i) x, snd (mems ! i) x)), snd \<circ> (\<lambda>x. if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> (mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High) then (mem\<^sub>1' x, mem\<^sub>2' x) else if (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<and> mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low then (some_val, some_val) else (fst (mems ! i) x, snd (mems ! i) x))) x = snd (mems ! i) x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>?i5 \<noteq> k; ?i5 \<sqsubset> length cms\<^sub>1; mem\<^sub>1 ?x5 = mem\<^sub>1' ?x5; mem\<^sub>2 ?x5 = mem\<^sub>2' ?x5\<rbrakk> \<Longrightarrow> fst (mems' ! ?i5) ?x5 = fst (mems ! ?i5) ?x5 \<and> snd (mems' ! ?i5) ?x5 = snd (mems ! ?i5) ?x5

goal (1 subgoal):
 1. (\<And>mems'. makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') ?mems'12
[PROOF STEP]
(* This may look complicated, but is actually a rather
       mechanical definition, as it merely spells out the cases
       of the definition: *)
[PROOF STATE]
proof (state)
this:
\<lbrakk>?i5 \<noteq> k; ?i5 \<sqsubset> length cms\<^sub>1; mem\<^sub>1 ?x5 = mem\<^sub>1' ?x5; mem\<^sub>2 ?x5 = mem\<^sub>2' ?x5\<rbrakk> \<Longrightarrow> fst (mems' ! ?i5) ?x5 = fst (mems ! ?i5) ?x5 \<and> snd (mems' ! ?i5) ?x5 = snd (mems ! ?i5) ?x5

goal (1 subgoal):
 1. (\<And>mems'. makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') ?mems'12
[PROOF STEP]
have mems'_i_cases:
      "\<And> P i x.
         \<lbrakk> i \<noteq> k; i < length cms\<^sub>1;
           \<lbrakk> mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x;
             mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High;
             fst (mems' ! i) x = mem\<^sub>1' x; snd (mems' ! i) x = mem\<^sub>2' x \<rbrakk> \<Longrightarrow> P x;
      \<lbrakk> mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x;
        mem\<^sub>1' x \<noteq>  mem\<^sub>2' x; dma x = Low;
        fst (mems' ! i) x = some_val; snd (mems' ! i) x = some_val \<rbrakk> \<Longrightarrow> P x;
      \<lbrakk> mem\<^sub>1 x = mem\<^sub>1' x; mem\<^sub>2 x = mem\<^sub>2' x;
        fst (mems' ! i) x = fst (mems ! i) x; snd (mems' ! i) x = snd (mems ! i) x \<rbrakk> \<Longrightarrow> P x \<rbrakk>
      \<Longrightarrow> P x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>P i x. \<lbrakk>i \<noteq> k; i \<sqsubset> length cms\<^sub>1; \<lbrakk>mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High; fst (mems' ! i) x = mem\<^sub>1' x; snd (mems' ! i) x = mem\<^sub>2' x\<rbrakk> \<Longrightarrow> P x; \<lbrakk>mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x; mem\<^sub>1' x \<noteq> mem\<^sub>2' x; dma x = Low; fst (mems' ! i) x = some_val; snd (mems' ! i) x = some_val\<rbrakk> \<Longrightarrow> P x; \<lbrakk>mem\<^sub>1 x = mem\<^sub>1' x; mem\<^sub>2 x = mem\<^sub>2' x; fst (mems' ! i) x = fst (mems ! i) x; snd (mems' ! i) x = snd (mems ! i) x\<rbrakk> \<Longrightarrow> P x\<rbrakk> \<Longrightarrow> P x
[PROOF STEP]
using mems'_i_1 mems'_i_2 mems'_i_3
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?i5 \<noteq> k; ?i5 \<sqsubset> length cms\<^sub>1; mem\<^sub>1 ?x5 \<noteq> mem\<^sub>1' ?x5 \<or> mem\<^sub>2 ?x5 \<noteq> mem\<^sub>2' ?x5; mem\<^sub>1' ?x5 = mem\<^sub>2' ?x5 \<or> dma ?x5 = High\<rbrakk> \<Longrightarrow> fst (mems' ! ?i5) ?x5 = mem\<^sub>1' ?x5 \<and> snd (mems' ! ?i5) ?x5 = mem\<^sub>2' ?x5
\<lbrakk>?i5 \<noteq> k; ?i5 \<sqsubset> length cms\<^sub>1; mem\<^sub>1 ?x5 \<noteq> mem\<^sub>1' ?x5 \<or> mem\<^sub>2 ?x5 \<noteq> mem\<^sub>2' ?x5; mem\<^sub>1' ?x5 \<noteq> mem\<^sub>2' ?x5; dma ?x5 = Low\<rbrakk> \<Longrightarrow> fst (mems' ! ?i5) ?x5 = some_val \<and> snd (mems' ! ?i5) ?x5 = some_val
\<lbrakk>?i5 \<noteq> k; ?i5 \<sqsubset> length cms\<^sub>1; mem\<^sub>1 ?x5 = mem\<^sub>1' ?x5; mem\<^sub>2 ?x5 = mem\<^sub>2' ?x5\<rbrakk> \<Longrightarrow> fst (mems' ! ?i5) ?x5 = fst (mems ! ?i5) ?x5 \<and> snd (mems' ! ?i5) ?x5 = snd (mems ! ?i5) ?x5

goal (1 subgoal):
 1. \<And>P i x. \<lbrakk>i \<noteq> k; i \<sqsubset> length cms\<^sub>1; \<lbrakk>mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High; fst (mems' ! i) x = mem\<^sub>1' x; snd (mems' ! i) x = mem\<^sub>2' x\<rbrakk> \<Longrightarrow> P x; \<lbrakk>mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x; mem\<^sub>1' x \<noteq> mem\<^sub>2' x; dma x = Low; fst (mems' ! i) x = some_val; snd (mems' ! i) x = some_val\<rbrakk> \<Longrightarrow> P x; \<lbrakk>mem\<^sub>1 x = mem\<^sub>1' x; mem\<^sub>2 x = mem\<^sub>2' x; fst (mems' ! i) x = fst (mems ! i) x; snd (mems' ! i) x = snd (mems ! i) x\<rbrakk> \<Longrightarrow> P x\<rbrakk> \<Longrightarrow> P x
[PROOF STEP]
by (metis (full_types) Sec.exhaust)
[PROOF STATE]
proof (state)
this:
\<lbrakk>?i5 \<noteq> k; ?i5 \<sqsubset> length cms\<^sub>1; \<lbrakk>mem\<^sub>1 ?x5 \<noteq> mem\<^sub>1' ?x5 \<or> mem\<^sub>2 ?x5 \<noteq> mem\<^sub>2' ?x5; mem\<^sub>1' ?x5 = mem\<^sub>2' ?x5 \<or> dma ?x5 = High; fst (mems' ! ?i5) ?x5 = mem\<^sub>1' ?x5; snd (mems' ! ?i5) ?x5 = mem\<^sub>2' ?x5\<rbrakk> \<Longrightarrow> ?P5 ?x5; \<lbrakk>mem\<^sub>1 ?x5 \<noteq> mem\<^sub>1' ?x5 \<or> mem\<^sub>2 ?x5 \<noteq> mem\<^sub>2' ?x5; mem\<^sub>1' ?x5 \<noteq> mem\<^sub>2' ?x5; dma ?x5 = Low; fst (mems' ! ?i5) ?x5 = some_val; snd (mems' ! ?i5) ?x5 = some_val\<rbrakk> \<Longrightarrow> ?P5 ?x5; \<lbrakk>mem\<^sub>1 ?x5 = mem\<^sub>1' ?x5; mem\<^sub>2 ?x5 = mem\<^sub>2' ?x5; fst (mems' ! ?i5) ?x5 = fst (mems ! ?i5) ?x5; snd (mems' ! ?i5) ?x5 = snd (mems ! ?i5) ?x5\<rbrakk> \<Longrightarrow> ?P5 ?x5\<rbrakk> \<Longrightarrow> ?P5 ?x5

goal (1 subgoal):
 1. (\<And>mems'. makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') ?mems'12
[PROOF STEP]
let ?X' = "\<lambda> i. differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<And>mems'. makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') ?mems'12
[PROOF STEP]
show "makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems'
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. length cms\<^sub>1' = length cms\<^sub>2' \<and> length cms\<^sub>1' = length mems'
 2. \<And>i \<sigma>. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; dom \<sigma> = differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i\<rbrakk> \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
 3. \<And>i x. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 4. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
have "length cms\<^sub>1' = length cms\<^sub>1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length cms\<^sub>1' = length cms\<^sub>1
[PROOF STEP]
by (metis cms\<^sub>2'_def equal_size length_list_update new_length)
[PROOF STATE]
proof (state)
this:
length cms\<^sub>1' = length cms\<^sub>1

goal (4 subgoals):
 1. length cms\<^sub>1' = length cms\<^sub>2' \<and> length cms\<^sub>1' = length mems'
 2. \<And>i \<sigma>. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; dom \<sigma> = differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i\<rbrakk> \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
 3. \<And>i x. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 4. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
length cms\<^sub>1' = length cms\<^sub>1
[PROOF STEP]
show "length cms\<^sub>1' = length cms\<^sub>2' \<and> length cms\<^sub>1' = length mems'"
[PROOF STATE]
proof (prove)
using this:
length cms\<^sub>1' = length cms\<^sub>1

goal (1 subgoal):
 1. length cms\<^sub>1' = length cms\<^sub>2' \<and> length cms\<^sub>1' = length mems'
[PROOF STEP]
using compat new_length
[PROOF STATE]
proof (prove)
using this:
length cms\<^sub>1' = length cms\<^sub>1
makes_compatible (cms\<^sub>1, mem\<^sub>1) (cms\<^sub>2, mem\<^sub>2) mems
length cms\<^sub>1' = length cms\<^sub>2'

goal (1 subgoal):
 1. length cms\<^sub>1' = length cms\<^sub>2' \<and> length cms\<^sub>1' = length mems'
[PROOF STEP]
unfolding mems'_def
[PROOF STATE]
proof (prove)
using this:
length cms\<^sub>1' = length cms\<^sub>1
makes_compatible (cms\<^sub>1, mem\<^sub>1) (cms\<^sub>2, mem\<^sub>2) mems
length cms\<^sub>1' = length cms\<^sub>2'

goal (1 subgoal):
 1. length cms\<^sub>1' = length cms\<^sub>2' \<and> length cms\<^sub>1' = length (map (\<lambda>i. if i = k then (fst \<circ> mems'_k, snd \<circ> mems'_k) else (fst \<circ> mems'_i i, snd \<circ> mems'_i i)) [0..<length cms\<^sub>1])
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
length cms\<^sub>1' = length cms\<^sub>2' \<and> length cms\<^sub>1' = length mems'

goal (3 subgoals):
 1. \<And>i \<sigma>. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; dom \<sigma> = differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i\<rbrakk> \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
 2. \<And>i x. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 3. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>i \<sigma>. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; dom \<sigma> = differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i\<rbrakk> \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
 2. \<And>i x. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 3. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
fix i
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>i \<sigma>. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; dom \<sigma> = differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i\<rbrakk> \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
 2. \<And>i x. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 3. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
fix \<sigma> :: "'Var \<rightharpoonup> 'Val"
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>i \<sigma>. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; dom \<sigma> = differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i\<rbrakk> \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
 2. \<And>i x. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 3. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
let ?mems\<^sub>1'i = "fst (mems' ! i)"
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>i \<sigma>. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; dom \<sigma> = differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i\<rbrakk> \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
 2. \<And>i x. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 3. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
let ?mems\<^sub>2'i = "snd (mems' ! i)"
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>i \<sigma>. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; dom \<sigma> = differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i\<rbrakk> \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
 2. \<And>i x. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 3. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
assume i_le: "i < length cms\<^sub>1'"
[PROOF STATE]
proof (state)
this:
i \<sqsubset> length cms\<^sub>1'

goal (3 subgoals):
 1. \<And>i \<sigma>. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; dom \<sigma> = differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i\<rbrakk> \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
 2. \<And>i x. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 3. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
assume dom\<sigma>: "dom \<sigma> = ?X' i"
[PROOF STATE]
proof (state)
this:
dom \<sigma> = differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (3 subgoals):
 1. \<And>i \<sigma>. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; dom \<sigma> = differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i\<rbrakk> \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
 2. \<And>i x. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 3. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
show "(cms\<^sub>1' ! i, (fst (mems' ! i)) [\<mapsto> \<sigma>]) \<approx> (cms\<^sub>2' ! i, (snd (mems' ! i)) [\<mapsto> \<sigma>])"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
proof (cases "i = k")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. i = k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
 2. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
assume [simp]: "i = k"
        \<comment> \<open>We define another  function from this and reuse the universally quantified statements
          from the first part of the proof.\<close>
[PROOF STATE]
proof (state)
this:
i = k

goal (2 subgoals):
 1. i = k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
 2. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
define \<sigma>'
          where "\<sigma>' x =
              (if x \<in> ?X k
                then if x \<in> ?X' k
                     then \<sigma> x
                     else if (x \<in> dom (g1 h))
                             then Some (?mems\<^sub>1'i x)
                             else if (x \<in> dom (g2 h))
                                  then Some (?mems\<^sub>2'i x)
                                  else Some some_val
                else None)" for x
[PROOF STATE]
proof (state)
this:
\<sigma>' ?x = (if ?x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then if ?x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k then \<sigma> ?x else if ?x \<in> dom (g1 h) then Some (fst (mems' ! i) ?x) else if ?x \<in> dom (g2 h) then Some (snd (mems' ! i) ?x) else Some some_val else None)

goal (2 subgoals):
 1. i = k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
 2. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<sigma>' ?x = (if ?x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then if ?x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k then \<sigma> ?x else if ?x \<in> dom (g1 h) then Some (fst (mems' ! i) ?x) else if ?x \<in> dom (g2 h) then Some (snd (mems' ! i) ?x) else Some some_val else None)
[PROOF STEP]
have dom\<sigma>': "dom \<sigma>' = ?X k"
[PROOF STATE]
proof (prove)
using this:
\<sigma>' ?x = (if ?x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then if ?x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k then \<sigma> ?x else if ?x \<in> dom (g1 h) then Some (fst (mems' ! i) ?x) else if ?x \<in> dom (g2 h) then Some (snd (mems' ! i) ?x) else Some some_val else None)

goal (1 subgoal):
 1. dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
[PROOF STEP]
by (auto, metis domI domIff, metis \<open>i = k\<close> domD dom\<sigma>)
[PROOF STATE]
proof (state)
this:
dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (2 subgoals):
 1. i = k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
 2. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
have diff_vars_impl [simp]: "\<And>x. x \<in> ?X' k \<Longrightarrow> x \<in> ?X k"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
[PROOF STEP]
proof (rule ccontr)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k; x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k; x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume "x \<notin> ?X k"
[PROOF STATE]
proof (state)
this:
x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k; x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
hence "mem\<^sub>1 x = ?mems\<^sub>1k x \<and> mem\<^sub>2 x = ?mems\<^sub>2k x"
[PROOF STATE]
proof (prove)
using this:
x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (1 subgoal):
 1. mem\<^sub>1 x = fst (mems ! k) x \<and> mem\<^sub>2 x = snd (mems ! k) x
[PROOF STEP]
by (metis differing_vars_neg)
[PROOF STATE]
proof (state)
this:
mem\<^sub>1 x = fst (mems ! k) x \<and> mem\<^sub>2 x = snd (mems ! k) x

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k; x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
from \<open>x \<notin> ?X k\<close>
[PROOF STATE]
proof (chain)
picking this:
x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
[PROOF STEP]
have "?mems\<^sub>1'i x = mem\<^sub>1' x \<and> ?mems\<^sub>2'i x = mem\<^sub>2' x"
[PROOF STATE]
proof (prove)
using this:
x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (1 subgoal):
 1. fst (mems' ! i) x = mem\<^sub>1' x \<and> snd (mems' ! i) x = mem\<^sub>2' x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fst (mems' ! i) x = mem\<^sub>1' x \<and> snd (mems' ! i) x = mem\<^sub>2' x

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k; x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
fst (mems' ! i) x = mem\<^sub>1' x \<and> snd (mems' ! i) x = mem\<^sub>2' x

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k; x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume "x \<in> ?X' k"
[PROOF STATE]
proof (state)
this:
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k; x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
hence "mem\<^sub>1' x \<noteq> ?mems\<^sub>1'i x \<or> mem\<^sub>2' x \<noteq> ?mems\<^sub>2'i x"
[PROOF STATE]
proof (prove)
using this:
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k

goal (1 subgoal):
 1. mem\<^sub>1' x \<noteq> fst (mems' ! i) x \<or> mem\<^sub>2' x \<noteq> snd (mems' ! i) x
[PROOF STEP]
by (metis \<open>i = k\<close> differing_vars_elim)
[PROOF STATE]
proof (state)
this:
mem\<^sub>1' x \<noteq> fst (mems' ! i) x \<or> mem\<^sub>2' x \<noteq> snd (mems' ! i) x

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k; x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
fst (mems' ! i) x = mem\<^sub>1' x \<and> snd (mems' ! i) x = mem\<^sub>2' x
mem\<^sub>1' x \<noteq> fst (mems' ! i) x \<or> mem\<^sub>2' x \<noteq> snd (mems' ! i) x
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
fst (mems' ! i) x = mem\<^sub>1' x \<and> snd (mems' ! i) x = mem\<^sub>2' x
mem\<^sub>1' x \<noteq> fst (mems' ! i) x \<or> mem\<^sub>2' x \<noteq> snd (mems' ! i) x

goal (1 subgoal):
 1. False
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?x5 \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> ?x5 \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (2 subgoals):
 1. i = k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
 2. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
have differing_in_dom: "\<And>x. \<lbrakk> x \<in> ?X k; x \<in> ?X' k \<rbrakk> \<Longrightarrow> x \<in> dom_g1 \<and> x \<in> dom_g2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k\<rbrakk> \<Longrightarrow> x \<in> dom_g1 \<and> x \<in> dom_g2
[PROOF STEP]
proof (rule ccontr)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k; \<not> (x \<in> dom_g1 \<and> x \<in> dom_g2)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k; \<not> (x \<in> dom_g1 \<and> x \<in> dom_g2)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume "x \<in> ?X k"
[PROOF STATE]
proof (state)
this:
x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k; \<not> (x \<in> dom_g1 \<and> x \<in> dom_g2)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume "\<not> (x \<in> dom_g1 \<and> x \<in> dom_g2)"
[PROOF STATE]
proof (state)
this:
\<not> (x \<in> dom_g1 \<and> x \<in> dom_g2)

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k; \<not> (x \<in> dom_g1 \<and> x \<in> dom_g2)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
hence not_in_dom: "x \<notin> dom_g1 \<or> x \<notin> dom_g2"
[PROOF STATE]
proof (prove)
using this:
\<not> (x \<in> dom_g1 \<and> x \<in> dom_g2)

goal (1 subgoal):
 1. x \<notin> dom_g1 \<or> x \<notin> dom_g2
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
x \<notin> dom_g1 \<or> x \<notin> dom_g2

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k; \<not> (x \<in> dom_g1 \<and> x \<in> dom_g2)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
hence "?mems\<^sub>1'i x = mem\<^sub>1' x" "?mems\<^sub>2'i x = mem\<^sub>2' x"
[PROOF STATE]
proof (prove)
using this:
x \<notin> dom_g1 \<or> x \<notin> dom_g2

goal (1 subgoal):
 1. fst (mems' ! i) x = mem\<^sub>1' x &&& snd (mems' ! i) x = mem\<^sub>2' x
[PROOF STEP]
using \<open>i = k\<close> \<open>x \<in> ?X k\<close> mems'_k_2
[PROOF STATE]
proof (prove)
using this:
x \<notin> dom_g1 \<or> x \<notin> dom_g2
i = k
x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
\<lbrakk>?x5 \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; ?x5 \<notin> dom_g1 \<or> ?x5 \<notin> dom_g2\<rbrakk> \<Longrightarrow> fst (mems' ! k) ?x5 = mem\<^sub>1' ?x5 \<and> snd (mems' ! k) ?x5 = mem\<^sub>2' ?x5

goal (1 subgoal):
 1. fst (mems' ! i) x = mem\<^sub>1' x &&& snd (mems' ! i) x = mem\<^sub>2' x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fst (mems' ! i) x = mem\<^sub>1' x
snd (mems' ! i) x = mem\<^sub>2' x

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k; \<not> (x \<in> dom_g1 \<and> x \<in> dom_g2)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
fst (mems' ! i) x = mem\<^sub>1' x
snd (mems' ! i) x = mem\<^sub>2' x

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k; \<not> (x \<in> dom_g1 \<and> x \<in> dom_g2)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume "x \<in> ?X' k"
[PROOF STATE]
proof (state)
this:
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k; \<not> (x \<in> dom_g1 \<and> x \<in> dom_g2)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
fst (mems' ! i) x = mem\<^sub>1' x
snd (mems' ! i) x = mem\<^sub>2' x
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
fst (mems' ! i) x = mem\<^sub>1' x
snd (mems' ! i) x = mem\<^sub>2' x
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k

goal (1 subgoal):
 1. False
[PROOF STEP]
by (metis \<open>i = k\<close> differing_vars_elim)
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>?x5 \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; ?x5 \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k\<rbrakk> \<Longrightarrow> ?x5 \<in> dom_g1 \<and> ?x5 \<in> dom_g2

goal (2 subgoals):
 1. i = k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
 2. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
(* We now show that we can reuse the earlier statements
           by showing the following equality: *)
[PROOF STATE]
proof (state)
this:
\<lbrakk>?x5 \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; ?x5 \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k\<rbrakk> \<Longrightarrow> ?x5 \<in> dom_g1 \<and> ?x5 \<in> dom_g2

goal (2 subgoals):
 1. i = k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
 2. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
have "?mems\<^sub>1'i [\<mapsto> \<sigma>] = mem\<^sub>1' [\<mapsto> g1 \<sigma>']"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. subst \<sigma> (fst (mems' ! i)) = subst (g1 \<sigma>') mem\<^sub>1'
[PROOF STEP]
proof (rule ext)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
show "?mems\<^sub>1'i [\<mapsto> \<sigma>] x = mem\<^sub>1' [\<mapsto> g1 \<sigma>'] x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
proof (cases "x \<in> ?X' k")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
assume x_in_X'k: "x \<in> ?X' k"
[PROOF STATE]
proof (state)
this:
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k
[PROOF STEP]
obtain v where "\<sigma> x = Some v"
[PROOF STATE]
proof (prove)
using this:
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k

goal (1 subgoal):
 1. (\<And>v. \<sigma> x = Some v \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis dom\<sigma> domD \<open>i = k\<close>)
[PROOF STATE]
proof (state)
this:
\<sigma> x = Some v

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
hence "?mems\<^sub>1'i [\<mapsto> \<sigma>] x = v"
[PROOF STATE]
proof (prove)
using this:
\<sigma> x = Some v

goal (1 subgoal):
 1. subst \<sigma> (fst (mems' ! i)) x = v
[PROOF STEP]
using \<open>x \<in> ?X' k\<close> dom\<sigma>
[PROOF STATE]
proof (prove)
using this:
\<sigma> x = Some v
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k
dom \<sigma> = differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. subst \<sigma> (fst (mems' ! i)) x = v
[PROOF STEP]
by (auto simp: subst_def)
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) x = v

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) x = v

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
from c
[PROOF STATE]
proof (chain)
picking this:
change_respecting (cms\<^sub>1 ! k, mem\<^sub>1) (cms\<^sub>1' ! k, mem\<^sub>1') (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g1
[PROOF STEP]
have le: "g1 \<sigma>' \<preceq> \<sigma>'"
[PROOF STATE]
proof (prove)
using this:
change_respecting (cms\<^sub>1 ! k, mem\<^sub>1) (cms\<^sub>1' ! k, mem\<^sub>1') (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g1

goal (1 subgoal):
 1. g1 \<sigma>' \<preceq> \<sigma>'
[PROOF STEP]
using dom\<sigma>'
[PROOF STATE]
proof (prove)
using this:
change_respecting (cms\<^sub>1 ! k, mem\<^sub>1) (cms\<^sub>1' ! k, mem\<^sub>1') (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g1
dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (1 subgoal):
 1. g1 \<sigma>' \<preceq> \<sigma>'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
g1 \<sigma>' \<preceq> \<sigma>'

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
from dom\<sigma>' and \<open>x \<in> ?X' k\<close>
[PROOF STATE]
proof (chain)
picking this:
dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k
[PROOF STEP]
have "x \<in> dom (g1 \<sigma>')"
[PROOF STATE]
proof (prove)
using this:
dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k

goal (1 subgoal):
 1. x \<in> dom (g1 \<sigma>')
[PROOF STEP]
by (metis diff_vars_impl differing_in_dom dom_uniq(1))
[PROOF STATE]
proof (state)
this:
x \<in> dom (g1 \<sigma>')

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
hence "mem\<^sub>1' [\<mapsto> g1 \<sigma>'] x = v"
[PROOF STATE]
proof (prove)
using this:
x \<in> dom (g1 \<sigma>')

goal (1 subgoal):
 1. subst (g1 \<sigma>') mem\<^sub>1' x = v
[PROOF STEP]
using dom\<sigma>' c le
[PROOF STATE]
proof (prove)
using this:
x \<in> dom (g1 \<sigma>')
dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
change_respecting (cms\<^sub>1 ! k, mem\<^sub>1) (cms\<^sub>1' ! k, mem\<^sub>1') (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g1
g1 \<sigma>' \<preceq> \<sigma>'

goal (1 subgoal):
 1. subst (g1 \<sigma>') mem\<^sub>1' x = v
[PROOF STEP]
unfolding func_le_def subst_def
[PROOF STATE]
proof (prove)
using this:
x \<in> dom (g1 \<sigma>')
dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
change_respecting (cms\<^sub>1 ! k, mem\<^sub>1) (cms\<^sub>1' ! k, mem\<^sub>1') (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g1
\<forall>x\<in>dom (g1 \<sigma>'). g1 \<sigma>' x = \<sigma>' x

goal (1 subgoal):
 1. (case g1 \<sigma>' x of None \<Rightarrow> mem\<^sub>1' x | Some v \<Rightarrow> v) = v
[PROOF STEP]
by (metis \<sigma>'_def \<open>\<sigma> x = Some v\<close> diff_vars_impl option.simps(5) x_in_X'k)
[PROOF STATE]
proof (state)
this:
subst (g1 \<sigma>') mem\<^sub>1' x = v

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
subst \<sigma> (fst (mems' ! i)) x = v
subst (g1 \<sigma>') mem\<^sub>1' x = v
[PROOF STEP]
show "?mems\<^sub>1'i [\<mapsto> \<sigma>] x = mem\<^sub>1' [\<mapsto> g1 \<sigma>'] x"
[PROOF STATE]
proof (prove)
using this:
subst \<sigma> (fst (mems' ! i)) x = v
subst (g1 \<sigma>') mem\<^sub>1' x = v

goal (1 subgoal):
 1. subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
assume "x \<notin> ?X' k"
[PROOF STATE]
proof (state)
this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
hence "?mems\<^sub>1'i [\<mapsto> \<sigma>] x = ?mems\<^sub>1'i x"
[PROOF STATE]
proof (prove)
using this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k

goal (1 subgoal):
 1. subst \<sigma> (fst (mems' ! i)) x = fst (mems' ! i) x
[PROOF STEP]
using dom\<sigma>
[PROOF STATE]
proof (prove)
using this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k
dom \<sigma> = differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. subst \<sigma> (fst (mems' ! i)) x = fst (mems' ! i) x
[PROOF STEP]
by (metis \<open>i = k\<close> subst_not_in_dom)
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) x = fst (mems' ! i) x

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
proof (cases "x \<in> dom_g1")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x \<in> dom_g1 \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
 2. x \<notin> dom_g1 \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
assume "x \<in> dom_g1"
[PROOF STATE]
proof (state)
this:
x \<in> dom_g1

goal (2 subgoals):
 1. x \<in> dom_g1 \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
 2. x \<notin> dom_g1 \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
hence "x \<in> dom (g1 \<sigma>')"
[PROOF STATE]
proof (prove)
using this:
x \<in> dom_g1

goal (1 subgoal):
 1. x \<in> dom (g1 \<sigma>')
[PROOF STEP]
using dom\<sigma>' dom_uniq
[PROOF STATE]
proof (prove)
using this:
x \<in> dom_g1
dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> dom_g1 = dom (g1 ?\<sigma>5)
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> dom_g2 = dom (g2 ?\<sigma>5)

goal (1 subgoal):
 1. x \<in> dom (g1 \<sigma>')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
x \<in> dom (g1 \<sigma>')

goal (2 subgoals):
 1. x \<in> dom_g1 \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
 2. x \<notin> dom_g1 \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
hence "g1 \<sigma>' x = \<sigma>' x"
[PROOF STATE]
proof (prove)
using this:
x \<in> dom (g1 \<sigma>')

goal (1 subgoal):
 1. g1 \<sigma>' x = \<sigma>' x
[PROOF STEP]
using c dom\<sigma>'
[PROOF STATE]
proof (prove)
using this:
x \<in> dom (g1 \<sigma>')
change_respecting (cms\<^sub>1 ! k, mem\<^sub>1) (cms\<^sub>1' ! k, mem\<^sub>1') (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g1
dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (1 subgoal):
 1. g1 \<sigma>' x = \<sigma>' x
[PROOF STEP]
by (metis change_respecting.simps func_le_def)
[PROOF STATE]
proof (state)
this:
g1 \<sigma>' x = \<sigma>' x

goal (2 subgoals):
 1. x \<in> dom_g1 \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
 2. x \<notin> dom_g1 \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
g1 \<sigma>' x = \<sigma>' x
[PROOF STEP]
have "\<sigma>' x = Some (?mems\<^sub>1'i x)"
[PROOF STATE]
proof (prove)
using this:
g1 \<sigma>' x = \<sigma>' x

goal (1 subgoal):
 1. \<sigma>' x = Some (fst (mems' ! i) x)
[PROOF STEP]
unfolding \<sigma>'_def
[PROOF STATE]
proof (prove)
using this:
g1 (\<lambda>x. if x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then if x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k then \<sigma> x else if x \<in> dom (g1 h) then Some (fst (mems' ! i) x) else if x \<in> dom (g2 h) then Some (snd (mems' ! i) x) else Some some_val else None) x = (if x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then if x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k then \<sigma> x else if x \<in> dom (g1 h) then Some (fst (mems' ! i) x) else if x \<in> dom (g2 h) then Some (snd (mems' ! i) x) else Some some_val else None)

goal (1 subgoal):
 1. (if x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then if x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k then \<sigma> x else if x \<in> dom (g1 h) then Some (fst (mems' ! i) x) else if x \<in> dom (g2 h) then Some (snd (mems' ! i) x) else Some some_val else None) = Some (fst (mems' ! i) x)
[PROOF STEP]
using dom\<sigma>' domh
[PROOF STATE]
proof (prove)
using this:
g1 (\<lambda>x. if x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then if x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k then \<sigma> x else if x \<in> dom (g1 h) then Some (fst (mems' ! i) x) else if x \<in> dom (g2 h) then Some (snd (mems' ! i) x) else Some some_val else None) x = (if x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then if x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k then \<sigma> x else if x \<in> dom (g1 h) then Some (fst (mems' ! i) x) else if x \<in> dom (g2 h) then Some (snd (mems' ! i) x) else Some some_val else None)
dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
dom h = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (1 subgoal):
 1. (if x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then if x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k then \<sigma> x else if x \<in> dom (g1 h) then Some (fst (mems' ! i) x) else if x \<in> dom (g2 h) then Some (snd (mems' ! i) x) else Some some_val else None) = Some (fst (mems' ! i) x)
[PROOF STEP]
by (metis \<open>g1 \<sigma>' x = \<sigma>' x\<close> \<open>x \<in> dom (g1 \<sigma>')\<close> \<open>x \<notin> ?X' k\<close> domIff dom_uniq(1))
[PROOF STATE]
proof (state)
this:
\<sigma>' x = Some (fst (mems' ! i) x)

goal (2 subgoals):
 1. x \<in> dom_g1 \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
 2. x \<notin> dom_g1 \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
hence "mem\<^sub>1' [\<mapsto> g1 \<sigma>'] x = ?mems\<^sub>1'i x"
[PROOF STATE]
proof (prove)
using this:
\<sigma>' x = Some (fst (mems' ! i) x)

goal (1 subgoal):
 1. subst (g1 \<sigma>') mem\<^sub>1' x = fst (mems' ! i) x
[PROOF STEP]
unfolding subst_def
[PROOF STATE]
proof (prove)
using this:
\<sigma>' x = Some (fst (mems' ! i) x)

goal (1 subgoal):
 1. (case g1 \<sigma>' x of None \<Rightarrow> mem\<^sub>1' x | Some v \<Rightarrow> v) = fst (mems' ! i) x
[PROOF STEP]
by (metis \<open>g1 \<sigma>' x = \<sigma>' x\<close> option.simps(5))
[PROOF STATE]
proof (state)
this:
subst (g1 \<sigma>') mem\<^sub>1' x = fst (mems' ! i) x

goal (2 subgoals):
 1. x \<in> dom_g1 \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
 2. x \<notin> dom_g1 \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
subst (g1 \<sigma>') mem\<^sub>1' x = fst (mems' ! i) x

goal (1 subgoal):
 1. subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
by (metis \<open>?mems\<^sub>1'i [\<mapsto>\<sigma>] x = ?mems\<^sub>1'i x\<close>)
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x

goal (1 subgoal):
 1. x \<notin> dom_g1 \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. x \<notin> dom_g1 \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
assume "x \<notin> dom_g1"
[PROOF STATE]
proof (state)
this:
x \<notin> dom_g1

goal (1 subgoal):
 1. x \<notin> dom_g1 \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
x \<notin> dom_g1
[PROOF STEP]
have "mem\<^sub>1' [\<mapsto> g1 \<sigma>'] x = mem\<^sub>1' x"
[PROOF STATE]
proof (prove)
using this:
x \<notin> dom_g1

goal (1 subgoal):
 1. subst (g1 \<sigma>') mem\<^sub>1' x = mem\<^sub>1' x
[PROOF STEP]
by (metis dom\<sigma>' dom_uniq(1) subst_not_in_dom)
[PROOF STATE]
proof (state)
this:
subst (g1 \<sigma>') mem\<^sub>1' x = mem\<^sub>1' x

goal (1 subgoal):
 1. x \<notin> dom_g1 \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
subst (g1 \<sigma>') mem\<^sub>1' x = mem\<^sub>1' x

goal (1 subgoal):
 1. x \<notin> dom_g1 \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
have "?mems\<^sub>1'i x = mem\<^sub>1' x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fst (mems' ! i) x = mem\<^sub>1' x
[PROOF STEP]
by (metis \<open>i = k\<close> \<open>x \<notin> ?X' k\<close> differing_vars_neg)
[PROOF STATE]
proof (state)
this:
fst (mems' ! i) x = mem\<^sub>1' x

goal (1 subgoal):
 1. x \<notin> dom_g1 \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
subst (g1 \<sigma>') mem\<^sub>1' x = mem\<^sub>1' x
fst (mems' ! i) x = mem\<^sub>1' x
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
subst (g1 \<sigma>') mem\<^sub>1' x = mem\<^sub>1' x
fst (mems' ! i) x = mem\<^sub>1' x

goal (1 subgoal):
 1. subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x
[PROOF STEP]
by (metis \<open>?mems\<^sub>1'i [\<mapsto>\<sigma>] x = ?mems\<^sub>1'i x\<close>)
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) x = subst (g1 \<sigma>') mem\<^sub>1' x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) = subst (g1 \<sigma>') mem\<^sub>1'

goal (2 subgoals):
 1. i = k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
 2. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
(* And the same for the second memories: *)
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) = subst (g1 \<sigma>') mem\<^sub>1'

goal (2 subgoals):
 1. i = k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
 2. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) = subst (g1 \<sigma>') mem\<^sub>1'

goal (2 subgoals):
 1. i = k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
 2. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
have "?mems\<^sub>2'i [\<mapsto> \<sigma>] = mem\<^sub>h [\<mapsto> g2 \<sigma>']"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. subst \<sigma> (snd (mems' ! i)) = subst (g2 \<sigma>') mem\<^sub>h
[PROOF STEP]
proof (rule ext)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
show "?mems\<^sub>2'i [\<mapsto> \<sigma>] x = mem\<^sub>h [\<mapsto> g2 \<sigma>'] x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
proof (cases "x \<in> ?X' k")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
assume "x \<in> ?X' k"
[PROOF STATE]
proof (state)
this:
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k
[PROOF STEP]
obtain v where "\<sigma> x = Some v"
[PROOF STATE]
proof (prove)
using this:
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k

goal (1 subgoal):
 1. (\<And>v. \<sigma> x = Some v \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using dom\<sigma>
[PROOF STATE]
proof (prove)
using this:
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k
dom \<sigma> = differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. (\<And>v. \<sigma> x = Some v \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis domD \<open>i = k\<close>)
[PROOF STATE]
proof (state)
this:
\<sigma> x = Some v

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
hence "?mems\<^sub>2'i [\<mapsto> \<sigma>] x = v"
[PROOF STATE]
proof (prove)
using this:
\<sigma> x = Some v

goal (1 subgoal):
 1. subst \<sigma> (snd (mems' ! i)) x = v
[PROOF STEP]
using \<open>x \<in> ?X' k\<close> dom\<sigma>
[PROOF STATE]
proof (prove)
using this:
\<sigma> x = Some v
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k
dom \<sigma> = differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. subst \<sigma> (snd (mems' ! i)) x = v
[PROOF STEP]
unfolding subst_def
[PROOF STATE]
proof (prove)
using this:
\<sigma> x = Some v
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k
dom \<sigma> = differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. (case \<sigma> x of None \<Rightarrow> snd (mems' ! i) x | Some v \<Rightarrow> v) = v
[PROOF STEP]
by (metis option.simps(5))
[PROOF STATE]
proof (state)
this:
subst \<sigma> (snd (mems' ! i)) x = v

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
subst \<sigma> (snd (mems' ! i)) x = v

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
from e
[PROOF STATE]
proof (chain)
picking this:
change_respecting (cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g2
[PROOF STEP]
have le: "g2 \<sigma>' \<preceq> \<sigma>'"
[PROOF STATE]
proof (prove)
using this:
change_respecting (cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g2

goal (1 subgoal):
 1. g2 \<sigma>' \<preceq> \<sigma>'
[PROOF STEP]
using dom\<sigma>'
[PROOF STATE]
proof (prove)
using this:
change_respecting (cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g2
dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (1 subgoal):
 1. g2 \<sigma>' \<preceq> \<sigma>'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
g2 \<sigma>' \<preceq> \<sigma>'

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
from \<open>x \<in> ?X' k\<close>
[PROOF STATE]
proof (chain)
picking this:
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k
[PROOF STEP]
have "x \<in> ?X k"
[PROOF STATE]
proof (prove)
using this:
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k

goal (1 subgoal):
 1. x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
hence "x \<in> dom (g2 \<sigma>')"
[PROOF STATE]
proof (prove)
using this:
x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (1 subgoal):
 1. x \<in> dom (g2 \<sigma>')
[PROOF STEP]
by (metis differing_in_dom dom\<sigma>' dom_uniq(2) \<open>x \<in> ?X' k\<close>)
[PROOF STATE]
proof (state)
this:
x \<in> dom (g2 \<sigma>')

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
hence "mem\<^sub>2' [\<mapsto> g2 \<sigma>'] x = v"
[PROOF STATE]
proof (prove)
using this:
x \<in> dom (g2 \<sigma>')

goal (1 subgoal):
 1. subst (g2 \<sigma>') mem\<^sub>2' x = v
[PROOF STEP]
using dom\<sigma>' c le
[PROOF STATE]
proof (prove)
using this:
x \<in> dom (g2 \<sigma>')
dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
change_respecting (cms\<^sub>1 ! k, mem\<^sub>1) (cms\<^sub>1' ! k, mem\<^sub>1') (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g1
g2 \<sigma>' \<preceq> \<sigma>'

goal (1 subgoal):
 1. subst (g2 \<sigma>') mem\<^sub>2' x = v
[PROOF STEP]
unfolding func_le_def subst_def
[PROOF STATE]
proof (prove)
using this:
x \<in> dom (g2 \<sigma>')
dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
change_respecting (cms\<^sub>1 ! k, mem\<^sub>1) (cms\<^sub>1' ! k, mem\<^sub>1') (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g1
\<forall>x\<in>dom (g2 \<sigma>'). g2 \<sigma>' x = \<sigma>' x

goal (1 subgoal):
 1. (case g2 \<sigma>' x of None \<Rightarrow> mem\<^sub>2' x | Some v \<Rightarrow> v) = v
[PROOF STEP]
by (metis \<sigma>'_def \<open>\<sigma> x = Some v\<close> diff_vars_impl option.simps(5) \<open>x \<in> ?X' k\<close>)
[PROOF STATE]
proof (state)
this:
subst (g2 \<sigma>') mem\<^sub>2' x = v

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
subst \<sigma> (snd (mems' ! i)) x = v
subst (g2 \<sigma>') mem\<^sub>2' x = v
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
subst \<sigma> (snd (mems' ! i)) x = v
subst (g2 \<sigma>') mem\<^sub>2' x = v

goal (1 subgoal):
 1. subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
by (metis dom\<sigma>' dom_restrict_total dom_uniq(2) mem\<^sub>2'_def subst_overrides)
[PROOF STATE]
proof (state)
this:
subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
assume "x \<notin> ?X' k"
[PROOF STATE]
proof (state)
this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
hence "?mems\<^sub>2'i [\<mapsto> \<sigma>] x = ?mems\<^sub>2'i x"
[PROOF STATE]
proof (prove)
using this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k

goal (1 subgoal):
 1. subst \<sigma> (snd (mems' ! i)) x = snd (mems' ! i) x
[PROOF STEP]
using dom\<sigma>
[PROOF STATE]
proof (prove)
using this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k
dom \<sigma> = differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. subst \<sigma> (snd (mems' ! i)) x = snd (mems' ! i) x
[PROOF STEP]
by (metis \<open>i = k\<close> subst_not_in_dom)
[PROOF STATE]
proof (state)
this:
subst \<sigma> (snd (mems' ! i)) x = snd (mems' ! i) x

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
proof (cases "x \<in> dom_g2")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x \<in> dom_g2 \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
 2. x \<notin> dom_g2 \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
assume "x \<in> dom_g2"
[PROOF STATE]
proof (state)
this:
x \<in> dom_g2

goal (2 subgoals):
 1. x \<in> dom_g2 \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
 2. x \<notin> dom_g2 \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
hence "x \<in> dom (g2 \<sigma>')"
[PROOF STATE]
proof (prove)
using this:
x \<in> dom_g2

goal (1 subgoal):
 1. x \<in> dom (g2 \<sigma>')
[PROOF STEP]
using dom\<sigma>'
[PROOF STATE]
proof (prove)
using this:
x \<in> dom_g2
dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (1 subgoal):
 1. x \<in> dom (g2 \<sigma>')
[PROOF STEP]
by (metis dom_uniq)
[PROOF STATE]
proof (state)
this:
x \<in> dom (g2 \<sigma>')

goal (2 subgoals):
 1. x \<in> dom_g2 \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
 2. x \<notin> dom_g2 \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
hence "g2 \<sigma>' x = \<sigma>' x"
[PROOF STATE]
proof (prove)
using this:
x \<in> dom (g2 \<sigma>')

goal (1 subgoal):
 1. g2 \<sigma>' x = \<sigma>' x
[PROOF STEP]
using e dom\<sigma>'
[PROOF STATE]
proof (prove)
using this:
x \<in> dom (g2 \<sigma>')
change_respecting (cms\<^sub>2 ! k, subst h (snd (mems ! k))) \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), mem\<^sub>h\<rangle> (differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k) g2
dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (1 subgoal):
 1. g2 \<sigma>' x = \<sigma>' x
[PROOF STEP]
by (metis change_respecting.simps func_le_def)
[PROOF STATE]
proof (state)
this:
g2 \<sigma>' x = \<sigma>' x

goal (2 subgoals):
 1. x \<in> dom_g2 \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
 2. x \<notin> dom_g2 \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
g2 \<sigma>' x = \<sigma>' x
[PROOF STEP]
have "\<sigma>' x = Some (?mems\<^sub>2'i x)"
[PROOF STATE]
proof (prove)
using this:
g2 \<sigma>' x = \<sigma>' x

goal (1 subgoal):
 1. \<sigma>' x = Some (snd (mems' ! i) x)
[PROOF STEP]
proof (cases "x \<in> dom_g1")
                \<comment> \<open>This can't happen, so derive a contradiction.\<close>
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>g2 \<sigma>' x = \<sigma>' x; x \<in> dom_g1\<rbrakk> \<Longrightarrow> \<sigma>' x = Some (snd (mems' ! i) x)
 2. \<lbrakk>g2 \<sigma>' x = \<sigma>' x; x \<notin> dom_g1\<rbrakk> \<Longrightarrow> \<sigma>' x = Some (snd (mems' ! i) x)
[PROOF STEP]
assume "x \<in> dom_g1"
[PROOF STATE]
proof (state)
this:
x \<in> dom_g1

goal (2 subgoals):
 1. \<lbrakk>g2 \<sigma>' x = \<sigma>' x; x \<in> dom_g1\<rbrakk> \<Longrightarrow> \<sigma>' x = Some (snd (mems' ! i) x)
 2. \<lbrakk>g2 \<sigma>' x = \<sigma>' x; x \<notin> dom_g1\<rbrakk> \<Longrightarrow> \<sigma>' x = Some (snd (mems' ! i) x)
[PROOF STEP]
have "x \<notin> ?X k"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
[PROOF STEP]
proof (rule ccontr)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> False
[PROOF STEP]
assume "\<not> (x \<notin> ?X k)"
[PROOF STATE]
proof (state)
this:
\<not> x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (1 subgoal):
 1. \<not> x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> False
[PROOF STEP]
hence "x \<in> ?X k"
[PROOF STATE]
proof (prove)
using this:
\<not> x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (1 subgoal):
 1. x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (1 subgoal):
 1. \<not> x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> False
[PROOF STEP]
have "mem\<^sub>1 x = mem\<^sub>1' x \<and> mem\<^sub>2 x = mem\<^sub>2' x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mem\<^sub>1 x = mem\<^sub>1' x \<and> mem\<^sub>2 x = mem\<^sub>2' x
[PROOF STEP]
by (metis \<sigma>'_def \<open>g2 \<sigma>' x = \<sigma>' x\<close> \<open>x \<in> dom (g2 \<sigma>')\<close>
                      \<open>x \<in> dom_g1\<close> \<open>x \<in> dom_g2\<close> domIff x_unchanged)
[PROOF STATE]
proof (state)
this:
mem\<^sub>1 x = mem\<^sub>1' x \<and> mem\<^sub>2 x = mem\<^sub>2' x

goal (1 subgoal):
 1. \<not> x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
mem\<^sub>1 x = mem\<^sub>1' x \<and> mem\<^sub>2 x = mem\<^sub>2' x

goal (1 subgoal):
 1. \<not> x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> False
[PROOF STEP]
from \<open>x \<notin> ?X' k\<close>
[PROOF STATE]
proof (chain)
picking this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k
[PROOF STEP]
have
                    "?mems\<^sub>1'i x = ?mems\<^sub>1k x \<and> ?mems\<^sub>2'i x = ?mems\<^sub>2k x"
[PROOF STATE]
proof (prove)
using this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k

goal (1 subgoal):
 1. fst (mems' ! i) x = fst (mems ! k) x \<and> snd (mems' ! i) x = snd (mems ! k) x
[PROOF STEP]
using \<open>x \<in> ?X k\<close> \<open>x \<in> dom_g1\<close> \<open>x \<in> dom_g2\<close>
[PROOF STATE]
proof (prove)
using this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k
x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
x \<in> dom_g1
x \<in> dom_g2

goal (1 subgoal):
 1. fst (mems' ! i) x = fst (mems ! k) x \<and> snd (mems' ! i) x = snd (mems ! k) x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fst (mems' ! i) x = fst (mems ! k) x \<and> snd (mems' ! i) x = snd (mems ! k) x

goal (1 subgoal):
 1. \<not> x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
mem\<^sub>1 x = mem\<^sub>1' x \<and> mem\<^sub>2 x = mem\<^sub>2' x
fst (mems' ! i) x = fst (mems ! k) x \<and> snd (mems' ! i) x = snd (mems ! k) x
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
mem\<^sub>1 x = mem\<^sub>1' x \<and> mem\<^sub>2 x = mem\<^sub>2' x
fst (mems' ! i) x = fst (mems ! k) x \<and> snd (mems' ! i) x = snd (mems ! k) x

goal (1 subgoal):
 1. False
[PROOF STEP]
using \<open>x \<in> ?X k\<close> \<open>x \<notin> ?X' k\<close>
[PROOF STATE]
proof (prove)
using this:
mem\<^sub>1 x = mem\<^sub>1' x \<and> mem\<^sub>2 x = mem\<^sub>2' x
fst (mems' ! i) x = fst (mems ! k) x \<and> snd (mems' ! i) x = snd (mems ! k) x
x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k

goal (1 subgoal):
 1. False
[PROOF STEP]
by (metis \<open>i = k\<close> differing_vars_elim differing_vars_neg)
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (2 subgoals):
 1. \<lbrakk>g2 \<sigma>' x = \<sigma>' x; x \<in> dom_g1\<rbrakk> \<Longrightarrow> \<sigma>' x = Some (snd (mems' ! i) x)
 2. \<lbrakk>g2 \<sigma>' x = \<sigma>' x; x \<notin> dom_g1\<rbrakk> \<Longrightarrow> \<sigma>' x = Some (snd (mems' ! i) x)
[PROOF STEP]
hence False
[PROOF STATE]
proof (prove)
using this:
x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (1 subgoal):
 1. False
[PROOF STEP]
by (metis \<sigma>'_def \<open>g2 \<sigma>' x = \<sigma>' x\<close> \<open>x \<in> dom (g2 \<sigma>')\<close> domIff)
[PROOF STATE]
proof (state)
this:
False

goal (2 subgoals):
 1. \<lbrakk>g2 \<sigma>' x = \<sigma>' x; x \<in> dom_g1\<rbrakk> \<Longrightarrow> \<sigma>' x = Some (snd (mems' ! i) x)
 2. \<lbrakk>g2 \<sigma>' x = \<sigma>' x; x \<notin> dom_g1\<rbrakk> \<Longrightarrow> \<sigma>' x = Some (snd (mems' ! i) x)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
False

goal (1 subgoal):
 1. \<sigma>' x = Some (snd (mems' ! i) x)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<sigma>' x = Some (snd (mems' ! i) x)

goal (1 subgoal):
 1. \<lbrakk>g2 \<sigma>' x = \<sigma>' x; x \<notin> dom_g1\<rbrakk> \<Longrightarrow> \<sigma>' x = Some (snd (mems' ! i) x)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>g2 \<sigma>' x = \<sigma>' x; x \<notin> dom_g1\<rbrakk> \<Longrightarrow> \<sigma>' x = Some (snd (mems' ! i) x)
[PROOF STEP]
assume "x \<notin> dom_g1"
[PROOF STATE]
proof (state)
this:
x \<notin> dom_g1

goal (1 subgoal):
 1. \<lbrakk>g2 \<sigma>' x = \<sigma>' x; x \<notin> dom_g1\<rbrakk> \<Longrightarrow> \<sigma>' x = Some (snd (mems' ! i) x)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
x \<notin> dom_g1

goal (1 subgoal):
 1. \<sigma>' x = Some (snd (mems' ! i) x)
[PROOF STEP]
unfolding \<sigma>'_def
[PROOF STATE]
proof (prove)
using this:
x \<notin> dom_g1

goal (1 subgoal):
 1. (if x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k then if x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k then \<sigma> x else if x \<in> dom (g1 h) then Some (fst (mems' ! i) x) else if x \<in> dom (g2 h) then Some (snd (mems' ! i) x) else Some some_val else None) = Some (snd (mems' ! i) x)
[PROOF STEP]
by (metis \<open>g2 \<sigma>' x = \<sigma>' x\<close> \<open>x \<in> dom (g2 \<sigma>')\<close> \<open>x \<notin> ?X' k\<close>
                    domIff dom\<sigma>' dom_uniq domh)
[PROOF STATE]
proof (state)
this:
\<sigma>' x = Some (snd (mems' ! i) x)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<sigma>' x = Some (snd (mems' ! i) x)

goal (2 subgoals):
 1. x \<in> dom_g2 \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
 2. x \<notin> dom_g2 \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
hence "mem\<^sub>2' [\<mapsto> g2 \<sigma>'] x = ?mems\<^sub>2'i x"
[PROOF STATE]
proof (prove)
using this:
\<sigma>' x = Some (snd (mems' ! i) x)

goal (1 subgoal):
 1. subst (g2 \<sigma>') mem\<^sub>2' x = snd (mems' ! i) x
[PROOF STEP]
unfolding subst_def
[PROOF STATE]
proof (prove)
using this:
\<sigma>' x = Some (snd (mems' ! i) x)

goal (1 subgoal):
 1. (case g2 \<sigma>' x of None \<Rightarrow> mem\<^sub>2' x | Some v \<Rightarrow> v) = snd (mems' ! i) x
[PROOF STEP]
by (metis \<open>g2 \<sigma>' x = \<sigma>' x\<close> option.simps(5))
[PROOF STATE]
proof (state)
this:
subst (g2 \<sigma>') mem\<^sub>2' x = snd (mems' ! i) x

goal (2 subgoals):
 1. x \<in> dom_g2 \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
 2. x \<notin> dom_g2 \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
subst (g2 \<sigma>') mem\<^sub>2' x = snd (mems' ! i) x

goal (1 subgoal):
 1. subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
using \<open>x \<notin> ?X' k\<close> dom\<sigma> dom\<sigma>'
[PROOF STATE]
proof (prove)
using this:
subst (g2 \<sigma>') mem\<^sub>2' x = snd (mems' ! i) x
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k
dom \<sigma> = differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k

goal (1 subgoal):
 1. subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
by (metis \<open>i = k\<close> dom_restrict_total dom_uniq(2)
                  mem\<^sub>2'_def subst_not_in_dom subst_overrides)
[PROOF STATE]
proof (state)
this:
subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x

goal (1 subgoal):
 1. x \<notin> dom_g2 \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. x \<notin> dom_g2 \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
assume "x \<notin> dom_g2"
[PROOF STATE]
proof (state)
this:
x \<notin> dom_g2

goal (1 subgoal):
 1. x \<notin> dom_g2 \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
x \<notin> dom_g2
[PROOF STEP]
have "mem\<^sub>h [\<mapsto> g2 \<sigma>'] x = mem\<^sub>h x"
[PROOF STATE]
proof (prove)
using this:
x \<notin> dom_g2

goal (1 subgoal):
 1. subst (g2 \<sigma>') mem\<^sub>h x = mem\<^sub>h x
[PROOF STEP]
by (metis dom\<sigma>' dom_uniq(2) subst_not_in_dom)
[PROOF STATE]
proof (state)
this:
subst (g2 \<sigma>') mem\<^sub>h x = mem\<^sub>h x

goal (1 subgoal):
 1. x \<notin> dom_g2 \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
subst (g2 \<sigma>') mem\<^sub>h x = mem\<^sub>h x

goal (1 subgoal):
 1. x \<notin> dom_g2 \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
have "?mems\<^sub>2'i x = mem\<^sub>2' x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd (mems' ! i) x = mem\<^sub>2' x
[PROOF STEP]
by (metis \<open>i = k\<close> \<open>x \<notin> dom_g2\<close> mems'_k_1 mems'_k_2)
[PROOF STATE]
proof (state)
this:
snd (mems' ! i) x = mem\<^sub>2' x

goal (1 subgoal):
 1. x \<notin> dom_g2 \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
hence "?mems\<^sub>2'i x = mem\<^sub>h x"
[PROOF STATE]
proof (prove)
using this:
snd (mems' ! i) x = mem\<^sub>2' x

goal (1 subgoal):
 1. snd (mems' ! i) x = mem\<^sub>h x
[PROOF STEP]
unfolding mem\<^sub>2'_def
[PROOF STATE]
proof (prove)
using this:
snd (mems' ! i) x = subst (g2 (to_partial mem\<^sub>2 |` differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k)) mem\<^sub>h x

goal (1 subgoal):
 1. snd (mems' ! i) x = mem\<^sub>h x
[PROOF STEP]
by (metis \<open>x \<notin> dom_g2\<close> dom\<sigma>_mem\<^sub>2 dom_uniq(2) subst_not_in_dom)
[PROOF STATE]
proof (state)
this:
snd (mems' ! i) x = mem\<^sub>h x

goal (1 subgoal):
 1. x \<notin> dom_g2 \<Longrightarrow> subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
subst (g2 \<sigma>') mem\<^sub>h x = mem\<^sub>h x
snd (mems' ! i) x = mem\<^sub>h x
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
subst (g2 \<sigma>') mem\<^sub>h x = mem\<^sub>h x
snd (mems' ! i) x = mem\<^sub>h x

goal (1 subgoal):
 1. subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x
[PROOF STEP]
by (metis \<open>?mems\<^sub>2'i [\<mapsto>\<sigma>] x = ?mems\<^sub>2'i x\<close>)
[PROOF STATE]
proof (state)
this:
subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
subst \<sigma> (snd (mems' ! i)) x = subst (g2 \<sigma>') mem\<^sub>h x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
subst \<sigma> (snd (mems' ! i)) = subst (g2 \<sigma>') mem\<^sub>h

goal (2 subgoals):
 1. i = k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
 2. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
subst \<sigma> (fst (mems' ! i)) = subst (g1 \<sigma>') mem\<^sub>1'
subst \<sigma> (snd (mems' ! i)) = subst (g2 \<sigma>') mem\<^sub>h
[PROOF STEP]
show
          "(cms\<^sub>1' ! i, (fst (mems' ! i)) [\<mapsto> \<sigma>]) \<approx> (cms\<^sub>2' ! i, (snd (mems' ! i)) [\<mapsto> \<sigma>])"
[PROOF STATE]
proof (prove)
using this:
subst \<sigma> (fst (mems' ! i)) = subst (g1 \<sigma>') mem\<^sub>1'
subst \<sigma> (snd (mems' ! i)) = subst (g2 \<sigma>') mem\<^sub>h

goal (1 subgoal):
 1. (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
using dom\<sigma> dom\<sigma>' g b \<open>i = k\<close>
[PROOF STATE]
proof (prove)
using this:
subst \<sigma> (fst (mems' ! i)) = subst (g1 \<sigma>') mem\<^sub>1'
subst \<sigma> (snd (mems' ! i)) = subst (g2 \<sigma>') mem\<^sub>h
dom \<sigma> = differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k
dom ?\<sigma>5 = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<Longrightarrow> (cms\<^sub>2 ! k, subst ?\<sigma>5 (snd (mems ! k))) \<leadsto> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 ?\<sigma>5) mem\<^sub>h\<rangle> \<and> (cms\<^sub>1' ! k, subst (g1 ?\<sigma>5) mem\<^sub>1') \<approx> \<langle>c\<^sub>h, snd (cms\<^sub>1' ! k), subst (g2 ?\<sigma>5) mem\<^sub>h\<rangle>
k \<sqsubset> length cms\<^sub>1 \<and> (cms\<^sub>1 ! k, mem\<^sub>1) \<leadsto> (cms\<^sub>1' ! k, mem\<^sub>1') \<and> cms\<^sub>1' = cms\<^sub>1[k := cms\<^sub>1' ! k]
i = k

goal (1 subgoal):
 1. (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
by (metis c\<^sub>2'_def cms\<^sub>2'_def equal_size nth_list_update_eq)
[PROOF STATE]
proof (state)
this:
(cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
assume "i \<noteq> k"
[PROOF STATE]
proof (state)
this:
i \<noteq> k

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
define \<sigma>'
          where "\<sigma>' x = (if x \<in> ?X i
                         then if x \<in> ?X' i
                              then \<sigma> x
                              else Some (mem\<^sub>1' x)
                         else None)" for x
[PROOF STATE]
proof (state)
this:
\<sigma>' ?x = (if ?x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i then if ?x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i then \<sigma> ?x else Some (mem\<^sub>1' ?x) else None)

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
let ?mems\<^sub>1i = "fst (mems ! i)" and
            ?mems\<^sub>2i = "snd (mems ! i)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
have "dom \<sigma>' = ?X i"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i
[PROOF STEP]
unfolding \<sigma>'_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dom (\<lambda>x. if x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i then if x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i then \<sigma> x else Some (mem\<^sub>1' x) else None) = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x y. (if x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i then if x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i then \<sigma> x else Some (mem\<^sub>1' x) else None) = Some y \<Longrightarrow> x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i
 2. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i; x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i\<rbrakk> \<Longrightarrow> \<exists>y. \<sigma> x = Some y
[PROOF STEP]
apply (metis option.simps(2))
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i; x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i\<rbrakk> \<Longrightarrow> \<exists>y. \<sigma> x = Some y
[PROOF STEP]
by (metis domD dom\<sigma>)
[PROOF STATE]
proof (state)
this:
dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
have o: "\<And> x.
                 (?mems\<^sub>1'i [\<mapsto> \<sigma>] x \<noteq> ?mems\<^sub>1i [\<mapsto> \<sigma>'] x \<or>
                  ?mems\<^sub>2'i [\<mapsto> \<sigma>] x \<noteq> ?mems\<^sub>2i [\<mapsto> \<sigma>'] x)
                 \<longrightarrow> (mem\<^sub>1' x \<noteq> mem\<^sub>1 x \<or> mem\<^sub>2' x \<noteq> mem\<^sub>2 x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x \<longrightarrow> mem\<^sub>1' x \<noteq> mem\<^sub>1 x \<or> mem\<^sub>2' x \<noteq> mem\<^sub>2 x
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x \<longrightarrow> mem\<^sub>1' x \<noteq> mem\<^sub>1 x \<or> mem\<^sub>2' x \<noteq> mem\<^sub>2 x
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x \<longrightarrow> mem\<^sub>1' x \<noteq> mem\<^sub>1 x \<or> mem\<^sub>2' x \<noteq> mem\<^sub>2 x
[PROOF STEP]
{
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x \<longrightarrow> mem\<^sub>1' x \<noteq> mem\<^sub>1 x \<or> mem\<^sub>2' x \<noteq> mem\<^sub>2 x
[PROOF STEP]
assume eq_mem: "mem\<^sub>1' x = mem\<^sub>1 x \<and> mem\<^sub>2' x = mem\<^sub>2 x"
[PROOF STATE]
proof (state)
this:
mem\<^sub>1' x = mem\<^sub>1 x \<and> mem\<^sub>2' x = mem\<^sub>2 x

goal (1 subgoal):
 1. \<And>x. subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x \<longrightarrow> mem\<^sub>1' x \<noteq> mem\<^sub>1 x \<or> mem\<^sub>2' x \<noteq> mem\<^sub>2 x
[PROOF STEP]
hence mems'_simp [simp]: "?mems\<^sub>1'i x = ?mems\<^sub>1i x \<and> ?mems\<^sub>2'i x = ?mems\<^sub>2i x"
[PROOF STATE]
proof (prove)
using this:
mem\<^sub>1' x = mem\<^sub>1 x \<and> mem\<^sub>2' x = mem\<^sub>2 x

goal (1 subgoal):
 1. fst (mems' ! i) x = fst (mems ! i) x \<and> snd (mems' ! i) x = snd (mems ! i) x
[PROOF STEP]
using mems'_i_3
[PROOF STATE]
proof (prove)
using this:
mem\<^sub>1' x = mem\<^sub>1 x \<and> mem\<^sub>2' x = mem\<^sub>2 x
\<lbrakk>?i5 \<noteq> k; ?i5 \<sqsubset> length cms\<^sub>1; mem\<^sub>1 ?x5 = mem\<^sub>1' ?x5; mem\<^sub>2 ?x5 = mem\<^sub>2' ?x5\<rbrakk> \<Longrightarrow> fst (mems' ! ?i5) ?x5 = fst (mems ! ?i5) ?x5 \<and> snd (mems' ! ?i5) ?x5 = snd (mems ! ?i5) ?x5

goal (1 subgoal):
 1. fst (mems' ! i) x = fst (mems ! i) x \<and> snd (mems' ! i) x = snd (mems ! i) x
[PROOF STEP]
by (metis \<open>i \<noteq> k\<close> b i_le length_list_update)
[PROOF STATE]
proof (state)
this:
fst (mems' ! i) x = fst (mems ! i) x \<and> snd (mems' ! i) x = snd (mems ! i) x

goal (1 subgoal):
 1. \<And>x. subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x \<longrightarrow> mem\<^sub>1' x \<noteq> mem\<^sub>1 x \<or> mem\<^sub>2' x \<noteq> mem\<^sub>2 x
[PROOF STEP]
have
              "?mems\<^sub>1'i [\<mapsto> \<sigma>] x = ?mems\<^sub>1i [\<mapsto> \<sigma>'] x \<and> ?mems\<^sub>2'i [\<mapsto> \<sigma>] x = ?mems\<^sub>2i [\<mapsto> \<sigma>'] x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x
[PROOF STEP]
proof (cases "x \<in> ?X' i")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x
[PROOF STEP]
assume "x \<in> ?X' i"
[PROOF STATE]
proof (state)
this:
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x
[PROOF STEP]
hence "?mems\<^sub>1'i x \<noteq> mem\<^sub>1' x \<or> ?mems\<^sub>2'i x \<noteq> mem\<^sub>2' x"
[PROOF STATE]
proof (prove)
using this:
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. fst (mems' ! i) x \<noteq> mem\<^sub>1' x \<or> snd (mems' ! i) x \<noteq> mem\<^sub>2' x
[PROOF STEP]
by (metis differing_vars_neg_intro)
[PROOF STATE]
proof (state)
this:
fst (mems' ! i) x \<noteq> mem\<^sub>1' x \<or> snd (mems' ! i) x \<noteq> mem\<^sub>2' x

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x
[PROOF STEP]
hence "x \<in> ?X i"
[PROOF STATE]
proof (prove)
using this:
fst (mems' ! i) x \<noteq> mem\<^sub>1' x \<or> snd (mems' ! i) x \<noteq> mem\<^sub>2' x

goal (1 subgoal):
 1. x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i
[PROOF STEP]
using eq_mem mems'_simp
[PROOF STATE]
proof (prove)
using this:
fst (mems' ! i) x \<noteq> mem\<^sub>1' x \<or> snd (mems' ! i) x \<noteq> mem\<^sub>2' x
mem\<^sub>1' x = mem\<^sub>1 x \<and> mem\<^sub>2' x = mem\<^sub>2 x
fst (mems' ! i) x = fst (mems ! i) x \<and> snd (mems' ! i) x = snd (mems ! i) x

goal (1 subgoal):
 1. x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i
[PROOF STEP]
by (metis differing_vars_neg)
[PROOF STATE]
proof (state)
this:
x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x
[PROOF STEP]
hence "\<sigma>' x = \<sigma> x"
[PROOF STATE]
proof (prove)
using this:
x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i

goal (1 subgoal):
 1. \<sigma>' x = \<sigma> x
[PROOF STEP]
by (metis \<sigma>'_def \<open>x \<in> ?X' i\<close>)
[PROOF STATE]
proof (state)
this:
\<sigma>' x = \<sigma> x

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\<sigma>' x = \<sigma> x

goal (1 subgoal):
 1. subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x
[PROOF STEP]
apply (auto simp: subst_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<sigma>' x = \<sigma> x \<Longrightarrow> (case \<sigma> x of None \<Rightarrow> fst (mems' ! i) x | Some v \<Rightarrow> v) = (case \<sigma> x of None \<Rightarrow> fst (mems ! i) x | Some v \<Rightarrow> v)
 2. \<sigma>' x = \<sigma> x \<Longrightarrow> (case \<sigma> x of None \<Rightarrow> snd (mems' ! i) x | Some v \<Rightarrow> v) = (case \<sigma> x of None \<Rightarrow> snd (mems ! i) x | Some v \<Rightarrow> v)
[PROOF STEP]
apply (metis mems'_simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<sigma>' x = \<sigma> x \<Longrightarrow> (case \<sigma> x of None \<Rightarrow> snd (mems' ! i) x | Some v \<Rightarrow> v) = (case \<sigma> x of None \<Rightarrow> snd (mems ! i) x | Some v \<Rightarrow> v)
[PROOF STEP]
by (metis mems'_simp)
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x
[PROOF STEP]
assume "x \<notin> ?X' i"
[PROOF STATE]
proof (state)
this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x
[PROOF STEP]
hence "?mems\<^sub>1'i x = mem\<^sub>1' x \<and> ?mems\<^sub>2'i x = mem\<^sub>2' x"
[PROOF STATE]
proof (prove)
using this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. fst (mems' ! i) x = mem\<^sub>1' x \<and> snd (mems' ! i) x = mem\<^sub>2' x
[PROOF STEP]
by (metis differing_vars_neg)
[PROOF STATE]
proof (state)
this:
fst (mems' ! i) x = mem\<^sub>1' x \<and> snd (mems' ! i) x = mem\<^sub>2' x

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x
[PROOF STEP]
hence "x \<notin> ?X i"
[PROOF STATE]
proof (prove)
using this:
fst (mems' ! i) x = mem\<^sub>1' x \<and> snd (mems' ! i) x = mem\<^sub>2' x

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i
[PROOF STEP]
using eq_mem mems'_simp
[PROOF STATE]
proof (prove)
using this:
fst (mems' ! i) x = mem\<^sub>1' x \<and> snd (mems' ! i) x = mem\<^sub>2' x
mem\<^sub>1' x = mem\<^sub>1 x \<and> mem\<^sub>2' x = mem\<^sub>2 x
fst (mems' ! i) x = fst (mems ! i) x \<and> snd (mems' ! i) x = snd (mems ! i) x

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i
[PROOF STEP]
by (auto simp: differing_vars_neg_intro)
[PROOF STATE]
proof (state)
this:
x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i

goal (1 subgoal):
 1. subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x
[PROOF STEP]
by (metis \<open>dom \<sigma>' = ?X i\<close> \<open>x \<notin> ?X' i\<close> dom\<sigma> mems'_simp subst_not_in_dom)
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x

goal (1 subgoal):
 1. \<And>x. subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x \<longrightarrow> mem\<^sub>1' x \<noteq> mem\<^sub>1 x \<or> mem\<^sub>2' x \<noteq> mem\<^sub>2 x
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
mem\<^sub>1' x = mem\<^sub>1 x \<and> mem\<^sub>2' x = mem\<^sub>2 x \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x

goal (1 subgoal):
 1. \<And>x. subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x \<longrightarrow> mem\<^sub>1' x \<noteq> mem\<^sub>1 x \<or> mem\<^sub>2' x \<noteq> mem\<^sub>2 x
[PROOF STEP]
thus "?thesis x"
[PROOF STATE]
proof (prove)
using this:
mem\<^sub>1' x = mem\<^sub>1 x \<and> mem\<^sub>2' x = mem\<^sub>2 x \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) x = subst \<sigma>' (fst (mems ! i)) x \<and> subst \<sigma> (snd (mems' ! i)) x = subst \<sigma>' (snd (mems ! i)) x

goal (1 subgoal):
 1. subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x \<longrightarrow> mem\<^sub>1' x \<noteq> mem\<^sub>1 x \<or> mem\<^sub>2' x \<noteq> mem\<^sub>2 x
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x \<longrightarrow> mem\<^sub>1' x \<noteq> mem\<^sub>1 x \<or> mem\<^sub>2' x \<noteq> mem\<^sub>2 x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) ?x5 \<noteq> subst \<sigma>' (fst (mems ! i)) ?x5 \<or> subst \<sigma> (snd (mems' ! i)) ?x5 \<noteq> subst \<sigma>' (snd (mems ! i)) ?x5 \<longrightarrow> mem\<^sub>1' ?x5 \<noteq> mem\<^sub>1 ?x5 \<or> mem\<^sub>2' ?x5 \<noteq> mem\<^sub>2 ?x5

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
from o
[PROOF STATE]
proof (chain)
picking this:
subst \<sigma> (fst (mems' ! i)) ?x5 \<noteq> subst \<sigma>' (fst (mems ! i)) ?x5 \<or> subst \<sigma> (snd (mems' ! i)) ?x5 \<noteq> subst \<sigma>' (snd (mems ! i)) ?x5 \<longrightarrow> mem\<^sub>1' ?x5 \<noteq> mem\<^sub>1 ?x5 \<or> mem\<^sub>2' ?x5 \<noteq> mem\<^sub>2 ?x5
[PROOF STEP]
have
          p: "\<And> x. \<lbrakk> ?mems\<^sub>1'i [\<mapsto> \<sigma>] x \<noteq> ?mems\<^sub>1i [\<mapsto> \<sigma>'] x \<or>
                      ?mems\<^sub>2'i [\<mapsto> \<sigma>] x \<noteq> ?mems\<^sub>2i [\<mapsto> \<sigma>'] x \<rbrakk> \<Longrightarrow>
          x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite"
[PROOF STATE]
proof (prove)
using this:
subst \<sigma> (fst (mems' ! i)) ?x5 \<noteq> subst \<sigma>' (fst (mems ! i)) ?x5 \<or> subst \<sigma> (snd (mems' ! i)) ?x5 \<noteq> subst \<sigma>' (snd (mems ! i)) ?x5 \<longrightarrow> mem\<^sub>1' ?x5 \<noteq> mem\<^sub>1 ?x5 \<or> mem\<^sub>2' ?x5 \<noteq> mem\<^sub>2 ?x5

goal (1 subgoal):
 1. \<And>x. subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x \<Longrightarrow> x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
 2. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x) \<longrightarrow> mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x)
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
 2. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x) \<longrightarrow> mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x)
[PROOF STEP]
assume mems_neq:
            "?mems\<^sub>1'i [\<mapsto> \<sigma>] x \<noteq> ?mems\<^sub>1i [\<mapsto> \<sigma>'] x \<or> ?mems\<^sub>2'i [\<mapsto> \<sigma>] x \<noteq> ?mems\<^sub>2i [\<mapsto> \<sigma>'] x"
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x

goal (2 subgoals):
 1. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
 2. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x) \<longrightarrow> mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x)
[PROOF STEP]
hence modified:
            "\<not> (doesnt_modify (fst (cms\<^sub>1 ! k)) x) \<or> \<not> (doesnt_modify (fst (cms\<^sub>2 ! k)) x)"
[PROOF STATE]
proof (prove)
using this:
subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x

goal (1 subgoal):
 1. \<not> doesnt_modify (fst (cms\<^sub>1 ! k)) x \<or> \<not> doesnt_modify (fst (cms\<^sub>2 ! k)) x
[PROOF STEP]
using b i o
[PROOF STATE]
proof (prove)
using this:
subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x
k \<sqsubset> length cms\<^sub>1 \<and> (cms\<^sub>1 ! k, mem\<^sub>1) \<leadsto> (cms\<^sub>1' ! k, mem\<^sub>1') \<and> cms\<^sub>1' = cms\<^sub>1[k := cms\<^sub>1' ! k]
(cms\<^sub>2 ! k, mem\<^sub>2) \<leadsto> \<langle>c\<^sub>2', snd (cms\<^sub>1' ! k), mem\<^sub>2'\<rangle>
subst \<sigma> (fst (mems' ! i)) ?x5 \<noteq> subst \<sigma>' (fst (mems ! i)) ?x5 \<or> subst \<sigma> (snd (mems' ! i)) ?x5 \<noteq> subst \<sigma>' (snd (mems ! i)) ?x5 \<longrightarrow> mem\<^sub>1' ?x5 \<noteq> mem\<^sub>1 ?x5 \<or> mem\<^sub>2' ?x5 \<noteq> mem\<^sub>2 ?x5

goal (1 subgoal):
 1. \<not> doesnt_modify (fst (cms\<^sub>1 ! k)) x \<or> \<not> doesnt_modify (fst (cms\<^sub>2 ! k)) x
[PROOF STEP]
unfolding doesnt_modify_def
[PROOF STATE]
proof (prove)
using this:
subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x
k \<sqsubset> length cms\<^sub>1 \<and> (cms\<^sub>1 ! k, mem\<^sub>1) \<leadsto> (cms\<^sub>1' ! k, mem\<^sub>1') \<and> cms\<^sub>1' = cms\<^sub>1[k := cms\<^sub>1' ! k]
(cms\<^sub>2 ! k, mem\<^sub>2) \<leadsto> \<langle>c\<^sub>2', snd (cms\<^sub>1' ! k), mem\<^sub>2'\<rangle>
subst \<sigma> (fst (mems' ! i)) ?x5 \<noteq> subst \<sigma>' (fst (mems ! i)) ?x5 \<or> subst \<sigma> (snd (mems' ! i)) ?x5 \<noteq> subst \<sigma>' (snd (mems ! i)) ?x5 \<longrightarrow> mem\<^sub>1' ?x5 \<noteq> mem\<^sub>1 ?x5 \<or> mem\<^sub>2' ?x5 \<noteq> mem\<^sub>2 ?x5

goal (1 subgoal):
 1. \<not> (\<forall>mds mem c' mds' mem'. \<langle>fst (cms\<^sub>1 ! k), mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle> \<longrightarrow> mem x = mem' x) \<or> \<not> (\<forall>mds mem c' mds' mem'. \<langle>fst (cms\<^sub>2 ! k), mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle> \<longrightarrow> mem x = mem' x)
[PROOF STEP]
by (metis surjective_pairing)
[PROOF STATE]
proof (state)
this:
\<not> doesnt_modify (fst (cms\<^sub>1 ! k)) x \<or> \<not> doesnt_modify (fst (cms\<^sub>2 ! k)) x

goal (2 subgoals):
 1. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
 2. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x) \<longrightarrow> mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<not> doesnt_modify (fst (cms\<^sub>1 ! k)) x \<or> \<not> doesnt_modify (fst (cms\<^sub>2 ! k)) x

goal (2 subgoals):
 1. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
 2. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x) \<longrightarrow> mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x)
[PROOF STEP]
from sound_modes
[PROOF STATE]
proof (chain)
picking this:
sound_mode_use (cms\<^sub>1, mem\<^sub>1)
sound_mode_use (cms\<^sub>2, mem\<^sub>2)
[PROOF STEP]
have loc_modes:
            "locally_sound_mode_use (cms\<^sub>1 ! k, mem\<^sub>1) \<and>
             locally_sound_mode_use (cms\<^sub>2 ! k, mem\<^sub>2)"
[PROOF STATE]
proof (prove)
using this:
sound_mode_use (cms\<^sub>1, mem\<^sub>1)
sound_mode_use (cms\<^sub>2, mem\<^sub>2)

goal (1 subgoal):
 1. locally_sound_mode_use (cms\<^sub>1 ! k, mem\<^sub>1) \<and> locally_sound_mode_use (cms\<^sub>2 ! k, mem\<^sub>2)
[PROOF STEP]
unfolding sound_mode_use.simps
[PROOF STATE]
proof (prove)
using this:
list_all (\<lambda>cm. locally_sound_mode_use (cm, mem\<^sub>1)) cms\<^sub>1 \<and> globally_sound_mode_use (cms\<^sub>1, mem\<^sub>1)
list_all (\<lambda>cm. locally_sound_mode_use (cm, mem\<^sub>2)) cms\<^sub>2 \<and> globally_sound_mode_use (cms\<^sub>2, mem\<^sub>2)

goal (1 subgoal):
 1. locally_sound_mode_use (cms\<^sub>1 ! k, mem\<^sub>1) \<and> locally_sound_mode_use (cms\<^sub>2 ! k, mem\<^sub>2)
[PROOF STEP]
by (metis b equal_size list_all_length)
[PROOF STATE]
proof (state)
this:
locally_sound_mode_use (cms\<^sub>1 ! k, mem\<^sub>1) \<and> locally_sound_mode_use (cms\<^sub>2 ! k, mem\<^sub>2)

goal (2 subgoals):
 1. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
 2. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x) \<longrightarrow> mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
locally_sound_mode_use (cms\<^sub>1 ! k, mem\<^sub>1) \<and> locally_sound_mode_use (cms\<^sub>2 ! k, mem\<^sub>2)

goal (2 subgoals):
 1. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
 2. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x) \<longrightarrow> mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x)
[PROOF STEP]
have "snd (cms\<^sub>1 ! k) = snd (cms\<^sub>2 ! k)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd (cms\<^sub>1 ! k) = snd (cms\<^sub>2 ! k)
[PROOF STEP]
by (metis b equal_size modes_eq nth_map)
[PROOF STATE]
proof (state)
this:
snd (cms\<^sub>1 ! k) = snd (cms\<^sub>2 ! k)

goal (2 subgoals):
 1. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
 2. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x) \<longrightarrow> mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x)
[PROOF STEP]
have "(cms\<^sub>1 ! k, mem\<^sub>1) \<in> loc_reach (cms\<^sub>1 ! k, mem\<^sub>1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (cms\<^sub>1 ! k, mem\<^sub>1) \<in> loc_reach (cms\<^sub>1 ! k, mem\<^sub>1)
[PROOF STEP]
by (metis loc_reach.refl prod.collapse)
[PROOF STATE]
proof (state)
this:
(cms\<^sub>1 ! k, mem\<^sub>1) \<in> loc_reach (cms\<^sub>1 ! k, mem\<^sub>1)

goal (2 subgoals):
 1. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
 2. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x) \<longrightarrow> mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x)
[PROOF STEP]
hence guars:
                "x \<in> snd (cms\<^sub>1 ! k) GuarNoWrite \<longrightarrow> doesnt_modify (fst (cms\<^sub>1 ! k)) x \<and>
                 x \<in> snd (cms\<^sub>2 ! k) GuarNoWrite \<longrightarrow> doesnt_modify (fst (cms\<^sub>1 ! k)) x"
[PROOF STATE]
proof (prove)
using this:
(cms\<^sub>1 ! k, mem\<^sub>1) \<in> loc_reach (cms\<^sub>1 ! k, mem\<^sub>1)

goal (1 subgoal):
 1. x \<in> snd (cms\<^sub>1 ! k) GuarNoWrite \<longrightarrow> doesnt_modify (fst (cms\<^sub>1 ! k)) x \<and> x \<in> snd (cms\<^sub>2 ! k) GuarNoWrite \<longrightarrow> doesnt_modify (fst (cms\<^sub>1 ! k)) x
[PROOF STEP]
using loc_modes
[PROOF STATE]
proof (prove)
using this:
(cms\<^sub>1 ! k, mem\<^sub>1) \<in> loc_reach (cms\<^sub>1 ! k, mem\<^sub>1)
locally_sound_mode_use (cms\<^sub>1 ! k, mem\<^sub>1) \<and> locally_sound_mode_use (cms\<^sub>2 ! k, mem\<^sub>2)

goal (1 subgoal):
 1. x \<in> snd (cms\<^sub>1 ! k) GuarNoWrite \<longrightarrow> doesnt_modify (fst (cms\<^sub>1 ! k)) x \<and> x \<in> snd (cms\<^sub>2 ! k) GuarNoWrite \<longrightarrow> doesnt_modify (fst (cms\<^sub>1 ! k)) x
[PROOF STEP]
unfolding locally_sound_mode_use_def \<open>snd (cms\<^sub>1 ! k) = snd (cms\<^sub>2 ! k)\<close>
[PROOF STATE]
proof (prove)
using this:
(cms\<^sub>1 ! k, mem\<^sub>1) \<in> loc_reach (cms\<^sub>1 ! k, mem\<^sub>1)
(\<forall>c' mds' mem'. \<langle>c', mds', mem'\<rangle> \<in> loc_reach (cms\<^sub>1 ! k, mem\<^sub>1) \<longrightarrow> (\<forall>x. (x \<in> mds' GuarNoRead \<longrightarrow> doesnt_read c' x) \<and> (x \<in> mds' GuarNoWrite \<longrightarrow> doesnt_modify c' x))) \<and> (\<forall>c' mds' mem'. \<langle>c', mds', mem'\<rangle> \<in> loc_reach (cms\<^sub>2 ! k, mem\<^sub>2) \<longrightarrow> (\<forall>x. (x \<in> mds' GuarNoRead \<longrightarrow> doesnt_read c' x) \<and> (x \<in> mds' GuarNoWrite \<longrightarrow> doesnt_modify c' x)))

goal (1 subgoal):
 1. x \<in> snd (cms\<^sub>2 ! k) GuarNoWrite \<longrightarrow> doesnt_modify (fst (cms\<^sub>1 ! k)) x \<and> x \<in> snd (cms\<^sub>2 ! k) GuarNoWrite \<longrightarrow> doesnt_modify (fst (cms\<^sub>1 ! k)) x
[PROOF STEP]
by (metis loc_reach.refl surjective_pairing)
[PROOF STATE]
proof (state)
this:
x \<in> snd (cms\<^sub>1 ! k) GuarNoWrite \<longrightarrow> doesnt_modify (fst (cms\<^sub>1 ! k)) x \<and> x \<in> snd (cms\<^sub>2 ! k) GuarNoWrite \<longrightarrow> doesnt_modify (fst (cms\<^sub>1 ! k)) x

goal (2 subgoals):
 1. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
 2. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x) \<longrightarrow> mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x)
[PROOF STEP]
hence "x \<notin> snd (cms\<^sub>1 ! k) GuarNoWrite"
[PROOF STATE]
proof (prove)
using this:
x \<in> snd (cms\<^sub>1 ! k) GuarNoWrite \<longrightarrow> doesnt_modify (fst (cms\<^sub>1 ! k)) x \<and> x \<in> snd (cms\<^sub>2 ! k) GuarNoWrite \<longrightarrow> doesnt_modify (fst (cms\<^sub>1 ! k)) x

goal (1 subgoal):
 1. x \<notin> snd (cms\<^sub>1 ! k) GuarNoWrite
[PROOF STEP]
using modified loc_modes locally_sound_mode_use_def
[PROOF STATE]
proof (prove)
using this:
x \<in> snd (cms\<^sub>1 ! k) GuarNoWrite \<longrightarrow> doesnt_modify (fst (cms\<^sub>1 ! k)) x \<and> x \<in> snd (cms\<^sub>2 ! k) GuarNoWrite \<longrightarrow> doesnt_modify (fst (cms\<^sub>1 ! k)) x
\<not> doesnt_modify (fst (cms\<^sub>1 ! k)) x \<or> \<not> doesnt_modify (fst (cms\<^sub>2 ! k)) x
locally_sound_mode_use (cms\<^sub>1 ! k, mem\<^sub>1) \<and> locally_sound_mode_use (cms\<^sub>2 ! k, mem\<^sub>2)
locally_sound_mode_use ?lc = (\<forall>c' mds' mem'. \<langle>c', mds', mem'\<rangle> \<in> loc_reach ?lc \<longrightarrow> (\<forall>x. (x \<in> mds' GuarNoRead \<longrightarrow> doesnt_read c' x) \<and> (x \<in> mds' GuarNoWrite \<longrightarrow> doesnt_modify c' x)))

goal (1 subgoal):
 1. x \<notin> snd (cms\<^sub>1 ! k) GuarNoWrite
[PROOF STEP]
by (metis \<open>snd (cms\<^sub>1 ! k) = snd (cms\<^sub>2 ! k)\<close> loc_reach.refl prod.collapse)
[PROOF STATE]
proof (state)
this:
x \<notin> snd (cms\<^sub>1 ! k) GuarNoWrite

goal (2 subgoals):
 1. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
 2. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x) \<longrightarrow> mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
x \<notin> snd (cms\<^sub>1 ! k) GuarNoWrite

goal (2 subgoals):
 1. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
 2. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x) \<longrightarrow> mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x)
[PROOF STEP]
from sound_modes
[PROOF STATE]
proof (chain)
picking this:
sound_mode_use (cms\<^sub>1, mem\<^sub>1)
sound_mode_use (cms\<^sub>2, mem\<^sub>2)
[PROOF STEP]
have "compatible_modes (map snd cms\<^sub>1)"
[PROOF STATE]
proof (prove)
using this:
sound_mode_use (cms\<^sub>1, mem\<^sub>1)
sound_mode_use (cms\<^sub>2, mem\<^sub>2)

goal (1 subgoal):
 1. compatible_modes (map snd cms\<^sub>1)
[PROOF STEP]
by (metis globally_sound_modes_compatible sound_mode_use.simps)
[PROOF STATE]
proof (state)
this:
compatible_modes (map snd cms\<^sub>1)

goal (2 subgoals):
 1. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
 2. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x) \<longrightarrow> mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<not> doesnt_modify (fst (cms\<^sub>1 ! k)) x \<or> \<not> doesnt_modify (fst (cms\<^sub>2 ! k)) x
locally_sound_mode_use (cms\<^sub>1 ! k, mem\<^sub>1) \<and> locally_sound_mode_use (cms\<^sub>2 ! k, mem\<^sub>2)
x \<notin> snd (cms\<^sub>1 ! k) GuarNoWrite
compatible_modes (map snd cms\<^sub>1)
[PROOF STEP]
show "x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite"
[PROOF STATE]
proof (prove)
using this:
\<not> doesnt_modify (fst (cms\<^sub>1 ! k)) x \<or> \<not> doesnt_modify (fst (cms\<^sub>2 ! k)) x
locally_sound_mode_use (cms\<^sub>1 ! k, mem\<^sub>1) \<and> locally_sound_mode_use (cms\<^sub>2 ! k, mem\<^sub>2)
x \<notin> snd (cms\<^sub>1 ! k) GuarNoWrite
compatible_modes (map snd cms\<^sub>1)

goal (1 subgoal):
 1. x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
[PROOF STEP]
unfolding compatible_modes_def
[PROOF STATE]
proof (prove)
using this:
\<not> doesnt_modify (fst (cms\<^sub>1 ! k)) x \<or> \<not> doesnt_modify (fst (cms\<^sub>2 ! k)) x
locally_sound_mode_use (cms\<^sub>1 ! k, mem\<^sub>1) \<and> locally_sound_mode_use (cms\<^sub>2 ! k, mem\<^sub>2)
x \<notin> snd (cms\<^sub>1 ! k) GuarNoWrite
\<forall>i x. i \<sqsubset> length (map snd cms\<^sub>1) \<longrightarrow> (x \<in> (map snd cms\<^sub>1 ! i) AsmNoRead \<longrightarrow> (\<forall>j<length (map snd cms\<^sub>1). j \<noteq> i \<longrightarrow> x \<in> (map snd cms\<^sub>1 ! j) GuarNoRead)) \<and> (x \<in> (map snd cms\<^sub>1 ! i) AsmNoWrite \<longrightarrow> (\<forall>j<length (map snd cms\<^sub>1). j \<noteq> i \<longrightarrow> x \<in> (map snd cms\<^sub>1 ! j) GuarNoWrite))

goal (1 subgoal):
 1. x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
[PROOF STEP]
using \<open>i \<noteq> k\<close> i_le
[PROOF STATE]
proof (prove)
using this:
\<not> doesnt_modify (fst (cms\<^sub>1 ! k)) x \<or> \<not> doesnt_modify (fst (cms\<^sub>2 ! k)) x
locally_sound_mode_use (cms\<^sub>1 ! k, mem\<^sub>1) \<and> locally_sound_mode_use (cms\<^sub>2 ! k, mem\<^sub>2)
x \<notin> snd (cms\<^sub>1 ! k) GuarNoWrite
\<forall>i x. i \<sqsubset> length (map snd cms\<^sub>1) \<longrightarrow> (x \<in> (map snd cms\<^sub>1 ! i) AsmNoRead \<longrightarrow> (\<forall>j<length (map snd cms\<^sub>1). j \<noteq> i \<longrightarrow> x \<in> (map snd cms\<^sub>1 ! j) GuarNoRead)) \<and> (x \<in> (map snd cms\<^sub>1 ! i) AsmNoWrite \<longrightarrow> (\<forall>j<length (map snd cms\<^sub>1). j \<noteq> i \<longrightarrow> x \<in> (map snd cms\<^sub>1 ! j) GuarNoWrite))
i \<noteq> k
i \<sqsubset> length cms\<^sub>1'

goal (1 subgoal):
 1. x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
[PROOF STEP]
by (metis (no_types) b length_list_update length_map nth_map)
[PROOF STATE]
proof (state)
this:
x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite

goal (1 subgoal):
 1. \<And>x. \<lbrakk>subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x) \<longrightarrow> mem\<^sub>1' (?x6 x) \<noteq> mem\<^sub>1 (?x6 x) \<or> mem\<^sub>2' (?x6 x) \<noteq> mem\<^sub>2 (?x6 x)\<rbrakk> \<Longrightarrow> subst \<sigma> (fst (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (fst (mems ! i)) (?x6 x) \<or> subst \<sigma> (snd (mems' ! i)) (?x6 x) \<noteq> subst \<sigma>' (snd (mems ! i)) (?x6 x)
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) ?x5 \<noteq> subst \<sigma>' (fst (mems ! i)) ?x5 \<or> subst \<sigma> (snd (mems' ! i)) ?x5 \<noteq> subst \<sigma>' (snd (mems ! i)) ?x5 \<Longrightarrow> ?x5 \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
have q:
          "\<And> x. \<lbrakk> dma x = Low;
                   ?mems\<^sub>1'i [\<mapsto> \<sigma>] x \<noteq> ?mems\<^sub>1i [\<mapsto> \<sigma>'] x \<or>
                   ?mems\<^sub>2'i [\<mapsto> \<sigma>] x \<noteq> ?mems\<^sub>2i [\<mapsto> \<sigma>'] x;
                   x \<notin> ?X' i \<rbrakk> \<Longrightarrow>
                 mem\<^sub>1' x = mem\<^sub>2' x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>dma x = Low; subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x; x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i\<rbrakk> \<Longrightarrow> mem\<^sub>1' x = mem\<^sub>2' x
[PROOF STEP]
by (metis \<open>i \<noteq> k\<close> b compat_different_vars i_le length_list_update mems'_i_2 o)
[PROOF STATE]
proof (state)
this:
\<lbrakk>dma ?x5 = Low; subst \<sigma> (fst (mems' ! i)) ?x5 \<noteq> subst \<sigma>' (fst (mems ! i)) ?x5 \<or> subst \<sigma> (snd (mems' ! i)) ?x5 \<noteq> subst \<sigma>' (snd (mems ! i)) ?x5; ?x5 \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i\<rbrakk> \<Longrightarrow> mem\<^sub>1' ?x5 = mem\<^sub>2' ?x5

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
have "i < length cms\<^sub>1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. i \<sqsubset> length cms\<^sub>1
[PROOF STEP]
by (metis cms\<^sub>2'_def equal_size i_le length_list_update new_length)
[PROOF STATE]
proof (state)
this:
i \<sqsubset> length cms\<^sub>1

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
with compat and \<open>dom \<sigma>' = ?X i\<close>
[PROOF STATE]
proof (chain)
picking this:
makes_compatible (cms\<^sub>1, mem\<^sub>1) (cms\<^sub>2, mem\<^sub>2) mems
dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i
i \<sqsubset> length cms\<^sub>1
[PROOF STEP]
have
          bisim: "(cms\<^sub>1 ! i, ?mems\<^sub>1i [\<mapsto> \<sigma>']) \<approx> (cms\<^sub>2 ! i, ?mems\<^sub>2i [\<mapsto> \<sigma>'])"
[PROOF STATE]
proof (prove)
using this:
makes_compatible (cms\<^sub>1, mem\<^sub>1) (cms\<^sub>2, mem\<^sub>2) mems
dom \<sigma>' = differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i
i \<sqsubset> length cms\<^sub>1

goal (1 subgoal):
 1. (cms\<^sub>1 ! i, subst \<sigma>' (fst (mems ! i))) \<approx> (cms\<^sub>2 ! i, subst \<sigma>' (snd (mems ! i)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(cms\<^sub>1 ! i, subst \<sigma>' (fst (mems ! i))) \<approx> (cms\<^sub>2 ! i, subst \<sigma>' (snd (mems ! i)))

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
let ?\<Delta> = "differing_vars (?mems\<^sub>1i [\<mapsto> \<sigma>']) (?mems\<^sub>1'i [\<mapsto> \<sigma>]) \<union>
                  differing_vars (?mems\<^sub>2i [\<mapsto> \<sigma>']) (?mems\<^sub>2'i [\<mapsto> \<sigma>])"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
have \<Delta>_finite: "finite ?\<Delta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite (differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))))
[PROOF STEP]
by (metis (no_types) differing_finite finite_UnI)
        \<comment> \<open>We first define the adaptation, then prove that it does the right thing.\<close>
[PROOF STATE]
proof (state)
this:
finite (differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))))

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
define A where "A x =
                     (if x \<in> ?\<Delta>
                      then if dma x = High
                           then Some (?mems\<^sub>1'i [\<mapsto> \<sigma>] x, ?mems\<^sub>2'i [\<mapsto> \<sigma>] x)
                           else if x \<in> ?X' i
                                then (case \<sigma> x of
                                        Some v \<Rightarrow> Some (v, v)
                                      | None \<Rightarrow> None)
                                else Some (mem\<^sub>1' x, mem\<^sub>1' x)
                      else None)" for x
[PROOF STATE]
proof (state)
this:
A ?x = (if ?x \<in> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) then if dma ?x = High then Some (subst \<sigma> (fst (mems' ! i)) ?x, subst \<sigma> (snd (mems' ! i)) ?x) else if ?x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i then case \<sigma> ?x of None \<Rightarrow> None | Some v \<Rightarrow> Some (v, v) else Some (mem\<^sub>1' ?x, mem\<^sub>1' ?x) else None)

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
have domA: "dom A = ?\<Delta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dom A = differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. dom A \<subseteq> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i)))
 2. differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) \<subseteq> dom A
[PROOF STEP]
show "dom A \<subseteq> ?\<Delta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dom A \<subseteq> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
using A_def
[PROOF STATE]
proof (prove)
using this:
A ?x = (if ?x \<in> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) then if dma ?x = High then Some (subst \<sigma> (fst (mems' ! i)) ?x, subst \<sigma> (snd (mems' ! i)) ?x) else if ?x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i then case \<sigma> ?x of None \<Rightarrow> None | Some v \<Rightarrow> Some (v, v) else Some (mem\<^sub>1' ?x, mem\<^sub>1' ?x) else None)

goal (1 subgoal):
 1. dom A \<subseteq> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
apply (auto simp: domD)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x a b. \<lbrakk>\<And>x. A x = (if x \<in> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<or> x \<in> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) then if dma x = High then Some (subst \<sigma> (fst (mems' ! i)) x, subst \<sigma> (snd (mems' ! i)) x) else if x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i then case \<sigma> x of None \<Rightarrow> None | Some v \<Rightarrow> Some (v, v) else Some (mem\<^sub>1' x, mem\<^sub>1' x) else None); x \<notin> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))); (if x \<in> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) then if dma x = High then Some (subst \<sigma> (fst (mems' ! i)) x, subst \<sigma> (snd (mems' ! i)) x) else if x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i then case \<sigma> x of None \<Rightarrow> None | Some v \<Rightarrow> Some (v, v) else Some (mem\<^sub>1' x, mem\<^sub>1' x) else None) = Some (a, b)\<rbrakk> \<Longrightarrow> x \<in> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i)))
[PROOF STEP]
by (metis option.simps(2))
[PROOF STATE]
proof (state)
this:
dom A \<subseteq> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i)))

goal (1 subgoal):
 1. differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) \<subseteq> dom A
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) \<subseteq> dom A
[PROOF STEP]
show "?\<Delta> \<subseteq> dom A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) \<subseteq> dom A
[PROOF STEP]
unfolding A_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) \<subseteq> dom (\<lambda>x. if x \<in> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) then if dma x = High then Some (subst \<sigma> (fst (mems' ! i)) x, subst \<sigma> (snd (mems' ! i)) x) else if x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i then case \<sigma> x of None \<Rightarrow> None | Some v \<Rightarrow> Some (v, v) else Some (mem\<^sub>1' x, mem\<^sub>1' x) else None)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<in> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))); x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i; dma x \<noteq> High\<rbrakk> \<Longrightarrow> \<exists>a b. (case \<sigma> x of None \<Rightarrow> None | Some v \<Rightarrow> Some (v, v)) = Some (a, b)
 2. \<And>x. \<lbrakk>x \<in> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))); x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i; dma x \<noteq> High\<rbrakk> \<Longrightarrow> \<exists>a b. (case \<sigma> x of None \<Rightarrow> None | Some v \<Rightarrow> Some (v, v)) = Some (a, b)
[PROOF STEP]
apply (metis (no_types) domIff dom\<sigma> option.exhaust option.simps(5))
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))); x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i; dma x \<noteq> High\<rbrakk> \<Longrightarrow> \<exists>a b. (case \<sigma> x of None \<Rightarrow> None | Some v \<Rightarrow> Some (v, v)) = Some (a, b)
[PROOF STEP]
by (metis (no_types) domIff dom\<sigma> option.exhaust option.simps(5))
[PROOF STATE]
proof (state)
this:
differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) \<subseteq> dom A

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
dom A = differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i)))

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
have A_correct:
              "\<And> x.
               globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and>
               ?mems\<^sub>1i [\<mapsto> \<sigma>'] [\<parallel>\<^sub>1 A] x = ?mems\<^sub>1'i [\<mapsto> \<sigma>] x \<and>
               ?mems\<^sub>2i [\<mapsto> \<sigma>'] [\<parallel>\<^sub>2 A] x = ?mems\<^sub>2'i [\<mapsto> \<sigma>] x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
show "?thesis x"
            (is "?A \<and> ?Eq\<^sub>1 \<and> ?Eq\<^sub>2")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
proof (cases "x \<in> ?\<Delta>")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x \<in> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
 2. x \<notin> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
assume "x \<in> ?\<Delta>"
[PROOF STATE]
proof (state)
this:
x \<in> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i)))

goal (2 subgoals):
 1. x \<in> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
 2. x \<notin> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
hence diff:
              "?mems\<^sub>1'i [\<mapsto> \<sigma>] x \<noteq> ?mems\<^sub>1i [\<mapsto> \<sigma>'] x \<or> ?mems\<^sub>2'i [\<mapsto> \<sigma>] x \<noteq> ?mems\<^sub>2i [\<mapsto> \<sigma>'] x"
[PROOF STATE]
proof (prove)
using this:
x \<in> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i)))

goal (1 subgoal):
 1. subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x
[PROOF STEP]
by (auto simp: differing_vars_def)
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x

goal (2 subgoals):
 1. x \<in> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
 2. x \<notin> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
from p and diff
[PROOF STATE]
proof (chain)
picking this:
subst \<sigma> (fst (mems' ! i)) ?x5 \<noteq> subst \<sigma>' (fst (mems ! i)) ?x5 \<or> subst \<sigma> (snd (mems' ! i)) ?x5 \<noteq> subst \<sigma>' (snd (mems ! i)) ?x5 \<Longrightarrow> ?x5 \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x
[PROOF STEP]
have writable: "x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite"
[PROOF STATE]
proof (prove)
using this:
subst \<sigma> (fst (mems' ! i)) ?x5 \<noteq> subst \<sigma>' (fst (mems ! i)) ?x5 \<or> subst \<sigma> (snd (mems' ! i)) ?x5 \<noteq> subst \<sigma>' (snd (mems ! i)) ?x5 \<Longrightarrow> ?x5 \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
subst \<sigma> (fst (mems' ! i)) x \<noteq> subst \<sigma>' (fst (mems ! i)) x \<or> subst \<sigma> (snd (mems' ! i)) x \<noteq> subst \<sigma>' (snd (mems ! i)) x

goal (1 subgoal):
 1. x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite

goal (2 subgoals):
 1. x \<in> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
 2. x \<notin> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
proof (cases "dma x")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. dma x = High \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
 2. dma x = Low \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
assume "dma x = High"
[PROOF STATE]
proof (state)
this:
dma x = High

goal (2 subgoals):
 1. dma x = High \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
 2. dma x = Low \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
from \<open>dma x = High\<close>
[PROOF STATE]
proof (chain)
picking this:
dma x = High
[PROOF STEP]
have A_simp [simp]:
                "A x = Some (?mems\<^sub>1'i [\<mapsto> \<sigma>] x, ?mems\<^sub>2'i [\<mapsto> \<sigma>] x)"
[PROOF STATE]
proof (prove)
using this:
dma x = High

goal (1 subgoal):
 1. A x = Some (subst \<sigma> (fst (mems' ! i)) x, subst \<sigma> (snd (mems' ! i)) x)
[PROOF STEP]
unfolding A_def
[PROOF STATE]
proof (prove)
using this:
dma x = High

goal (1 subgoal):
 1. (if x \<in> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) then if dma x = High then Some (subst \<sigma> (fst (mems' ! i)) x, subst \<sigma> (snd (mems' ! i)) x) else if x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i then case \<sigma> x of None \<Rightarrow> None | Some v \<Rightarrow> Some (v, v) else Some (mem\<^sub>1' x, mem\<^sub>1' x) else None) = Some (subst \<sigma> (fst (mems' ! i)) x, subst \<sigma> (snd (mems' ! i)) x)
[PROOF STEP]
by (metis \<open>x \<in> ?\<Delta>\<close>)
[PROOF STATE]
proof (state)
this:
A x = Some (subst \<sigma> (fst (mems' ! i)) x, subst \<sigma> (snd (mems' ! i)) x)

goal (2 subgoals):
 1. dma x = High \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
 2. dma x = Low \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
from writable
[PROOF STATE]
proof (chain)
picking this:
x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
[PROOF STEP]
have "?A"
[PROOF STATE]
proof (prove)
using this:
x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite

goal (1 subgoal):
 1. globally_consistent_var A (snd (cms\<^sub>1 ! i)) x
[PROOF STEP]
unfolding globally_consistent_var_def A_simp
[PROOF STATE]
proof (prove)
using this:
x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite

goal (1 subgoal):
 1. case Some (subst \<sigma> (fst (mems' ! i)) x, subst \<sigma> (snd (mems' ! i)) x) of None \<Rightarrow> True | Some (v, v') \<Rightarrow> x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite \<and> (dma x = Low \<longrightarrow> v = v')
[PROOF STEP]
using \<open>dma x = High\<close>
[PROOF STATE]
proof (prove)
using this:
x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
dma x = High

goal (1 subgoal):
 1. case Some (subst \<sigma> (fst (mems' ! i)) x, subst \<sigma> (snd (mems' ! i)) x) of None \<Rightarrow> True | Some (v, v') \<Rightarrow> x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite \<and> (dma x = Low \<longrightarrow> v = v')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x

goal (2 subgoals):
 1. dma x = High \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
 2. dma x = Low \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x

goal (2 subgoals):
 1. dma x = High \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
 2. dma x = Low \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
from A_simp
[PROOF STATE]
proof (chain)
picking this:
A x = Some (subst \<sigma> (fst (mems' ! i)) x, subst \<sigma> (snd (mems' ! i)) x)
[PROOF STEP]
have ?Eq\<^sub>1 ?Eq\<^sub>2
[PROOF STATE]
proof (prove)
using this:
A x = Some (subst \<sigma> (fst (mems' ! i)) x, subst \<sigma> (snd (mems' ! i)) x)

goal (1 subgoal):
 1. subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x &&& subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
unfolding A_def apply_adaptation_def
[PROOF STATE]
proof (prove)
using this:
(if x \<in> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) then if dma x = High then Some (subst \<sigma> (fst (mems' ! i)) x, subst \<sigma> (snd (mems' ! i)) x) else if x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i then case \<sigma> x of None \<Rightarrow> None | Some v \<Rightarrow> Some (v, v) else Some (mem\<^sub>1' x, mem\<^sub>1' x) else None) = Some (subst \<sigma> (fst (mems' ! i)) x, subst \<sigma> (snd (mems' ! i)) x)

goal (1 subgoal):
 1. (case if x \<in> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) then if dma x = High then Some (subst \<sigma> (fst (mems' ! i)) x, subst \<sigma> (snd (mems' ! i)) x) else if x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i then case \<sigma> x of None \<Rightarrow> None | Some v \<Rightarrow> Some (v, v) else Some (mem\<^sub>1' x, mem\<^sub>1' x) else None of None \<Rightarrow> subst \<sigma>' (fst (mems ! i)) x | Some (xa, xb) \<Rightarrow> if True then xa else xb) = subst \<sigma> (fst (mems' ! i)) x &&& (case if x \<in> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) then if dma x = High then Some (subst \<sigma> (fst (mems' ! i)) x, subst \<sigma> (snd (mems' ! i)) x) else if x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i then case \<sigma> x of None \<Rightarrow> None | Some v \<Rightarrow> Some (v, v) else Some (mem\<^sub>1' x, mem\<^sub>1' x) else None of None \<Rightarrow> subst \<sigma>' (snd (mems ! i)) x | Some (xa, xb) \<Rightarrow> if False then xa else xb) = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x
subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x

goal (2 subgoals):
 1. dma x = High \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
 2. dma x = Low \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x
subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x
subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x
subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x
subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x

goal (1 subgoal):
 1. globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x

goal (1 subgoal):
 1. dma x = Low \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. dma x = Low \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
assume "dma x = Low"
[PROOF STATE]
proof (state)
this:
dma x = Low

goal (1 subgoal):
 1. dma x = Low \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
proof (cases "x \<in> ?X' i")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
assume "x \<in> ?X' i"
[PROOF STATE]
proof (state)
this:
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
obtain v where "\<sigma> x = Some v"
[PROOF STATE]
proof (prove)
using this:
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. (\<And>v. \<sigma> x = Some v \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis domD dom\<sigma>)
[PROOF STATE]
proof (state)
this:
\<sigma> x = Some v

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
hence eq: "?mems\<^sub>1'i [\<mapsto> \<sigma>] x = v \<and> ?mems\<^sub>2'i [\<mapsto> \<sigma>] x = v"
[PROOF STATE]
proof (prove)
using this:
\<sigma> x = Some v

goal (1 subgoal):
 1. subst \<sigma> (fst (mems' ! i)) x = v \<and> subst \<sigma> (snd (mems' ! i)) x = v
[PROOF STEP]
unfolding subst_def
[PROOF STATE]
proof (prove)
using this:
\<sigma> x = Some v

goal (1 subgoal):
 1. (case \<sigma> x of None \<Rightarrow> fst (mems' ! i) x | Some v \<Rightarrow> v) = v \<and> (case \<sigma> x of None \<Rightarrow> snd (mems' ! i) x | Some v \<Rightarrow> v) = v
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) x = v \<and> subst \<sigma> (snd (mems' ! i)) x = v

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) x = v \<and> subst \<sigma> (snd (mems' ! i)) x = v

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
from \<open>x \<in> ?X' i\<close> and \<open>dma x = Low\<close>
[PROOF STATE]
proof (chain)
picking this:
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
dma x = Low
[PROOF STEP]
have A_simp [simp]:
                  "A x = (case \<sigma> x of
                            Some v \<Rightarrow> Some (v, v)
                          | None \<Rightarrow> None)"
[PROOF STATE]
proof (prove)
using this:
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
dma x = Low

goal (1 subgoal):
 1. A x = (case \<sigma> x of None \<Rightarrow> None | Some v \<Rightarrow> Some (v, v))
[PROOF STEP]
unfolding A_def
[PROOF STATE]
proof (prove)
using this:
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
dma x = Low

goal (1 subgoal):
 1. (if x \<in> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) then if dma x = High then Some (subst \<sigma> (fst (mems' ! i)) x, subst \<sigma> (snd (mems' ! i)) x) else if x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i then case \<sigma> x of None \<Rightarrow> None | Some v \<Rightarrow> Some (v, v) else Some (mem\<^sub>1' x, mem\<^sub>1' x) else None) = (case \<sigma> x of None \<Rightarrow> None | Some v \<Rightarrow> Some (v, v))
[PROOF STEP]
by (metis Sec.simps(1) \<open>x \<in> ?\<Delta>\<close>)
[PROOF STATE]
proof (state)
this:
A x = (case \<sigma> x of None \<Rightarrow> None | Some v \<Rightarrow> Some (v, v))

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
with writable eq \<open>\<sigma> x = Some v\<close>
[PROOF STATE]
proof (chain)
picking this:
x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
subst \<sigma> (fst (mems' ! i)) x = v \<and> subst \<sigma> (snd (mems' ! i)) x = v
\<sigma> x = Some v
A x = (case \<sigma> x of None \<Rightarrow> None | Some v \<Rightarrow> Some (v, v))
[PROOF STEP]
have "?A"
[PROOF STATE]
proof (prove)
using this:
x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
subst \<sigma> (fst (mems' ! i)) x = v \<and> subst \<sigma> (snd (mems' ! i)) x = v
\<sigma> x = Some v
A x = (case \<sigma> x of None \<Rightarrow> None | Some v \<Rightarrow> Some (v, v))

goal (1 subgoal):
 1. globally_consistent_var A (snd (cms\<^sub>1 ! i)) x
[PROOF STEP]
unfolding globally_consistent_var_def
[PROOF STATE]
proof (prove)
using this:
x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
subst \<sigma> (fst (mems' ! i)) x = v \<and> subst \<sigma> (snd (mems' ! i)) x = v
\<sigma> x = Some v
A x = (case \<sigma> x of None \<Rightarrow> None | Some v \<Rightarrow> Some (v, v))

goal (1 subgoal):
 1. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite \<and> (dma x = Low \<longrightarrow> v = v')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x

goal (2 subgoals):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
 2. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
subst \<sigma> (fst (mems' ! i)) x = v \<and> subst \<sigma> (snd (mems' ! i)) x = v
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
subst \<sigma> (fst (mems' ! i)) x = v \<and> subst \<sigma> (snd (mems' ! i)) x = v
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x

goal (1 subgoal):
 1. globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
using domA \<open>x \<in> ?\<Delta>\<close> \<open>\<sigma> x = Some v\<close>
[PROOF STATE]
proof (prove)
using this:
subst \<sigma> (fst (mems' ! i)) x = v \<and> subst \<sigma> (snd (mems' ! i)) x = v
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x
dom A = differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i)))
x \<in> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i)))
\<sigma> x = Some v

goal (1 subgoal):
 1. globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
by (auto simp: apply_adaptation_def)
[PROOF STATE]
proof (state)
this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
assume "x \<notin> ?X' i"
[PROOF STATE]
proof (state)
this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
hence A_simp [simp]: "A x = Some (mem\<^sub>1' x, mem\<^sub>1' x)"
[PROOF STATE]
proof (prove)
using this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. A x = Some (mem\<^sub>1' x, mem\<^sub>1' x)
[PROOF STEP]
unfolding A_def
[PROOF STATE]
proof (prove)
using this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. (if x \<in> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) then if dma x = High then Some (subst \<sigma> (fst (mems' ! i)) x, subst \<sigma> (snd (mems' ! i)) x) else if x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i then case \<sigma> x of None \<Rightarrow> None | Some v \<Rightarrow> Some (v, v) else Some (mem\<^sub>1' x, mem\<^sub>1' x) else None) = Some (mem\<^sub>1' x, mem\<^sub>1' x)
[PROOF STEP]
using \<open>x \<in> ?\<Delta>\<close> \<open>dma x = Low\<close>
[PROOF STATE]
proof (prove)
using this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
x \<in> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i)))
dma x = Low

goal (1 subgoal):
 1. (if x \<in> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) then if dma x = High then Some (subst \<sigma> (fst (mems' ! i)) x, subst \<sigma> (snd (mems' ! i)) x) else if x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i then case \<sigma> x of None \<Rightarrow> None | Some v \<Rightarrow> Some (v, v) else Some (mem\<^sub>1' x, mem\<^sub>1' x) else None) = Some (mem\<^sub>1' x, mem\<^sub>1' x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
A x = Some (mem\<^sub>1' x, mem\<^sub>1' x)

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
from q
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>dma ?x5 = Low; subst \<sigma> (fst (mems' ! i)) ?x5 \<noteq> subst \<sigma>' (fst (mems ! i)) ?x5 \<or> subst \<sigma> (snd (mems' ! i)) ?x5 \<noteq> subst \<sigma>' (snd (mems ! i)) ?x5; ?x5 \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i\<rbrakk> \<Longrightarrow> mem\<^sub>1' ?x5 = mem\<^sub>2' ?x5
[PROOF STEP]
have "mem\<^sub>1' x = mem\<^sub>2' x"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>dma ?x5 = Low; subst \<sigma> (fst (mems' ! i)) ?x5 \<noteq> subst \<sigma>' (fst (mems ! i)) ?x5 \<or> subst \<sigma> (snd (mems' ! i)) ?x5 \<noteq> subst \<sigma>' (snd (mems ! i)) ?x5; ?x5 \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i\<rbrakk> \<Longrightarrow> mem\<^sub>1' ?x5 = mem\<^sub>2' ?x5

goal (1 subgoal):
 1. mem\<^sub>1' x = mem\<^sub>2' x
[PROOF STEP]
by (metis \<open>dma x = Low\<close> diff \<open>x \<notin> ?X' i\<close>)
[PROOF STATE]
proof (state)
this:
mem\<^sub>1' x = mem\<^sub>2' x

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
with writable
[PROOF STATE]
proof (chain)
picking this:
x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
mem\<^sub>1' x = mem\<^sub>2' x
[PROOF STEP]
have ?A
[PROOF STATE]
proof (prove)
using this:
x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
mem\<^sub>1' x = mem\<^sub>2' x

goal (1 subgoal):
 1. globally_consistent_var A (snd (cms\<^sub>1 ! i)) x
[PROOF STEP]
unfolding globally_consistent_var_def
[PROOF STATE]
proof (prove)
using this:
x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite
mem\<^sub>1' x = mem\<^sub>2' x

goal (1 subgoal):
 1. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> x \<notin> snd (cms\<^sub>1 ! i) AsmNoWrite \<and> (dma x = Low \<longrightarrow> v = v')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
from \<open>x \<notin> ?X' i\<close>
[PROOF STATE]
proof (chain)
picking this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
have
                  "?mems\<^sub>1'i [\<mapsto> \<sigma>] x = ?mems\<^sub>1'i x \<and> ?mems\<^sub>2'i [\<mapsto> \<sigma>] x = ?mems\<^sub>2'i x"
[PROOF STATE]
proof (prove)
using this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. subst \<sigma> (fst (mems' ! i)) x = fst (mems' ! i) x \<and> subst \<sigma> (snd (mems' ! i)) x = snd (mems' ! i) x
[PROOF STEP]
by (metis dom\<sigma> subst_not_in_dom)
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) x = fst (mems' ! i) x \<and> subst \<sigma> (snd (mems' ! i)) x = snd (mems' ! i) x

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
subst \<sigma> (fst (mems' ! i)) x = fst (mems' ! i) x \<and> subst \<sigma> (snd (mems' ! i)) x = snd (mems' ! i) x

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
from \<open>x \<notin> ?X' i\<close>
[PROOF STATE]
proof (chain)
picking this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
have "?mems\<^sub>1'i x = mem\<^sub>1' x \<and> ?mems\<^sub>2'i x = mem\<^sub>2' x"
[PROOF STATE]
proof (prove)
using this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. fst (mems' ! i) x = mem\<^sub>1' x \<and> snd (mems' ! i) x = mem\<^sub>2' x
[PROOF STEP]
by (metis differing_vars_neg)
[PROOF STATE]
proof (state)
this:
fst (mems' ! i) x = mem\<^sub>1' x \<and> snd (mems' ! i) x = mem\<^sub>2' x

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x
subst \<sigma> (fst (mems' ! i)) x = fst (mems' ! i) x \<and> subst \<sigma> (snd (mems' ! i)) x = snd (mems' ! i) x
fst (mems' ! i) x = mem\<^sub>1' x \<and> snd (mems' ! i) x = mem\<^sub>2' x
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x
subst \<sigma> (fst (mems' ! i)) x = fst (mems' ! i) x \<and> subst \<sigma> (snd (mems' ! i)) x = snd (mems' ! i) x
fst (mems' ! i) x = mem\<^sub>1' x \<and> snd (mems' ! i) x = mem\<^sub>2' x

goal (1 subgoal):
 1. globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
using \<open>mem\<^sub>1' x = mem\<^sub>2' x\<close>
[PROOF STATE]
proof (prove)
using this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x
subst \<sigma> (fst (mems' ! i)) x = fst (mems' ! i) x \<and> subst \<sigma> (snd (mems' ! i)) x = snd (mems' ! i) x
fst (mems' ! i) x = mem\<^sub>1' x \<and> snd (mems' ! i) x = mem\<^sub>2' x
mem\<^sub>1' x = mem\<^sub>2' x

goal (1 subgoal):
 1. globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
by (auto simp: apply_adaptation_def)
[PROOF STATE]
proof (state)
this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x

goal (1 subgoal):
 1. x \<notin> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. x \<notin> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
assume "x \<notin> ?\<Delta>"
[PROOF STATE]
proof (state)
this:
x \<notin> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i)))

goal (1 subgoal):
 1. x \<notin> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
hence "A x = None"
[PROOF STATE]
proof (prove)
using this:
x \<notin> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i)))

goal (1 subgoal):
 1. A x = None
[PROOF STEP]
by (metis domA domIff)
[PROOF STATE]
proof (state)
this:
A x = None

goal (1 subgoal):
 1. x \<notin> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
hence "globally_consistent_var A (snd (cms\<^sub>1 ! i)) x"
[PROOF STATE]
proof (prove)
using this:
A x = None

goal (1 subgoal):
 1. globally_consistent_var A (snd (cms\<^sub>1 ! i)) x
[PROOF STEP]
by (auto simp: globally_consistent_var_def)
[PROOF STATE]
proof (state)
this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x

goal (1 subgoal):
 1. x \<notin> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x

goal (1 subgoal):
 1. x \<notin> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
from \<open>A x = None\<close>
[PROOF STATE]
proof (chain)
picking this:
A x = None
[PROOF STEP]
have "x \<notin> dom A"
[PROOF STATE]
proof (prove)
using this:
A x = None

goal (1 subgoal):
 1. x \<notin> dom A
[PROOF STEP]
by (metis domIff)
[PROOF STATE]
proof (state)
this:
x \<notin> dom A

goal (1 subgoal):
 1. x \<notin> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
from \<open>x \<notin> ?\<Delta>\<close>
[PROOF STATE]
proof (chain)
picking this:
x \<notin> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
have "?mems\<^sub>1i [\<mapsto> \<sigma>'] [\<parallel>\<^sub>1 A] x = ?mems\<^sub>1'i [\<mapsto> \<sigma>] x \<and>
                                 ?mems\<^sub>2i [\<mapsto> \<sigma>'] [\<parallel>\<^sub>2 A] x = ?mems\<^sub>2'i [\<mapsto> \<sigma>] x"
[PROOF STATE]
proof (prove)
using this:
x \<notin> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i)))

goal (1 subgoal):
 1. subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
using \<open>A x = None\<close>
[PROOF STATE]
proof (prove)
using this:
x \<notin> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i)))
A x = None

goal (1 subgoal):
 1. subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
unfolding differing_vars_def apply_adaptation_def
[PROOF STATE]
proof (prove)
using this:
x \<notin> {x. subst \<sigma>' (fst (mems ! i)) x \<noteq> subst \<sigma> (fst (mems' ! i)) x} \<union> {x. subst \<sigma>' (snd (mems ! i)) x \<noteq> subst \<sigma> (snd (mems' ! i)) x}
A x = None

goal (1 subgoal):
 1. (case A x of None \<Rightarrow> subst \<sigma>' (fst (mems ! i)) x | Some (xa, xb) \<Rightarrow> if True then xa else xb) = subst \<sigma> (fst (mems' ! i)) x \<and> (case A x of None \<Rightarrow> subst \<sigma>' (snd (mems ! i)) x | Some (xa, xb) \<Rightarrow> if False then xa else xb) = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x

goal (1 subgoal):
 1. x \<notin> differing_vars (subst \<sigma>' (fst (mems ! i))) (subst \<sigma> (fst (mems' ! i))) \<union> differing_vars (subst \<sigma>' (snd (mems ! i))) (subst \<sigma> (snd (mems' ! i))) \<Longrightarrow> globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x
subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x
subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x

goal (1 subgoal):
 1. globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) x \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] x = subst \<sigma> (fst (mems' ! i)) x \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] x = subst \<sigma> (snd (mems' ! i)) x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) ?x5 \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] ?x5 = subst \<sigma> (fst (mems' ! i)) ?x5 \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] ?x5 = subst \<sigma> (snd (mems' ! i)) ?x5

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
hence "?mems\<^sub>1i [\<mapsto> \<sigma>'] [\<parallel>\<^sub>1 A] = ?mems\<^sub>1'i [\<mapsto> \<sigma>] \<and>
               ?mems\<^sub>2i [\<mapsto> \<sigma>'] [\<parallel>\<^sub>2 A] = ?mems\<^sub>2'i [\<mapsto> \<sigma>]"
[PROOF STATE]
proof (prove)
using this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) ?x5 \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] ?x5 = subst \<sigma> (fst (mems' ! i)) ?x5 \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] ?x5 = subst \<sigma> (snd (mems' ! i)) ?x5

goal (1 subgoal):
 1. subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] = subst \<sigma> (fst (mems' ! i)) \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] = subst \<sigma> (snd (mems' ! i))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] = subst \<sigma> (fst (mems' ! i)) \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] = subst \<sigma> (snd (mems' ! i))

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] = subst \<sigma> (fst (mems' ! i)) \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] = subst \<sigma> (snd (mems' ! i))

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
from A_correct
[PROOF STATE]
proof (chain)
picking this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) ?x5 \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] ?x5 = subst \<sigma> (fst (mems' ! i)) ?x5 \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] ?x5 = subst \<sigma> (snd (mems' ! i)) ?x5
[PROOF STEP]
have "globally_consistent A (snd (cms\<^sub>1 ! i))"
[PROOF STATE]
proof (prove)
using this:
globally_consistent_var A (snd (cms\<^sub>1 ! i)) ?x5 \<and> subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] ?x5 = subst \<sigma> (fst (mems' ! i)) ?x5 \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] ?x5 = subst \<sigma> (snd (mems' ! i)) ?x5

goal (1 subgoal):
 1. globally_consistent A (snd (cms\<^sub>1 ! i))
[PROOF STEP]
by (metis \<Delta>_finite globally_consistent_def domA)
[PROOF STATE]
proof (state)
this:
globally_consistent A (snd (cms\<^sub>1 ! i))

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
have "snd (cms\<^sub>1 ! i) = snd (cms\<^sub>2 ! i)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd (cms\<^sub>1 ! i) = snd (cms\<^sub>2 ! i)
[PROOF STEP]
by (metis \<open>i < length cms\<^sub>1\<close> equal_size modes_eq nth_map)
[PROOF STATE]
proof (state)
this:
snd (cms\<^sub>1 ! i) = snd (cms\<^sub>2 ! i)

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
with bisim
[PROOF STATE]
proof (chain)
picking this:
(cms\<^sub>1 ! i, subst \<sigma>' (fst (mems ! i))) \<approx> (cms\<^sub>2 ! i, subst \<sigma>' (snd (mems ! i)))
snd (cms\<^sub>1 ! i) = snd (cms\<^sub>2 ! i)
[PROOF STEP]
have "(cms\<^sub>1 ! i, ?mems\<^sub>1i [\<mapsto> \<sigma>'] [\<parallel>\<^sub>1 A]) \<approx> (cms\<^sub>2 ! i, ?mems\<^sub>2i [\<mapsto> \<sigma>'] [\<parallel>\<^sub>2 A])"
[PROOF STATE]
proof (prove)
using this:
(cms\<^sub>1 ! i, subst \<sigma>' (fst (mems ! i))) \<approx> (cms\<^sub>2 ! i, subst \<sigma>' (snd (mems ! i)))
snd (cms\<^sub>1 ! i) = snd (cms\<^sub>2 ! i)

goal (1 subgoal):
 1. (cms\<^sub>1 ! i, subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A]) \<approx> (cms\<^sub>2 ! i, subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A])
[PROOF STEP]
using \<open>globally_consistent A (snd (cms\<^sub>1 ! i))\<close>
[PROOF STATE]
proof (prove)
using this:
(cms\<^sub>1 ! i, subst \<sigma>' (fst (mems ! i))) \<approx> (cms\<^sub>2 ! i, subst \<sigma>' (snd (mems ! i)))
snd (cms\<^sub>1 ! i) = snd (cms\<^sub>2 ! i)
globally_consistent A (snd (cms\<^sub>1 ! i))

goal (1 subgoal):
 1. (cms\<^sub>1 ! i, subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A]) \<approx> (cms\<^sub>2 ! i, subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A])
[PROOF STEP]
apply (subst surjective_pairing[of "cms\<^sub>1 ! i"])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(cms\<^sub>1 ! i, subst \<sigma>' (fst (mems ! i))) \<approx> (cms\<^sub>2 ! i, subst \<sigma>' (snd (mems ! i))); snd (cms\<^sub>1 ! i) = snd (cms\<^sub>2 ! i); globally_consistent A (snd (cms\<^sub>1 ! i))\<rbrakk> \<Longrightarrow> \<langle>fst (cms\<^sub>1 ! i), snd (cms\<^sub>1 ! i), subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A]\<rangle> \<approx> (cms\<^sub>2 ! i, subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A])
[PROOF STEP]
apply (subst surjective_pairing[of "cms\<^sub>2 ! i"])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(cms\<^sub>1 ! i, subst \<sigma>' (fst (mems ! i))) \<approx> (cms\<^sub>2 ! i, subst \<sigma>' (snd (mems ! i))); snd (cms\<^sub>1 ! i) = snd (cms\<^sub>2 ! i); globally_consistent A (snd (cms\<^sub>1 ! i))\<rbrakk> \<Longrightarrow> \<langle>fst (cms\<^sub>1 ! i), snd (cms\<^sub>1 ! i), subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A]\<rangle> \<approx> \<langle>fst (cms\<^sub>2 ! i), snd (cms\<^sub>2 ! i), subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A]\<rangle>
[PROOF STEP]
by (metis surjective_pairing globally_consistent_adapt_bisim)
[PROOF STATE]
proof (state)
this:
(cms\<^sub>1 ! i, subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A]) \<approx> (cms\<^sub>2 ! i, subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A])

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] = subst \<sigma> (fst (mems' ! i)) \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] = subst \<sigma> (snd (mems' ! i))
(cms\<^sub>1 ! i, subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A]) \<approx> (cms\<^sub>2 ! i, subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A])
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A] = subst \<sigma> (fst (mems' ! i)) \<and> subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A] = subst \<sigma> (snd (mems' ! i))
(cms\<^sub>1 ! i, subst \<sigma>' (fst (mems ! i)) [\<parallel>\<^sub>1 A]) \<approx> (cms\<^sub>2 ! i, subst \<sigma>' (snd (mems ! i)) [\<parallel>\<^sub>2 A])

goal (1 subgoal):
 1. (cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))
[PROOF STEP]
by (metis \<open>i \<noteq> k\<close> b cms\<^sub>2'_def nth_list_update_neq)
[PROOF STATE]
proof (state)
this:
(cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(cms\<^sub>1' ! i, subst \<sigma> (fst (mems' ! i))) \<approx> (cms\<^sub>2' ! i, subst \<sigma> (snd (mems' ! i)))

goal (2 subgoals):
 1. \<And>i x. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 2. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>i x. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 2. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
fix i x
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>i x. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 2. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
let ?mems\<^sub>1'i = "fst (mems' ! i)"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>i x. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 2. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
let ?mems\<^sub>2'i = "snd (mems' ! i)"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>i x. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 2. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
assume i_le: "i < length cms\<^sub>1'"
[PROOF STATE]
proof (state)
this:
i \<sqsubset> length cms\<^sub>1'

goal (2 subgoals):
 1. \<And>i x. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 2. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
assume mem_eq: "mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High"
[PROOF STATE]
proof (state)
this:
mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High

goal (2 subgoals):
 1. \<And>i x. \<lbrakk>i \<sqsubset> length cms\<^sub>1'; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 2. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
show "x \<notin> ?X' i"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
proof (cases "i = k")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. i = k \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 2. i \<noteq> k \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
assume "i = k"
[PROOF STATE]
proof (state)
this:
i = k

goal (2 subgoals):
 1. i = k \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 2. i \<noteq> k \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
thus "x \<notin> ?X' i"
[PROOF STATE]
proof (prove)
using this:
i = k

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
apply (cases "x \<notin> ?X k \<or> x \<notin> dom_g1 \<or> x \<notin> dom_g2")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>i = k; x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<or> x \<notin> dom_g1 \<or> x \<notin> dom_g2\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 2. \<lbrakk>i = k; \<not> (x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<or> x \<notin> dom_g1 \<or> x \<notin> dom_g2)\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
apply (metis differing_vars_neg_intro mems'_k_1 mems'_k_2)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>i = k; \<not> (x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<or> x \<notin> dom_g1 \<or> x \<notin> dom_g2)\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
by (metis Sec.simps(2) b compat compat_different mem_eq x_unchanged)
[PROOF STATE]
proof (state)
this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
assume "i \<noteq> k"
[PROOF STATE]
proof (state)
this:
i \<noteq> k

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
thus "x \<notin> ?X' i"
[PROOF STATE]
proof (prove)
using this:
i \<noteq> k

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
proof (rule mems'_i_cases)
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. i \<sqsubset> length cms\<^sub>1
 2. \<lbrakk>mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High; fst (mems' ! i) x = mem\<^sub>1' x; snd (mems' ! i) x = mem\<^sub>2' x\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 3. \<lbrakk>mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x; mem\<^sub>1' x \<noteq> mem\<^sub>2' x; dma x = Low; fst (mems' ! i) x = some_val; snd (mems' ! i) x = some_val\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 4. \<lbrakk>mem\<^sub>1 x = mem\<^sub>1' x; mem\<^sub>2 x = mem\<^sub>2' x; fst (mems' ! i) x = fst (mems ! i) x; snd (mems' ! i) x = snd (mems ! i) x\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
from b i_le
[PROOF STATE]
proof (chain)
picking this:
k \<sqsubset> length cms\<^sub>1 \<and> (cms\<^sub>1 ! k, mem\<^sub>1) \<leadsto> (cms\<^sub>1' ! k, mem\<^sub>1') \<and> cms\<^sub>1' = cms\<^sub>1[k := cms\<^sub>1' ! k]
i \<sqsubset> length cms\<^sub>1'
[PROOF STEP]
show "i < length cms\<^sub>1"
[PROOF STATE]
proof (prove)
using this:
k \<sqsubset> length cms\<^sub>1 \<and> (cms\<^sub>1 ! k, mem\<^sub>1) \<leadsto> (cms\<^sub>1' ! k, mem\<^sub>1') \<and> cms\<^sub>1' = cms\<^sub>1[k := cms\<^sub>1' ! k]
i \<sqsubset> length cms\<^sub>1'

goal (1 subgoal):
 1. i \<sqsubset> length cms\<^sub>1
[PROOF STEP]
by (metis length_list_update)
[PROOF STATE]
proof (state)
this:
i \<sqsubset> length cms\<^sub>1

goal (3 subgoals):
 1. \<lbrakk>mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High; fst (mems' ! i) x = mem\<^sub>1' x; snd (mems' ! i) x = mem\<^sub>2' x\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 2. \<lbrakk>mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x; mem\<^sub>1' x \<noteq> mem\<^sub>2' x; dma x = Low; fst (mems' ! i) x = some_val; snd (mems' ! i) x = some_val\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 3. \<lbrakk>mem\<^sub>1 x = mem\<^sub>1' x; mem\<^sub>2 x = mem\<^sub>2' x; fst (mems' ! i) x = fst (mems ! i) x; snd (mems' ! i) x = snd (mems ! i) x\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<lbrakk>mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High; fst (mems' ! i) x = mem\<^sub>1' x; snd (mems' ! i) x = mem\<^sub>2' x\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 2. \<lbrakk>mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x; mem\<^sub>1' x \<noteq> mem\<^sub>2' x; dma x = Low; fst (mems' ! i) x = some_val; snd (mems' ! i) x = some_val\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 3. \<lbrakk>mem\<^sub>1 x = mem\<^sub>1' x; mem\<^sub>2 x = mem\<^sub>2' x; fst (mems' ! i) x = fst (mems ! i) x; snd (mems' ! i) x = snd (mems ! i) x\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
assume "fst (mems' ! i) x = mem\<^sub>1' x"
            "snd (mems' ! i) x = mem\<^sub>2' x"
[PROOF STATE]
proof (state)
this:
fst (mems' ! i) x = mem\<^sub>1' x
snd (mems' ! i) x = mem\<^sub>2' x

goal (3 subgoals):
 1. \<lbrakk>mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x; mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High; fst (mems' ! i) x = mem\<^sub>1' x; snd (mems' ! i) x = mem\<^sub>2' x\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 2. \<lbrakk>mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x; mem\<^sub>1' x \<noteq> mem\<^sub>2' x; dma x = Low; fst (mems' ! i) x = some_val; snd (mems' ! i) x = some_val\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 3. \<lbrakk>mem\<^sub>1 x = mem\<^sub>1' x; mem\<^sub>2 x = mem\<^sub>2' x; fst (mems' ! i) x = fst (mems ! i) x; snd (mems' ! i) x = snd (mems ! i) x\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
thus "x \<notin> ?X' i"
[PROOF STATE]
proof (prove)
using this:
fst (mems' ! i) x = mem\<^sub>1' x
snd (mems' ! i) x = mem\<^sub>2' x

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
by (metis differing_vars_neg_intro)
[PROOF STATE]
proof (state)
this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (2 subgoals):
 1. \<lbrakk>mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x; mem\<^sub>1' x \<noteq> mem\<^sub>2' x; dma x = Low; fst (mems' ! i) x = some_val; snd (mems' ! i) x = some_val\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 2. \<lbrakk>mem\<^sub>1 x = mem\<^sub>1' x; mem\<^sub>2 x = mem\<^sub>2' x; fst (mems' ! i) x = fst (mems ! i) x; snd (mems' ! i) x = snd (mems ! i) x\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x; mem\<^sub>1' x \<noteq> mem\<^sub>2' x; dma x = Low; fst (mems' ! i) x = some_val; snd (mems' ! i) x = some_val\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 2. \<lbrakk>mem\<^sub>1 x = mem\<^sub>1' x; mem\<^sub>2 x = mem\<^sub>2' x; fst (mems' ! i) x = fst (mems ! i) x; snd (mems' ! i) x = snd (mems ! i) x\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
assume "mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x"
            "mem\<^sub>1' x \<noteq> mem\<^sub>2' x" and "dma x = Low"
          \<comment> \<open>In this case, for example, the values of (mems' ! i) are not needed.\<close>
[PROOF STATE]
proof (state)
this:
mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x
mem\<^sub>1' x \<noteq> mem\<^sub>2' x
dma x = Low

goal (2 subgoals):
 1. \<lbrakk>mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x; mem\<^sub>1' x \<noteq> mem\<^sub>2' x; dma x = Low; fst (mems' ! i) x = some_val; snd (mems' ! i) x = some_val\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 2. \<lbrakk>mem\<^sub>1 x = mem\<^sub>1' x; mem\<^sub>2 x = mem\<^sub>2' x; fst (mems' ! i) x = fst (mems ! i) x; snd (mems' ! i) x = snd (mems ! i) x\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
thus "x \<notin> ?X' i"
[PROOF STATE]
proof (prove)
using this:
mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x
mem\<^sub>1' x \<noteq> mem\<^sub>2' x
dma x = Low

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
by (metis Sec.simps(2) mem_eq)
[PROOF STATE]
proof (state)
this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. \<lbrakk>mem\<^sub>1 x = mem\<^sub>1' x; mem\<^sub>2 x = mem\<^sub>2' x; fst (mems' ! i) x = fst (mems ! i) x; snd (mems' ! i) x = snd (mems ! i) x\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>mem\<^sub>1 x = mem\<^sub>1' x; mem\<^sub>2 x = mem\<^sub>2' x; fst (mems' ! i) x = fst (mems ! i) x; snd (mems' ! i) x = snd (mems ! i) x\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
assume case3: "mem\<^sub>1 x = mem\<^sub>1' x" "mem\<^sub>2 x = mem\<^sub>2' x"
            "fst (mems' ! i) x = fst (mems ! i) x"
            "snd (mems' ! i) x = snd (mems ! i) x"
[PROOF STATE]
proof (state)
this:
mem\<^sub>1 x = mem\<^sub>1' x
mem\<^sub>2 x = mem\<^sub>2' x
fst (mems' ! i) x = fst (mems ! i) x
snd (mems' ! i) x = snd (mems ! i) x

goal (1 subgoal):
 1. \<lbrakk>mem\<^sub>1 x = mem\<^sub>1' x; mem\<^sub>2 x = mem\<^sub>2' x; fst (mems' ! i) x = fst (mems ! i) x; snd (mems' ! i) x = snd (mems ! i) x\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
have "x \<in> ?X' i \<Longrightarrow> mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low
[PROOF STEP]
assume "x \<in> ?X' i"
[PROOF STATE]
proof (state)
this:
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low
[PROOF STEP]
from case3 and \<open>x \<in> ?X' i\<close>
[PROOF STATE]
proof (chain)
picking this:
mem\<^sub>1 x = mem\<^sub>1' x
mem\<^sub>2 x = mem\<^sub>2' x
fst (mems' ! i) x = fst (mems ! i) x
snd (mems' ! i) x = snd (mems ! i) x
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
have "x \<in> ?X i"
[PROOF STATE]
proof (prove)
using this:
mem\<^sub>1 x = mem\<^sub>1' x
mem\<^sub>2 x = mem\<^sub>2' x
fst (mems' ! i) x = fst (mems ! i) x
snd (mems' ! i) x = snd (mems ! i) x
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i
[PROOF STEP]
by (metis differing_vars_neg differing_vars_elim)
[PROOF STATE]
proof (state)
this:
x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i

goal (1 subgoal):
 1. x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low
[PROOF STEP]
with case3
[PROOF STATE]
proof (chain)
picking this:
mem\<^sub>1 x = mem\<^sub>1' x
mem\<^sub>2 x = mem\<^sub>2' x
fst (mems' ! i) x = fst (mems ! i) x
snd (mems' ! i) x = snd (mems ! i) x
x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
mem\<^sub>1 x = mem\<^sub>1' x
mem\<^sub>2 x = mem\<^sub>2' x
fst (mems' ! i) x = fst (mems ! i) x
snd (mems' ! i) x = snd (mems ! i) x
x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i

goal (1 subgoal):
 1. mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low
[PROOF STEP]
by (metis b compat compat_different i_le length_list_update)
[PROOF STATE]
proof (state)
this:
mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low

goal (1 subgoal):
 1. \<lbrakk>mem\<^sub>1 x = mem\<^sub>1' x; mem\<^sub>2 x = mem\<^sub>2' x; fst (mems' ! i) x = fst (mems ! i) x; snd (mems' ! i) x = snd (mems ! i) x\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
with \<open>mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High\<close>
[PROOF STATE]
proof (chain)
picking this:
mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low
[PROOF STEP]
show "x \<notin> ?X' i"
[PROOF STATE]
proof (prove)
using this:
mem\<^sub>1' x = mem\<^sub>2' x \<or> dma x = High
x \<in> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i \<Longrightarrow> mem\<^sub>1' x \<noteq> mem\<^sub>2' x \<and> dma x = Low

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
have "\<exists> i < length cms\<^sub>1. x \<notin> ?X' i"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
proof (cases "mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 2. \<not> (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
assume var_changed: "mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x"
[PROOF STATE]
proof (state)
this:
mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x

goal (2 subgoals):
 1. mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 2. \<not> (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
have "x \<notin> ?X' k"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k
[PROOF STEP]
apply (rule mems'_k_cases)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<or> x \<notin> dom_g1 \<or> x \<notin> dom_g2; fst (mems' ! k) x = mem\<^sub>1' x; snd (mems' ! k) x = mem\<^sub>2' x\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k
 2. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2; fst (mems' ! k) x = fst (mems ! k) x; snd (mems' ! k) x = snd (mems ! k) x\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k
[PROOF STEP]
apply (metis differing_vars_neg_intro)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2; fst (mems' ! k) x = fst (mems ! k) x; snd (mems' ! k) x = snd (mems ! k) x\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k
[PROOF STEP]
by (metis var_changed x_unchanged)
[PROOF STATE]
proof (state)
this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k

goal (2 subgoals):
 1. mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 2. \<not> (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k

goal (1 subgoal):
 1. \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
by (metis b)
[PROOF STATE]
proof (state)
this:
\<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. \<not> (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
assume "\<not> (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x)"
[PROOF STATE]
proof (state)
this:
\<not> (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x)

goal (1 subgoal):
 1. \<not> (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
hence assms: "mem\<^sub>1 x = mem\<^sub>1' x" "mem\<^sub>2 x = mem\<^sub>2' x"
[PROOF STATE]
proof (prove)
using this:
\<not> (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x)

goal (1 subgoal):
 1. mem\<^sub>1 x = mem\<^sub>1' x &&& mem\<^sub>2 x = mem\<^sub>2' x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
mem\<^sub>1 x = mem\<^sub>1' x
mem\<^sub>2 x = mem\<^sub>2' x

goal (1 subgoal):
 1. \<not> (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
have "length cms\<^sub>1 \<noteq> 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length cms\<^sub>1 \<noteq> 0
[PROOF STEP]
using b
[PROOF STATE]
proof (prove)
using this:
k \<sqsubset> length cms\<^sub>1 \<and> (cms\<^sub>1 ! k, mem\<^sub>1) \<leadsto> (cms\<^sub>1' ! k, mem\<^sub>1') \<and> cms\<^sub>1' = cms\<^sub>1[k := cms\<^sub>1' ! k]

goal (1 subgoal):
 1. length cms\<^sub>1 \<noteq> 0
[PROOF STEP]
by (metis less_zeroE)
[PROOF STATE]
proof (state)
this:
length cms\<^sub>1 \<noteq> 0

goal (1 subgoal):
 1. \<not> (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
length cms\<^sub>1 \<noteq> 0
[PROOF STEP]
obtain i where i_prop: "i < length cms\<^sub>1 \<and> x \<notin> ?X i"
[PROOF STATE]
proof (prove)
using this:
length cms\<^sub>1 \<noteq> 0

goal (1 subgoal):
 1. (\<And>i. i \<sqsubset> length cms\<^sub>1 \<and> x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using compat
[PROOF STATE]
proof (prove)
using this:
length cms\<^sub>1 \<noteq> 0
makes_compatible (cms\<^sub>1, mem\<^sub>1) (cms\<^sub>2, mem\<^sub>2) mems

goal (1 subgoal):
 1. (\<And>i. i \<sqsubset> length cms\<^sub>1 \<and> x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (auto, blast)
[PROOF STATE]
proof (state)
this:
i \<sqsubset> length cms\<^sub>1 \<and> x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i

goal (1 subgoal):
 1. \<not> (mem\<^sub>1 x \<noteq> mem\<^sub>1' x \<or> mem\<^sub>2 x \<noteq> mem\<^sub>2' x) \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
proof (cases "i = k")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. i = k \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 2. i \<noteq> k \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
assume "i = k"
[PROOF STATE]
proof (state)
this:
i = k

goal (2 subgoals):
 1. i = k \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 2. i \<noteq> k \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
have "x \<notin> ?X' k"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k
[PROOF STEP]
apply (rule mems'_k_cases)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k \<or> x \<notin> dom_g1 \<or> x \<notin> dom_g2; fst (mems' ! k) x = mem\<^sub>1' x; snd (mems' ! k) x = mem\<^sub>2' x\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k
 2. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2; fst (mems' ! k) x = fst (mems ! k) x; snd (mems' ! k) x = snd (mems ! k) x\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k
[PROOF STEP]
apply (metis differing_vars_neg_intro)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x \<in> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems k; x \<in> dom_g1; x \<in> dom_g2; fst (mems' ! k) x = fst (mems ! k) x; snd (mems' ! k) x = snd (mems ! k) x\<rbrakk> \<Longrightarrow> x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k
[PROOF STEP]
by (metis i_prop \<open>i = k\<close>)
[PROOF STATE]
proof (state)
this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k

goal (2 subgoals):
 1. i = k \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
 2. i \<noteq> k \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' k

goal (1 subgoal):
 1. \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
by (metis b)
[PROOF STATE]
proof (state)
this:
\<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
assume "i \<noteq> k"
[PROOF STATE]
proof (state)
this:
i \<noteq> k

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
hence "fst (mems' ! i) x = fst (mems ! i) x"
                  "snd (mems' ! i) x = snd (mems ! i) x"
[PROOF STATE]
proof (prove)
using this:
i \<noteq> k

goal (1 subgoal):
 1. fst (mems' ! i) x = fst (mems ! i) x &&& snd (mems' ! i) x = snd (mems ! i) x
[PROOF STEP]
using i_prop assms mems'_i_3
[PROOF STATE]
proof (prove)
using this:
i \<noteq> k
i \<sqsubset> length cms\<^sub>1 \<and> x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i
mem\<^sub>1 x = mem\<^sub>1' x
mem\<^sub>2 x = mem\<^sub>2' x
\<lbrakk>?i5 \<noteq> k; ?i5 \<sqsubset> length cms\<^sub>1; mem\<^sub>1 ?x5 = mem\<^sub>1' ?x5; mem\<^sub>2 ?x5 = mem\<^sub>2' ?x5\<rbrakk> \<Longrightarrow> fst (mems' ! ?i5) ?x5 = fst (mems ! ?i5) ?x5 \<and> snd (mems' ! ?i5) ?x5 = snd (mems ! ?i5) ?x5

goal (1 subgoal):
 1. fst (mems' ! i) x = fst (mems ! i) x &&& snd (mems' ! i) x = snd (mems ! i) x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fst (mems' ! i) x = fst (mems ! i) x
snd (mems' ! i) x = snd (mems ! i) x

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
with i_prop
[PROOF STATE]
proof (chain)
picking this:
i \<sqsubset> length cms\<^sub>1 \<and> x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i
fst (mems' ! i) x = fst (mems ! i) x
snd (mems' ! i) x = snd (mems ! i) x
[PROOF STEP]
have "x \<notin> ?X' i"
[PROOF STATE]
proof (prove)
using this:
i \<sqsubset> length cms\<^sub>1 \<and> x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i
fst (mems' ! i) x = fst (mems ! i) x
snd (mems' ! i) x = snd (mems ! i) x

goal (1 subgoal):
 1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
by (metis assms differing_vars_neg differing_vars_neg_intro)
[PROOF STATE]
proof (state)
this:
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. i \<noteq> k \<Longrightarrow> \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
with i_prop
[PROOF STATE]
proof (chain)
picking this:
i \<sqsubset> length cms\<^sub>1 \<and> x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
i \<sqsubset> length cms\<^sub>1 \<and> x \<notin> differing_vars_lists mem\<^sub>1 mem\<^sub>2 mems i
x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. \<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>i<length cms\<^sub>1. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<exists>i<length cms\<^sub>1. ?x7 \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
thus "(length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2') \<or> (\<forall> x. \<exists> i < length cms\<^sub>1'. x \<notin> ?X' i)"
[PROOF STATE]
proof (prove)
using this:
\<exists>i<length cms\<^sub>1. ?x7 \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i

goal (1 subgoal):
 1. length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)
[PROOF STEP]
by (metis cms\<^sub>2'_def equal_size length_list_update new_length)
[PROOF STATE]
proof (state)
this:
length cms\<^sub>1' = 0 \<and> mem\<^sub>1' =\<^sup>l mem\<^sub>2' \<or> (\<forall>x. \<exists>i<length cms\<^sub>1'. x \<notin> differing_vars_lists mem\<^sub>1' mem\<^sub>2' mems' i)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems'

goal (1 subgoal):
 1. (\<And>cms\<^sub>2' mem\<^sub>2' mems'. map snd cms\<^sub>1' = map snd cms\<^sub>2' \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2') \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2')
map snd cms\<^sub>1' = map snd cms\<^sub>2'
makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2')
map snd cms\<^sub>1' = map snd cms\<^sub>2'
makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems'

goal (1 subgoal):
 1. thesis
[PROOF STEP]
using that
[PROOF STATE]
proof (prove)
using this:
(cms\<^sub>2, mem\<^sub>2) \<rightarrow> (cms\<^sub>2', mem\<^sub>2')
map snd cms\<^sub>1' = map snd cms\<^sub>2'
makes_compatible (cms\<^sub>1', mem\<^sub>1') (cms\<^sub>2', mem\<^sub>2') mems'
map snd cms\<^sub>1' = map snd ?cms\<^sub>2'5 \<and> (cms\<^sub>2, mem\<^sub>2) \<rightarrow> (?cms\<^sub>2'5, ?mem\<^sub>2'5) \<and> makes_compatible (cms\<^sub>1', mem\<^sub>1') (?cms\<^sub>2'5, ?mem\<^sub>2'5) ?mems'5 \<Longrightarrow> thesis

goal (1 subgoal):
 1. thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
thesis

goal:
No subgoals!
[PROOF STEP]
qed