[STATEMENT]
lemma unwinding_implies_view_partitioned_ind:
shows view_partitioned_ind
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. view_partitioned_ind
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. view_partitioned_ind
[PROOF STEP]
{
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. view_partitioned_ind
[PROOF STEP]
fix execs execs2 s t n u
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. view_partitioned_ind
[PROOF STEP]
have "equivalent_states s t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n s execs) (run n t execs2) u"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. equivalent_states s t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n s execs) (run n t execs2) u
[PROOF STEP]
proof (induct n s execs arbitrary: t u execs2 rule: run.induct)
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. \<And>s execs t u execs2. equivalent_states s t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run 0 s execs) (run 0 t execs2) u
 2. \<And>n execs t u execs2. equivalent_states None t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) None execs) (run (Suc n) t execs2) u
 3. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 5. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 6. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
case (1 s execs t u execs2)
[PROOF STATE]
proof (state)
this:

goal (6 subgoals):
 1. \<And>s execs t u execs2. equivalent_states s t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run 0 s execs) (run 0 t execs2) u
 2. \<And>n execs t u execs2. equivalent_states None t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) None execs) (run (Suc n) t execs2) u
 3. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 5. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 6. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. equivalent_states s t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run 0 s execs) (run 0 t execs2) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
equivalent_states s t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run 0 s execs) (run 0 t execs2) u

goal (5 subgoals):
 1. \<And>n execs t u execs2. equivalent_states None t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) None execs) (run (Suc n) t execs2) u
 2. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 5. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>n execs t u execs2. equivalent_states None t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) None execs) (run (Suc n) t execs2) u
 2. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 5. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
case (2 n execs t u execs2)
[PROOF STATE]
proof (state)
this:

goal (5 subgoals):
 1. \<And>n execs t u execs2. equivalent_states None t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) None execs) (run (Suc n) t execs2) u
 2. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 5. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. equivalent_states None t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) None execs) (run (Suc n) t execs2) u
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
equivalent_states None t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) None execs) (run (Suc n) t execs2) u

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
case (3 n s execs t u execs2)
[PROOF STATE]
proof (state)
this:
interrupt (Suc n)
equivalent_states (Some (cswitch (Suc n) s)) ?t ?u \<and> purged_relation ?u execs ?execs2.0 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n ?t ?execs2.0) ?u

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume interrupt_s: "interrupt (Suc n)"
[PROOF STATE]
proof (state)
this:
interrupt (Suc n)

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume IH: "(\<And>t u execs2.
           equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow>
           equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u)"
[PROOF STATE]
proof (state)
this:
equivalent_states (Some (cswitch (Suc n) s)) ?t ?u \<and> purged_relation ?u execs ?execs2.0 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n ?t ?execs2.0) ?u

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
equivalent_states (Some (cswitch (Suc n) s)) ?t ?u \<and> purged_relation ?u execs ?execs2.0 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n ?t ?execs2.0) ?u

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
fix t'
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume "t = Some t'"
[PROOF STATE]
proof (state)
this:
t = Some t'

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
fix rs
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume rs: "run (Suc n) (Some s) execs = Some rs"
[PROOF STATE]
proof (state)
this:
run (Suc n) (Some s) execs = Some rs

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
fix rt
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume rt: "run (Suc n) (Some t') execs2 = Some rt"
[PROOF STATE]
proof (state)
this:
run (Suc n) (Some t') execs2 = Some rt

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume vpeq_s_t: "\<forall> v . ifp^** v u \<longrightarrow> vpeq v s t'"
[PROOF STATE]
proof (state)
this:
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume current_s_t: "current s = current t'"
[PROOF STATE]
proof (state)
this:
current s = current t'

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume purged_a_a2: "purged_relation u execs execs2"

      \<comment> \<open>The following terminology is used: states rs and rt (for: run-s and run-t) are the states after a run.
         States ns and nt (for: next-s and next-t) are the states after one step.\<close>
      \<comment> \<open>We prove two properties: the states rs and rt have equal active domains (current-rs-rt) and are vpeq for all domains v that may influence u (vpeq-rs-rt).
          Both are proven using the IH.
          To use the IH, we have to prove that the properties hold for the next step (in this case, a context switch).
          Statement current-ns-nt states that after one step states ns and nt have the same active domain.
          Statement vpeq-ns-nt states that after one step states ns and nt are vpeq for all domains v that may influence u (vpeq-rs-rt).\<close>
[PROOF STATE]
proof (state)
this:
purged_relation u execs execs2

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from current_s_t cswitch_independent_of_state
[PROOF STATE]
proof (chain)
picking this:
current s = current t'
\<forall>n s t. current s = current t \<longrightarrow> current (cswitch n s) = current (cswitch n t)
[PROOF STEP]
have current_ns_nt: "current (cswitch (Suc n) s) = current (cswitch (Suc n) t')"
[PROOF STATE]
proof (prove)
using this:
current s = current t'
\<forall>n s t. current s = current t \<longrightarrow> current (cswitch n s) = current (cswitch n t)

goal (1 subgoal):
 1. current (cswitch (Suc n) s) = current (cswitch (Suc n) t')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
current (cswitch (Suc n) s) = current (cswitch (Suc n) t')

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from cswitch_consistency vpeq_s_t
[PROOF STATE]
proof (chain)
picking this:
\<forall>u s t n. vpeq u s t \<longrightarrow> vpeq u (cswitch n s) (cswitch n t)
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
[PROOF STEP]
have vpeq_ns_nt: "\<forall> v . ifp^** v u \<longrightarrow> vpeq v (cswitch (Suc n) s) (cswitch (Suc n) t')"
[PROOF STATE]
proof (prove)
using this:
\<forall>u s t n. vpeq u s t \<longrightarrow> vpeq u (cswitch n s) (cswitch n t)
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'

goal (1 subgoal):
 1. \<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v (cswitch (Suc n) s) (cswitch (Suc n) t')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v (cswitch (Suc n) s) (cswitch (Suc n) t')

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from current_ns_nt vpeq_ns_nt interrupt_s vpeq_reflexive purged_a_a2 current_s_t IH[where u=u and t="Some (cswitch (Suc n) t')" and ?execs2.0=execs2]
[PROOF STATE]
proof (chain)
picking this:
current (cswitch (Suc n) s) = current (cswitch (Suc n) t')
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v (cswitch (Suc n) s) (cswitch (Suc n) t')
interrupt (Suc n)
\<forall>a u. vpeq u a a
purged_relation u execs execs2
current s = current t'
equivalent_states (Some (cswitch (Suc n) s)) (Some (cswitch (Suc n) t')) u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n (Some (cswitch (Suc n) t')) execs2) u
[PROOF STEP]
have current_rs_rt: "current rs = current rt"
[PROOF STATE]
proof (prove)
using this:
current (cswitch (Suc n) s) = current (cswitch (Suc n) t')
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v (cswitch (Suc n) s) (cswitch (Suc n) t')
interrupt (Suc n)
\<forall>a u. vpeq u a a
purged_relation u execs execs2
current s = current t'
equivalent_states (Some (cswitch (Suc n) s)) (Some (cswitch (Suc n) t')) u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n (Some (cswitch (Suc n) t')) execs2) u

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
current (cswitch (Suc n) s) = current (cswitch (Suc n) t')
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v (cswitch (Suc n) s) (cswitch (Suc n) t')
interrupt (Suc n)
\<forall>a u. vpeq u a a
purged_relation u execs execs2
current s = current t'
equivalent_states (Some (cswitch (Suc n) s)) (Some (cswitch (Suc n) t')) u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n (Some (cswitch (Suc n) t')) execs2) u
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
fix v
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume ia: "ifp^** v u"
[PROOF STATE]
proof (state)
this:
ifp\<^sup>*\<^sup>* v u

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from current_ns_nt vpeq_ns_nt ia interrupt_s vpeq_reflexive purged_a_a2 IH[where u=u and t="Some (cswitch (Suc n) t')" and ?execs2.0=execs2]
[PROOF STATE]
proof (chain)
picking this:
current (cswitch (Suc n) s) = current (cswitch (Suc n) t')
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v (cswitch (Suc n) s) (cswitch (Suc n) t')
ifp\<^sup>*\<^sup>* v u
interrupt (Suc n)
\<forall>a u. vpeq u a a
purged_relation u execs execs2
equivalent_states (Some (cswitch (Suc n) s)) (Some (cswitch (Suc n) t')) u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n (Some (cswitch (Suc n) t')) execs2) u
[PROOF STEP]
have vpeq_rs_rt: "vpeq v rs rt"
[PROOF STATE]
proof (prove)
using this:
current (cswitch (Suc n) s) = current (cswitch (Suc n) t')
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v (cswitch (Suc n) s) (cswitch (Suc n) t')
ifp\<^sup>*\<^sup>* v u
interrupt (Suc n)
\<forall>a u. vpeq u a a
purged_relation u execs execs2
equivalent_states (Some (cswitch (Suc n) s)) (Some (cswitch (Suc n) t')) u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n (Some (cswitch (Suc n) t')) execs2) u

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
current (cswitch (Suc n) s) = current (cswitch (Suc n) t')
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v (cswitch (Suc n) s) (cswitch (Suc n) t')
ifp\<^sup>*\<^sup>* v u
interrupt (Suc n)
\<forall>a u. vpeq u a a
purged_relation u execs execs2
equivalent_states (Some (cswitch (Suc n) s)) (Some (cswitch (Suc n) t')) u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n (Some (cswitch (Suc n) t')) execs2) u
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
vpeq v rs rt

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
ifp\<^sup>*\<^sup>* ?v2 u \<Longrightarrow> vpeq ?v2 rs rt

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from current_rs_rt and this
[PROOF STATE]
proof (chain)
picking this:
current rs = current rt
ifp\<^sup>*\<^sup>* ?v2 u \<Longrightarrow> vpeq ?v2 rs rt
[PROOF STEP]
have "equivalent_states (Some rs) (Some rt) u"
[PROOF STATE]
proof (prove)
using this:
current rs = current rt
ifp\<^sup>*\<^sup>* ?v2 u \<Longrightarrow> vpeq ?v2 rs rt

goal (1 subgoal):
 1. equivalent_states (Some rs) (Some rt) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
equivalent_states (Some rs) (Some rt) u

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>t = Some ?t'2; run (Suc n) (Some s) execs = Some ?rs2; run (Suc n) (Some ?t'2) execs2 = Some ?rt2; \<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s ?t'2; current s = current ?t'2; purged_relation u execs execs2\<rbrakk> \<Longrightarrow> equivalent_states (Some ?rs2) (Some ?rt2) u

goal (4 subgoals):
 1. \<And>n s execs t u execs2. \<lbrakk>interrupt (Suc n); \<And>t u execs2. equivalent_states (Some (cswitch (Suc n) s)) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some (cswitch (Suc n) s)) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 4. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>t = Some ?t'2; run (Suc n) (Some s) execs = Some ?rs2; run (Suc n) (Some ?t'2) execs2 = Some ?rt2; \<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s ?t'2; current s = current ?t'2; purged_relation u execs execs2\<rbrakk> \<Longrightarrow> equivalent_states (Some ?rs2) (Some ?rt2) u

goal (1 subgoal):
 1. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
by(simp add:option.splits,cases t,simp+)
[PROOF STATE]
proof (state)
this:
equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
case (4 n execs s t u execs2)
[PROOF STATE]
proof (state)
this:
\<not> interrupt (Suc n)
thread_empty (execs (current s))
equivalent_states (Some s) ?t ?u \<and> purged_relation ?u execs ?execs2.0 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n ?t ?execs2.0) ?u

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume not_interrupt: "\<not>interrupt (Suc n)"
[PROOF STATE]
proof (state)
this:
\<not> interrupt (Suc n)

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume thread_empty_s: "thread_empty(execs (current s))"
[PROOF STATE]
proof (state)
this:
thread_empty (execs (current s))

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume IH: "(\<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u)"
[PROOF STATE]
proof (state)
this:
equivalent_states (Some s) ?t ?u \<and> purged_relation ?u execs ?execs2.0 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n ?t ?execs2.0) ?u

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
equivalent_states (Some s) ?t ?u \<and> purged_relation ?u execs ?execs2.0 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n ?t ?execs2.0) ?u

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
fix t'
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume t: "t = Some t'"
[PROOF STATE]
proof (state)
this:
t = Some t'

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
fix rs
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume rs: "run (Suc n) (Some s) execs = Some rs"
[PROOF STATE]
proof (state)
this:
run (Suc n) (Some s) execs = Some rs

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
fix rt
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume rt: "run (Suc n) (Some t') execs2 = Some rt"
[PROOF STATE]
proof (state)
this:
run (Suc n) (Some t') execs2 = Some rt

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume vpeq_s_t: "\<forall> v . ifp^** v u \<longrightarrow> vpeq v s t'"
[PROOF STATE]
proof (state)
this:
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume current_s_t: "current s = current t'"
[PROOF STATE]
proof (state)
this:
current s = current t'

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume purged_a_a2: "purged_relation u execs execs2"

      \<comment> \<open>The following terminology is used: states rs and rt (for: run-s and run-t) are the states after a run.
         States ns and nt (for: next-s and next-t) are the states after one step.\<close>
      \<comment> \<open>We prove two properties: the states rs and rt have equal active domains (current-rs-rt) and are vpeq for all domains v that may influence u (vpeq-rs-rt).
          Both are proven using the IH.
          To use the IH, we have to prove that the properties hold for the next step (in this case, nothing happens in s as the thread is empty).
          Statement current-ns-nt states that after one step states ns and nt have the same active domain.
          Statement $vpeq\_ns\_nt$ states that after one step states ns and nt are vpeq for all domains v that may influence u (vpeq-rs-rt).\<close>
[PROOF STATE]
proof (state)
this:
purged_relation u execs execs2

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from ifp_reflexive and vpeq_s_t
[PROOF STATE]
proof (chain)
picking this:
\<forall>u. ifp u u
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
[PROOF STEP]
have vpeq_s_t_u: "vpeq u s t'"
[PROOF STATE]
proof (prove)
using this:
\<forall>u. ifp u u
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'

goal (1 subgoal):
 1. vpeq u s t'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vpeq u s t'

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from thread_empty_s and purged_a_a2 and current_s_t
[PROOF STATE]
proof (chain)
picking this:
thread_empty (execs (current s))
purged_relation u execs execs2
current s = current t'
[PROOF STEP]
have purged_a_na2: "\<not>ifp^** (current t') u \<longrightarrow> purged_relation u execs (next_execs t' execs2)"
[PROOF STATE]
proof (prove)
using this:
thread_empty (execs (current s))
purged_relation u execs execs2
current s = current t'

goal (1 subgoal):
 1. unrelated (current t') u \<longrightarrow> purged_relation u execs (next_execs t' execs2)
[PROOF STEP]
by(unfold next_execs_def,unfold purged_relation_def,auto)
[PROOF STATE]
proof (state)
this:
unrelated (current t') u \<longrightarrow> purged_relation u execs (next_execs t' execs2)

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from step_atomicity current_next_state current_s_t
[PROOF STATE]
proof (chain)
picking this:
\<forall>s a. current (kstep s a) = current s
\<forall>s execs. current (next_state s execs) = current s
current s = current t'
[PROOF STEP]
have current_s_nt: "current s = current (step (next_state t' execs2) (next_action t' execs2))"
[PROOF STATE]
proof (prove)
using this:
\<forall>s a. current (kstep s a) = current s
\<forall>s execs. current (next_state s execs) = current s
current s = current t'

goal (1 subgoal):
 1. current s = current (step (next_state t' execs2) (next_action t' execs2))
[PROOF STEP]
unfolding step_def
[PROOF STATE]
proof (prove)
using this:
\<forall>s a. current (kstep s a) = current s
\<forall>s execs. current (next_state s execs) = current s
current s = current t'

goal (1 subgoal):
 1. current s = current (case next_action t' execs2 of None \<Rightarrow> next_state t' execs2 | Some a \<Rightarrow> kstep (next_state t' execs2) a)
[PROOF STEP]
by (cases "next_action t' execs2",auto)

      \<comment> \<open>The proof is by case distinction. If the current thread is empty in state t as well (case t-empty), then nothing happens and the proof is trivial.
          Otherwise (case t-not-empty), since the current thread has different executions in states s and t, we now show that it cannot influence u (statement not-ifp-curr-t).
          If in state t the precondition holds (case t-prec), locally respects shows that the states remain vpeq.
          Otherwise, (case t-not-prec), everything holds vacuously.\<close>
[PROOF STATE]
proof (state)
this:
current s = current (step (next_state t' execs2) (next_action t' execs2))

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
have current_rs_rt: "current rs = current rt"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
proof (cases "thread_empty(execs2 (current t'))" rule :case_split[case_names t_empty t_not_empty])
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> current rs = current rt
 2. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> current rs = current rt
[PROOF STEP]
case t_empty
[PROOF STATE]
proof (state)
this:
thread_empty (execs2 (current t'))

goal (2 subgoals):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> current rs = current rt
 2. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> current rs = current rt
[PROOF STEP]
from purged_a_a2 and vpeq_s_t and current_s_t IH[where t="Some t'" and u=u and ?execs2.0=execs2]
[PROOF STATE]
proof (chain)
picking this:
purged_relation u execs execs2
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
current s = current t'
equivalent_states (Some s) (Some t') u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n (Some t') execs2) u
[PROOF STEP]
have "equivalent_states (run n (Some s) execs) (run n (Some t') execs2) u"
[PROOF STATE]
proof (prove)
using this:
purged_relation u execs execs2
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
current s = current t'
equivalent_states (Some s) (Some t') u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n (Some t') execs2) u

goal (1 subgoal):
 1. equivalent_states (run n (Some s) execs) (run n (Some t') execs2) u
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
purged_relation u execs execs2
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
current s = current t'
equivalent_states (Some s) (Some t') u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n (Some t') execs2) u
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. equivalent_states (run n (Some s) execs) (run n (Some t') execs2) u
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
equivalent_states (run n (Some s) execs) (run n (Some t') execs2) u

goal (2 subgoals):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> current rs = current rt
 2. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> current rs = current rt
[PROOF STEP]
from this not_interrupt t_empty thread_empty_s
[PROOF STATE]
proof (chain)
picking this:
equivalent_states (run n (Some s) execs) (run n (Some t') execs2) u
\<not> interrupt (Suc n)
thread_empty (execs2 (current t'))
thread_empty (execs (current s))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
equivalent_states (run n (Some s) execs) (run n (Some t') execs2) u
\<not> interrupt (Suc n)
thread_empty (execs2 (current t'))
thread_empty (execs (current s))

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
equivalent_states (run n (Some s) execs) (run n (Some t') execs2) u
\<not> interrupt (Suc n)
thread_empty (execs2 (current t'))
thread_empty (execs (current s))
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> current rs = current rt
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> current rs = current rt
[PROOF STEP]
case t_not_empty
[PROOF STATE]
proof (state)
this:
\<not> thread_empty (execs2 (current t'))

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> current rs = current rt
[PROOF STEP]
from t_not_empty current_next_state and vpeq_s_t_u and thread_empty_s and purged_a_a2 and current_s_t
[PROOF STATE]
proof (chain)
picking this:
\<not> thread_empty (execs2 (current t'))
\<forall>s execs. current (next_state s execs) = current s
vpeq u s t'
thread_empty (execs (current s))
purged_relation u execs execs2
current s = current t'
[PROOF STEP]
have not_ifp_curr_t: "\<not>ifp^** (current (next_state t' execs2)) u"
[PROOF STATE]
proof (prove)
using this:
\<not> thread_empty (execs2 (current t'))
\<forall>s execs. current (next_state s execs) = current s
vpeq u s t'
thread_empty (execs (current s))
purged_relation u execs execs2
current s = current t'

goal (1 subgoal):
 1. unrelated (current (next_state t' execs2)) u
[PROOF STEP]
unfolding purged_relation_def
[PROOF STATE]
proof (prove)
using this:
\<not> thread_empty (execs2 (current t'))
\<forall>s execs. current (next_state s execs) = current s
vpeq u s t'
thread_empty (execs (current s))
\<forall>d. ifp\<^sup>*\<^sup>* d u \<longrightarrow> execs d = execs2 d
current s = current t'

goal (1 subgoal):
 1. unrelated (current (next_state t' execs2)) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
unrelated (current (next_state t' execs2)) u

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> current rs = current rt
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
proof (cases "precondition (next_state t' execs2) (next_action t' execs2)" rule :case_split[case_names t_prec t_not_prec])
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
[PROOF STEP]
case t_prec
[PROOF STATE]
proof (state)
this:
precondition (next_state t' execs2) (next_action t' execs2)

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
[PROOF STEP]
from locally_respects_next_state current_next_state t_prec not_ifp_curr_t vpeq_s_t locally_respects vpeq_s_nt
[PROOF STATE]
proof (chain)
picking this:
\<forall>s u execs. \<not> ifp (current s) u \<longrightarrow> vpeq u s (next_state s execs)
\<forall>s execs. current (next_state s execs) = current s
precondition (next_state t' execs2) (next_action t' execs2)
unrelated (current (next_state t' execs2)) u
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
\<forall>a s u. \<not> ifp (current s) u \<and> kprecondition s a \<longrightarrow> vpeq u s (kstep s a)
\<lbrakk>precondition (next_state ?t ?execs2.0) (next_action ?t ?execs2.0); unrelated (current ?t) ?u; \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v ?s ?t\<rbrakk> \<Longrightarrow> \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v ?s (step (next_state ?t ?execs2.0) (next_action ?t ?execs2.0))
[PROOF STEP]
have vpeq_s_nt: "(\<forall> v . ifp^** v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2)))"
[PROOF STATE]
proof (prove)
using this:
\<forall>s u execs. \<not> ifp (current s) u \<longrightarrow> vpeq u s (next_state s execs)
\<forall>s execs. current (next_state s execs) = current s
precondition (next_state t' execs2) (next_action t' execs2)
unrelated (current (next_state t' execs2)) u
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
\<forall>a s u. \<not> ifp (current s) u \<and> kprecondition s a \<longrightarrow> vpeq u s (kstep s a)
\<lbrakk>precondition (next_state ?t ?execs2.0) (next_action ?t ?execs2.0); unrelated (current ?t) ?u; \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v ?s ?t\<rbrakk> \<Longrightarrow> \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v ?s (step (next_state ?t ?execs2.0) (next_action ?t ?execs2.0))

goal (1 subgoal):
 1. \<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
[PROOF STEP]
from vpeq_s_nt purged_a_na2 this current_s_nt not_ifp_curr_t current_next_state
                IH[where t="Some (step (next_state t' execs2) (next_action t' execs2))" and u=u and ?execs2.0="next_execs t' execs2"]
[PROOF STATE]
proof (chain)
picking this:
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))
unrelated (current t') u \<longrightarrow> purged_relation u execs (next_execs t' execs2)
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))
current s = current (step (next_state t' execs2) (next_action t' execs2))
unrelated (current (next_state t' execs2)) u
\<forall>s execs. current (next_state s execs) = current s
equivalent_states (Some s) (Some (step (next_state t' execs2) (next_action t' execs2))) u \<and> purged_relation u execs (next_execs t' execs2) \<longrightarrow> equivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
[PROOF STEP]
have "equivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u"
[PROOF STATE]
proof (prove)
using this:
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))
unrelated (current t') u \<longrightarrow> purged_relation u execs (next_execs t' execs2)
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))
current s = current (step (next_state t' execs2) (next_action t' execs2))
unrelated (current (next_state t' execs2)) u
\<forall>s execs. current (next_state s execs) = current s
equivalent_states (Some s) (Some (step (next_state t' execs2) (next_action t' execs2))) u \<and> purged_relation u execs (next_execs t' execs2) \<longrightarrow> equivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u

goal (1 subgoal):
 1. equivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))
unrelated (current t') u \<longrightarrow> purged_relation u execs (next_execs t' execs2)
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))
current s = current (step (next_state t' execs2) (next_action t' execs2))
unrelated (current (next_state t' execs2)) u
\<forall>s execs. current (next_state s execs) = current s
equivalent_states (Some s) (Some (step (next_state t' execs2) (next_action t' execs2))) u \<and> purged_relation u execs (next_execs t' execs2) \<longrightarrow> equivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. equivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
equivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
[PROOF STEP]
from t_not_empty t_prec vpeq_s_nt this thread_empty_s not_interrupt
[PROOF STATE]
proof (chain)
picking this:
\<not> thread_empty (execs2 (current t'))
precondition (next_state t' execs2) (next_action t' execs2)
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))
equivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
thread_empty (execs (current s))
\<not> interrupt (Suc n)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<not> thread_empty (execs2 (current t'))
precondition (next_state t' execs2) (next_action t' execs2)
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))
equivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
thread_empty (execs (current s))
\<not> interrupt (Suc n)

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
\<not> thread_empty (execs2 (current t'))
precondition (next_state t' execs2) (next_action t' execs2)
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))
equivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
thread_empty (execs (current s))
\<not> interrupt (Suc n)
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal (1 subgoal):
 1. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
[PROOF STEP]
case t_not_prec
[PROOF STATE]
proof (state)
this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)

goal (1 subgoal):
 1. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
using rt t_not_empty not_interrupt
[PROOF STATE]
proof (prove)
using this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)
run (Suc n) (Some t') execs2 = Some rt
\<not> thread_empty (execs2 (current t'))
\<not> interrupt (Suc n)

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
fix v
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume ia: "ifp^** v u"
[PROOF STATE]
proof (state)
this:
ifp\<^sup>*\<^sup>* v u

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
have "vpeq v rs rt"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
proof (cases "thread_empty(execs2 (current t'))" rule :case_split[case_names t_empty t_not_empty])
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> vpeq v rs rt
 2. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
case t_empty
[PROOF STATE]
proof (state)
this:
thread_empty (execs2 (current t'))

goal (2 subgoals):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> vpeq v rs rt
 2. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
from purged_a_a2 and vpeq_s_t and current_s_t IH[where t="Some t'" and u=u and ?execs2.0=execs2]
[PROOF STATE]
proof (chain)
picking this:
purged_relation u execs execs2
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
current s = current t'
equivalent_states (Some s) (Some t') u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n (Some t') execs2) u
[PROOF STEP]
have "equivalent_states (run n (Some s) execs) (run n (Some t') execs2) u"
[PROOF STATE]
proof (prove)
using this:
purged_relation u execs execs2
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
current s = current t'
equivalent_states (Some s) (Some t') u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n (Some t') execs2) u

goal (1 subgoal):
 1. equivalent_states (run n (Some s) execs) (run n (Some t') execs2) u
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
purged_relation u execs execs2
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
current s = current t'
equivalent_states (Some s) (Some t') u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n (Some t') execs2) u
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. equivalent_states (run n (Some s) execs) (run n (Some t') execs2) u
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
equivalent_states (run n (Some s) execs) (run n (Some t') execs2) u

goal (2 subgoals):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> vpeq v rs rt
 2. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
from ia this not_interrupt t_empty thread_empty_s
[PROOF STATE]
proof (chain)
picking this:
ifp\<^sup>*\<^sup>* v u
equivalent_states (run n (Some s) execs) (run n (Some t') execs2) u
\<not> interrupt (Suc n)
thread_empty (execs2 (current t'))
thread_empty (execs (current s))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ifp\<^sup>*\<^sup>* v u
equivalent_states (run n (Some s) execs) (run n (Some t') execs2) u
\<not> interrupt (Suc n)
thread_empty (execs2 (current t'))
thread_empty (execs (current s))

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
ifp\<^sup>*\<^sup>* v u
equivalent_states (run n (Some s) execs) (run n (Some t') execs2) u
\<not> interrupt (Suc n)
thread_empty (execs2 (current t'))
thread_empty (execs (current s))
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
vpeq v rs rt

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
case t_not_empty
[PROOF STATE]
proof (state)
this:
\<not> thread_empty (execs2 (current t'))

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
proof (cases "precondition (next_state t' execs2) (next_action t' execs2)" rule :case_split[case_names t_prec t_not_prec])
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
case t_prec
[PROOF STATE]
proof (state)
this:
precondition (next_state t' execs2) (next_action t' execs2)

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
from t_not_empty current_next_state and vpeq_s_t_u and thread_empty_s and purged_a_a2 and current_s_t
[PROOF STATE]
proof (chain)
picking this:
\<not> thread_empty (execs2 (current t'))
\<forall>s execs. current (next_state s execs) = current s
vpeq u s t'
thread_empty (execs (current s))
purged_relation u execs execs2
current s = current t'
[PROOF STEP]
have not_ifp_curr_t: "\<not>ifp^** (current (next_state t' execs2)) u"
[PROOF STATE]
proof (prove)
using this:
\<not> thread_empty (execs2 (current t'))
\<forall>s execs. current (next_state s execs) = current s
vpeq u s t'
thread_empty (execs (current s))
purged_relation u execs execs2
current s = current t'

goal (1 subgoal):
 1. unrelated (current (next_state t' execs2)) u
[PROOF STEP]
unfolding purged_relation_def
[PROOF STATE]
proof (prove)
using this:
\<not> thread_empty (execs2 (current t'))
\<forall>s execs. current (next_state s execs) = current s
vpeq u s t'
thread_empty (execs (current s))
\<forall>d. ifp\<^sup>*\<^sup>* d u \<longrightarrow> execs d = execs2 d
current s = current t'

goal (1 subgoal):
 1. unrelated (current (next_state t' execs2)) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
unrelated (current (next_state t' execs2)) u

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
from t_prec current_next_state locally_respects_next_state this and vpeq_s_t and locally_respects and vpeq_s_nt
[PROOF STATE]
proof (chain)
picking this:
precondition (next_state t' execs2) (next_action t' execs2)
\<forall>s execs. current (next_state s execs) = current s
\<forall>s u execs. \<not> ifp (current s) u \<longrightarrow> vpeq u s (next_state s execs)
unrelated (current (next_state t' execs2)) u
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
\<forall>a s u. \<not> ifp (current s) u \<and> kprecondition s a \<longrightarrow> vpeq u s (kstep s a)
\<lbrakk>precondition (next_state ?t ?execs2.0) (next_action ?t ?execs2.0); unrelated (current ?t) ?u; \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v ?s ?t\<rbrakk> \<Longrightarrow> \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v ?s (step (next_state ?t ?execs2.0) (next_action ?t ?execs2.0))
[PROOF STEP]
have vpeq_s_nt: "(\<forall> v . ifp^** v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2)))"
[PROOF STATE]
proof (prove)
using this:
precondition (next_state t' execs2) (next_action t' execs2)
\<forall>s execs. current (next_state s execs) = current s
\<forall>s u execs. \<not> ifp (current s) u \<longrightarrow> vpeq u s (next_state s execs)
unrelated (current (next_state t' execs2)) u
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
\<forall>a s u. \<not> ifp (current s) u \<and> kprecondition s a \<longrightarrow> vpeq u s (kstep s a)
\<lbrakk>precondition (next_state ?t ?execs2.0) (next_action ?t ?execs2.0); unrelated (current ?t) ?u; \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v ?s ?t\<rbrakk> \<Longrightarrow> \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v ?s (step (next_state ?t ?execs2.0) (next_action ?t ?execs2.0))

goal (1 subgoal):
 1. \<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
from purged_a_na2 this current_s_nt not_ifp_curr_t current_next_state
                   IH[where t="Some (step (next_state t' execs2) (next_action t' execs2))" and u=u and ?execs2.0="next_execs t' execs2"]
[PROOF STATE]
proof (chain)
picking this:
unrelated (current t') u \<longrightarrow> purged_relation u execs (next_execs t' execs2)
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))
current s = current (step (next_state t' execs2) (next_action t' execs2))
unrelated (current (next_state t' execs2)) u
\<forall>s execs. current (next_state s execs) = current s
equivalent_states (Some s) (Some (step (next_state t' execs2) (next_action t' execs2))) u \<and> purged_relation u execs (next_execs t' execs2) \<longrightarrow> equivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
[PROOF STEP]
have "equivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u"
[PROOF STATE]
proof (prove)
using this:
unrelated (current t') u \<longrightarrow> purged_relation u execs (next_execs t' execs2)
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))
current s = current (step (next_state t' execs2) (next_action t' execs2))
unrelated (current (next_state t' execs2)) u
\<forall>s execs. current (next_state s execs) = current s
equivalent_states (Some s) (Some (step (next_state t' execs2) (next_action t' execs2))) u \<and> purged_relation u execs (next_execs t' execs2) \<longrightarrow> equivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u

goal (1 subgoal):
 1. equivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
unrelated (current t') u \<longrightarrow> purged_relation u execs (next_execs t' execs2)
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))
current s = current (step (next_state t' execs2) (next_action t' execs2))
unrelated (current (next_state t' execs2)) u
\<forall>s execs. current (next_state s execs) = current s
equivalent_states (Some s) (Some (step (next_state t' execs2) (next_action t' execs2))) u \<and> purged_relation u execs (next_execs t' execs2) \<longrightarrow> equivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. equivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
equivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
from ia t_not_empty t_prec vpeq_s_nt this thread_empty_s not_interrupt
[PROOF STATE]
proof (chain)
picking this:
ifp\<^sup>*\<^sup>* v u
\<not> thread_empty (execs2 (current t'))
precondition (next_state t' execs2) (next_action t' execs2)
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))
equivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
thread_empty (execs (current s))
\<not> interrupt (Suc n)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ifp\<^sup>*\<^sup>* v u
\<not> thread_empty (execs2 (current t'))
precondition (next_state t' execs2) (next_action t' execs2)
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))
equivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
thread_empty (execs (current s))
\<not> interrupt (Suc n)

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
ifp\<^sup>*\<^sup>* v u
\<not> thread_empty (execs2 (current t'))
precondition (next_state t' execs2) (next_action t' execs2)
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s (step (next_state t' execs2) (next_action t' execs2))
equivalent_states (run n (Some s) execs) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
thread_empty (execs (current s))
\<not> interrupt (Suc n)
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vpeq v rs rt

goal (1 subgoal):
 1. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
case t_not_prec
[PROOF STATE]
proof (state)
this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)

goal (1 subgoal):
 1. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
using rt t_not_empty not_interrupt
[PROOF STATE]
proof (prove)
using this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)
run (Suc n) (Some t') execs2 = Some rt
\<not> thread_empty (execs2 (current t'))
\<not> interrupt (Suc n)

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
vpeq v rs rt

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
vpeq v rs rt

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
vpeq v rs rt

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
ifp\<^sup>*\<^sup>* ?v2 u \<Longrightarrow> vpeq ?v2 rs rt

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from current_rs_rt and this
[PROOF STATE]
proof (chain)
picking this:
current rs = current rt
ifp\<^sup>*\<^sup>* ?v2 u \<Longrightarrow> vpeq ?v2 rs rt
[PROOF STEP]
have "equivalent_states (Some rs) (Some rt) u"
[PROOF STATE]
proof (prove)
using this:
current rs = current rt
ifp\<^sup>*\<^sup>* ?v2 u \<Longrightarrow> vpeq ?v2 rs rt

goal (1 subgoal):
 1. equivalent_states (Some rs) (Some rt) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
equivalent_states (Some rs) (Some rt) u

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>t = Some ?t'2; run (Suc n) (Some s) execs = Some ?rs2; run (Suc n) (Some ?t'2) execs2 = Some ?rt2; \<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s ?t'2; current s = current ?t'2; purged_relation u execs execs2\<rbrakk> \<Longrightarrow> equivalent_states (Some ?rs2) (Some ?rt2) u

goal (3 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); thread_empty (execs (current s)); \<And>t u execs2. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n (Some s) execs) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 3. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>t = Some ?t'2; run (Suc n) (Some s) execs = Some ?rs2; run (Suc n) (Some ?t'2) execs2 = Some ?rt2; \<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s ?t'2; current s = current ?t'2; purged_relation u execs execs2\<rbrakk> \<Longrightarrow> equivalent_states (Some ?rs2) (Some ?rt2) u

goal (1 subgoal):
 1. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
by(simp add:option.splits,cases t,simp+)
[PROOF STATE]
proof (state)
this:
equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u

goal (2 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
case (5 n execs s t u execs2)
[PROOF STATE]
proof (state)
this:
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
\<not> precondition (next_state s execs) (next_action s execs)

goal (2 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume not_interrupt: "\<not>interrupt (Suc n)"
[PROOF STATE]
proof (state)
this:
\<not> interrupt (Suc n)

goal (2 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume thread_not_empty_s: "\<not>thread_empty(execs (current s))"
[PROOF STATE]
proof (state)
this:
\<not> thread_empty (execs (current s))

goal (2 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume not_prec_s: "\<not> precondition (next_state s execs) (next_action s execs)"
    \<comment> \<open>Whenever the precondition does not hold, the entire theorem flattens to True and everything holds vacuously.\<close>
[PROOF STATE]
proof (state)
this:
\<not> precondition (next_state s execs) (next_action s execs)

goal (2 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
hence "run (Suc n) (Some s) execs = None"
[PROOF STATE]
proof (prove)
using this:
\<not> precondition (next_state s execs) (next_action s execs)

goal (1 subgoal):
 1. run (Suc n) (Some s) execs = None
[PROOF STEP]
using not_interrupt thread_not_empty_s
[PROOF STATE]
proof (prove)
using this:
\<not> precondition (next_state s execs) (next_action s execs)
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))

goal (1 subgoal):
 1. run (Suc n) (Some s) execs = None
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
run (Suc n) (Some s) execs = None

goal (2 subgoals):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); \<not> precondition (next_state s execs) (next_action s execs)\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
 2. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
run (Suc n) (Some s) execs = None

goal (1 subgoal):
 1. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
by(simp add:option.splits)
[PROOF STATE]
proof (state)
this:
equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
case (6 n execs s t u execs2)
[PROOF STATE]
proof (state)
this:
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
precondition (next_state s execs) (next_action s execs)
equivalent_states (Some (step (next_state s execs) (next_action s execs))) ?t ?u \<and> purged_relation ?u (next_execs s execs) ?execs2.0 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n ?t ?execs2.0) ?u

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume not_interrupt: "\<not>interrupt (Suc n)"
[PROOF STATE]
proof (state)
this:
\<not> interrupt (Suc n)

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume thread_not_empty_s: "\<not>thread_empty(execs (current s))"
[PROOF STATE]
proof (state)
this:
\<not> thread_empty (execs (current s))

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume prec_s: "precondition (next_state s execs) (next_action s execs)"
[PROOF STATE]
proof (state)
this:
precondition (next_state s execs) (next_action s execs)

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume IH: "(\<And>t u execs2.
           equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and>
           purged_relation u (next_execs s execs) execs2 \<longrightarrow>
           equivalent_states
            (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs))
            (run n t execs2) u)"
[PROOF STATE]
proof (state)
this:
equivalent_states (Some (step (next_state s execs) (next_action s execs))) ?t ?u \<and> purged_relation ?u (next_execs s execs) ?execs2.0 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n ?t ?execs2.0) ?u

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
equivalent_states (Some (step (next_state s execs) (next_action s execs))) ?t ?u \<and> purged_relation ?u (next_execs s execs) ?execs2.0 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n ?t ?execs2.0) ?u

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
fix t'
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume t: "t = Some t'"
[PROOF STATE]
proof (state)
this:
t = Some t'

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
fix rs
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume rs: "run (Suc n) (Some s) execs = Some rs"
[PROOF STATE]
proof (state)
this:
run (Suc n) (Some s) execs = Some rs

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
fix rt
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume rt: "run (Suc n) (Some t') execs2 = Some rt"
[PROOF STATE]
proof (state)
this:
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume vpeq_s_t: "\<forall> v . ifp^** v u \<longrightarrow> vpeq v s t'"
[PROOF STATE]
proof (state)
this:
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume current_s_t: "current s = current t'"
[PROOF STATE]
proof (state)
this:
current s = current t'

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume purged_a_a2: "purged_relation u execs execs2"

      \<comment> \<open>The following terminology is used: states rs and rt (for: run-s and run-t) are the states after a run.
         States ns and nt (for: next-s and next-t) are the states after one step.\<close>
      \<comment> \<open>We prove two properties: the states rs and rt have equal active domains (current-rs-rt) and are vpeq for all domains v that may influence u (vpeq-rs-rt).
          Both are proven using the IH.
          To use the IH, we have to prove that the properties hold for the next step (in this case, state s executes an action).
          Statement current-ns-nt states that after one step states ns and nt have the same active domain.
          Statement vpeq-ns-nt states that after one step states ns and nt are vpeq for all domains v that may influence u (vpeq-rs-rt).\<close>

      \<comment> \<open>Some lemma's used in the remainder of this case.\<close>
[PROOF STATE]
proof (state)
this:
purged_relation u execs execs2

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from ifp_reflexive and vpeq_s_t
[PROOF STATE]
proof (chain)
picking this:
\<forall>u. ifp u u
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
[PROOF STEP]
have vpeq_s_t_u: "vpeq u s t'"
[PROOF STATE]
proof (prove)
using this:
\<forall>u. ifp u u
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'

goal (1 subgoal):
 1. vpeq u s t'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vpeq u s t'

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from step_atomicity and current_s_t current_next_state
[PROOF STATE]
proof (chain)
picking this:
\<forall>s a. current (kstep s a) = current s
current s = current t'
\<forall>s execs. current (next_state s execs) = current s
[PROOF STEP]
have current_ns_nt: "current (step (next_state s execs) (next_action s execs)) = current (step (next_state t' execs2) (next_action t' execs2))"
[PROOF STATE]
proof (prove)
using this:
\<forall>s a. current (kstep s a) = current s
current s = current t'
\<forall>s execs. current (next_state s execs) = current s

goal (1 subgoal):
 1. current (step (next_state s execs) (next_action s execs)) = current (step (next_state t' execs2) (next_action t' execs2))
[PROOF STEP]
unfolding step_def
[PROOF STATE]
proof (prove)
using this:
\<forall>s a. current (kstep s a) = current s
current s = current t'
\<forall>s execs. current (next_state s execs) = current s

goal (1 subgoal):
 1. current (case next_action s execs of None \<Rightarrow> next_state s execs | Some a \<Rightarrow> kstep (next_state s execs) a) = current (case next_action t' execs2 of None \<Rightarrow> next_state t' execs2 | Some a \<Rightarrow> kstep (next_state t' execs2) a)
[PROOF STEP]
by (cases "next_action s execs",cases "next_action t' execs2",simp,simp,cases "next_action t' execs2",simp,simp)
[PROOF STATE]
proof (state)
this:
current (step (next_state s execs) (next_action s execs)) = current (step (next_state t' execs2) (next_action t' execs2))

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from vpeq_s_t
[PROOF STATE]
proof (chain)
picking this:
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
[PROOF STEP]
have vpeq_curr_s_t: "ifp^** (current s) u \<longrightarrow> vpeq (current s) s t'"
[PROOF STATE]
proof (prove)
using this:
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'

goal (1 subgoal):
 1. ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> vpeq (current s) s t'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> vpeq (current s) s t'

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from prec_s involved_ifp[THEN spec,THEN spec,where x1="next_state s execs" and x="next_action s execs"] vpeq_s_t
[PROOF STATE]
proof (chain)
picking this:
precondition (next_state s execs) (next_action s execs)
\<forall>d\<in>involved (next_action s execs). kprecondition (next_state s execs) (the (next_action s execs)) \<longrightarrow> ifp d (current (next_state s execs))
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
[PROOF STEP]
have vpeq_involved: "ifp^** (current s) u \<longrightarrow> (\<forall> d \<in> involved (next_action s execs) . vpeq d s t')"
[PROOF STATE]
proof (prove)
using this:
precondition (next_state s execs) (next_action s execs)
\<forall>d\<in>involved (next_action s execs). kprecondition (next_state s execs) (the (next_action s execs)) \<longrightarrow> ifp d (current (next_state s execs))
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'

goal (1 subgoal):
 1. ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> (\<forall>d\<in>involved (next_action s execs). vpeq d s t')
[PROOF STEP]
using current_next_state
[PROOF STATE]
proof (prove)
using this:
precondition (next_state s execs) (next_action s execs)
\<forall>d\<in>involved (next_action s execs). kprecondition (next_state s execs) (the (next_action s execs)) \<longrightarrow> ifp d (current (next_state s execs))
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
\<forall>s execs. current (next_state s execs) = current s

goal (1 subgoal):
 1. ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> (\<forall>d\<in>involved (next_action s execs). vpeq d s t')
[PROOF STEP]
unfolding involved_def precondition_def B_def
[PROOF STATE]
proof (prove)
using this:
case next_action s execs of None \<Rightarrow> True | Some a \<Rightarrow> kprecondition (next_state s execs) a
\<forall>d\<in>case next_action s execs of None \<Rightarrow> {} | Some a \<Rightarrow> kinvolved a. kprecondition (next_state s execs) (the (next_action s execs)) \<longrightarrow> ifp d (current (next_state s execs))
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
\<forall>s execs. current (next_state s execs) = current s

goal (1 subgoal):
 1. ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> (\<forall>d\<in>case next_action s execs of None \<Rightarrow> {} | Some a \<Rightarrow> kinvolved a. vpeq d s t')
[PROOF STEP]
by(cases "next_action s execs",simp,auto,metis converse_rtranclp_into_rtranclp)
[PROOF STATE]
proof (state)
this:
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> (\<forall>d\<in>involved (next_action s execs). vpeq d s t')

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from current_s_t next_execs_consistent vpeq_curr_s_t vpeq_involved
[PROOF STATE]
proof (chain)
picking this:
current s = current t'
\<forall>s t execs. vpeq (current s) s t \<and> (\<forall>d\<in>involved (next_action s execs). vpeq d s t) \<and> current s = current t \<longrightarrow> fst (snd (control s (current s) (execs (current s)))) = fst (snd (control t (current s) (execs (current s))))
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> vpeq (current s) s t'
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> (\<forall>d\<in>involved (next_action s execs). vpeq d s t')
[PROOF STEP]
have next_execs_t: "ifp^** (current s) u \<longrightarrow> next_execs t' execs = next_execs s execs"
[PROOF STATE]
proof (prove)
using this:
current s = current t'
\<forall>s t execs. vpeq (current s) s t \<and> (\<forall>d\<in>involved (next_action s execs). vpeq d s t) \<and> current s = current t \<longrightarrow> fst (snd (control s (current s) (execs (current s)))) = fst (snd (control t (current s) (execs (current s))))
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> vpeq (current s) s t'
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> (\<forall>d\<in>involved (next_action s execs). vpeq d s t')

goal (1 subgoal):
 1. ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_execs t' execs = next_execs s execs
[PROOF STEP]
unfolding next_execs_def
[PROOF STATE]
proof (prove)
using this:
current s = current t'
\<forall>s t execs. vpeq (current s) s t \<and> (\<forall>d\<in>involved (next_action s execs). vpeq d s t) \<and> current s = current t \<longrightarrow> fst (snd (control s (current s) (execs (current s)))) = fst (snd (control t (current s) (execs (current s))))
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> vpeq (current s) s t'
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> (\<forall>d\<in>involved (next_action s execs). vpeq d s t')

goal (1 subgoal):
 1. ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> execs(current t' := fst (snd (control t' (current t') (execs (current t'))))) = execs(current s := fst (snd (control s (current s) (execs (current s)))))
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_execs t' execs = next_execs s execs

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from current_s_t purged_a_a2  thread_not_empty_s next_action_consistent[THEN spec,THEN spec,where x1=s and x=t'] vpeq_curr_s_t vpeq_involved
[PROOF STATE]
proof (chain)
picking this:
current s = current t'
purged_relation u execs execs2
\<not> thread_empty (execs (current s))
\<forall>execs. vpeq (current s) s t' \<and> (\<forall>d\<in>involved (next_action s execs). vpeq d s t') \<and> current s = current t' \<longrightarrow> next_action s execs = next_action t' execs
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> vpeq (current s) s t'
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> (\<forall>d\<in>involved (next_action s execs). vpeq d s t')
[PROOF STEP]
have next_action_s_t: "ifp^** (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs"
[PROOF STATE]
proof (prove)
using this:
current s = current t'
purged_relation u execs execs2
\<not> thread_empty (execs (current s))
\<forall>execs. vpeq (current s) s t' \<and> (\<forall>d\<in>involved (next_action s execs). vpeq d s t') \<and> current s = current t' \<longrightarrow> next_action s execs = next_action t' execs
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> vpeq (current s) s t'
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> (\<forall>d\<in>involved (next_action s execs). vpeq d s t')

goal (1 subgoal):
 1. ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs
[PROOF STEP]
by(unfold next_action_def,unfold purged_relation_def,auto)
[PROOF STATE]
proof (state)
this:
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from purged_a_a2 current_s_t next_execs_consistent[THEN spec,THEN spec,THEN spec,where x2=s and x1=t' and x="execs"]
           vpeq_curr_s_t vpeq_involved
[PROOF STATE]
proof (chain)
picking this:
purged_relation u execs execs2
current s = current t'
vpeq (current s) s t' \<and> (\<forall>d\<in>involved (next_action s execs). vpeq d s t') \<and> current s = current t' \<longrightarrow> fst (snd (control s (current s) (execs (current s)))) = fst (snd (control t' (current s) (execs (current s))))
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> vpeq (current s) s t'
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> (\<forall>d\<in>involved (next_action s execs). vpeq d s t')
[PROOF STEP]
have purged_na_na2: "purged_relation u (next_execs s execs) (next_execs t' execs2)"
[PROOF STATE]
proof (prove)
using this:
purged_relation u execs execs2
current s = current t'
vpeq (current s) s t' \<and> (\<forall>d\<in>involved (next_action s execs). vpeq d s t') \<and> current s = current t' \<longrightarrow> fst (snd (control s (current s) (execs (current s)))) = fst (snd (control t' (current s) (execs (current s))))
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> vpeq (current s) s t'
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> (\<forall>d\<in>involved (next_action s execs). vpeq d s t')

goal (1 subgoal):
 1. purged_relation u (next_execs s execs) (next_execs t' execs2)
[PROOF STEP]
unfolding next_execs_def purged_relation_def
[PROOF STATE]
proof (prove)
using this:
\<forall>d. ifp\<^sup>*\<^sup>* d u \<longrightarrow> execs d = execs2 d
current s = current t'
vpeq (current s) s t' \<and> (\<forall>d\<in>involved (next_action s execs). vpeq d s t') \<and> current s = current t' \<longrightarrow> fst (snd (control s (current s) (execs (current s)))) = fst (snd (control t' (current s) (execs (current s))))
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> vpeq (current s) s t'
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> (\<forall>d\<in>involved (next_action s execs). vpeq d s t')

goal (1 subgoal):
 1. \<forall>d. ifp\<^sup>*\<^sup>* d u \<longrightarrow> (execs(current s := fst (snd (control s (current s) (execs (current s)))))) d = (execs2(current t' := fst (snd (control t' (current t') (execs2 (current t')))))) d
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
purged_relation u (next_execs s execs) (next_execs t' execs2)

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from purged_a_a2 and purged_relation_def and thread_not_empty_s and current_s_t
[PROOF STATE]
proof (chain)
picking this:
purged_relation u execs execs2
purged_relation ?u ?execs1.0 ?execs2.0 \<equiv> \<forall>d. ifp\<^sup>*\<^sup>* d ?u \<longrightarrow> ?execs1.0 d = ?execs2.0 d
\<not> thread_empty (execs (current s))
current s = current t'
[PROOF STEP]
have thread_not_empty_t: "ifp^** (current s) u \<longrightarrow> \<not>thread_empty(execs2 (current t'))"
[PROOF STATE]
proof (prove)
using this:
purged_relation u execs execs2
purged_relation ?u ?execs1.0 ?execs2.0 \<equiv> \<forall>d. ifp\<^sup>*\<^sup>* d ?u \<longrightarrow> ?execs1.0 d = ?execs2.0 d
\<not> thread_empty (execs (current s))
current s = current t'

goal (1 subgoal):
 1. ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> \<not> thread_empty (execs2 (current t'))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> \<not> thread_empty (execs2 (current t'))

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from step_atomicity current_s_t current_next_state
[PROOF STATE]
proof (chain)
picking this:
\<forall>s a. current (kstep s a) = current s
current s = current t'
\<forall>s execs. current (next_state s execs) = current s
[PROOF STEP]
have current_ns_t: "current (step (next_state s execs) (next_action s execs)) = current t'"
[PROOF STATE]
proof (prove)
using this:
\<forall>s a. current (kstep s a) = current s
current s = current t'
\<forall>s execs. current (next_state s execs) = current s

goal (1 subgoal):
 1. current (step (next_state s execs) (next_action s execs)) = current t'
[PROOF STEP]
unfolding step_def
[PROOF STATE]
proof (prove)
using this:
\<forall>s a. current (kstep s a) = current s
current s = current t'
\<forall>s execs. current (next_state s execs) = current s

goal (1 subgoal):
 1. current (case next_action s execs of None \<Rightarrow> next_state s execs | Some a \<Rightarrow> kstep (next_state s execs) a) = current t'
[PROOF STEP]
by (cases "next_action s execs",auto)
[PROOF STATE]
proof (state)
this:
current (step (next_state s execs) (next_action s execs)) = current t'

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from step_atomicity and current_s_t
[PROOF STATE]
proof (chain)
picking this:
\<forall>s a. current (kstep s a) = current s
current s = current t'
[PROOF STEP]
have current_s_nt: "current s = current (step t' (next_action t' execs2))"
[PROOF STATE]
proof (prove)
using this:
\<forall>s a. current (kstep s a) = current s
current s = current t'

goal (1 subgoal):
 1. current s = current (step t' (next_action t' execs2))
[PROOF STEP]
unfolding step_def
[PROOF STATE]
proof (prove)
using this:
\<forall>s a. current (kstep s a) = current s
current s = current t'

goal (1 subgoal):
 1. current s = current (case next_action t' execs2 of None \<Rightarrow> t' | Some a \<Rightarrow> kstep t' a)
[PROOF STEP]
by (cases "next_action t' execs2",auto)
[PROOF STATE]
proof (state)
this:
current s = current (step t' (next_action t' execs2))

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from purged_a_a2
[PROOF STATE]
proof (chain)
picking this:
purged_relation u execs execs2
[PROOF STEP]
have purged_na_a: "\<not>ifp^** (current s) u \<longrightarrow> purged_relation u (next_execs s execs) execs2"
[PROOF STATE]
proof (prove)
using this:
purged_relation u execs execs2

goal (1 subgoal):
 1. unrelated (current s) u \<longrightarrow> purged_relation u (next_execs s execs) execs2
[PROOF STEP]
by(unfold next_execs_def,unfold purged_relation_def,auto)

      \<comment> \<open>The proof is by case distinction. If the current domain can interact with u (case curr-ifp-u), then either in state t the precondition holds (case t-prec) or not.
          If it holds, then lemma vpeq-ns-nt-ifp-u applies. Otherwise, the proof is trivial as the theorem holds vacuously.
          If the domain cannot interact with u, (case curr-not-ifp-u), then lemma vpeq-ns-nt-not-ifp-u applies.\<close>
[PROOF STATE]
proof (state)
this:
unrelated (current s) u \<longrightarrow> purged_relation u (next_execs s execs) execs2

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
have current_rs_rt: "current rs = current rt"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
proof (cases "ifp^** (current s) u" rule :case_split[case_names curr_ifp_u curr_not_ifp_u])
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. ifp\<^sup>*\<^sup>* (current s) u \<Longrightarrow> current rs = current rt
 2. unrelated (current s) u \<Longrightarrow> current rs = current rt
[PROOF STEP]
case curr_ifp_u
[PROOF STATE]
proof (state)
this:
ifp\<^sup>*\<^sup>* (current s) u

goal (2 subgoals):
 1. ifp\<^sup>*\<^sup>* (current s) u \<Longrightarrow> current rs = current rt
 2. unrelated (current s) u \<Longrightarrow> current rs = current rt
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
proof (cases "precondition (next_state t' execs2) (next_action t' execs2)" rule :case_split[case_names prec_t prec_not_t])
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
[PROOF STEP]
case prec_t
[PROOF STATE]
proof (state)
this:
precondition (next_state t' execs2) (next_action t' execs2)

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
[PROOF STEP]
have thread_not_empty_t: "\<not>thread_empty(execs2 (current t'))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t'))
[PROOF STEP]
using thread_not_empty_t curr_ifp_u
[PROOF STATE]
proof (prove)
using this:
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> \<not> thread_empty (execs2 (current t'))
ifp\<^sup>*\<^sup>* (current s) u

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t'))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<not> thread_empty (execs2 (current t'))

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
[PROOF STEP]
from
            current_ns_nt next_execs_t next_action_s_t purged_a_a2
            curr_ifp_u prec_t prec_s vpeq_ns_nt_ifp_u[where a="(next_action s execs)"] vpeq_s_t current_s_t
[PROOF STATE]
proof (chain)
picking this:
current (step (next_state s execs) (next_action s execs)) = current (step (next_state t' execs2) (next_action t' execs2))
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_execs t' execs = next_execs s execs
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs
purged_relation u execs execs2
ifp\<^sup>*\<^sup>* (current s) u
precondition (next_state t' execs2) (next_action t' execs2)
precondition (next_state s execs) (next_action s execs)
\<lbrakk>\<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v ?s ?t'; current ?s = current ?t'; precondition (next_state ?s ?execs) (next_action s execs) \<and> precondition (next_state ?t' ?execs) (next_action s execs); ifp\<^sup>*\<^sup>* (current ?s) ?u\<rbrakk> \<Longrightarrow> \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v (step (next_state ?s ?execs) (next_action s execs)) (step (next_state ?t' ?execs) (next_action s execs))
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
current s = current t'
[PROOF STEP]
have "equivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some (step (next_state t' execs2) (next_action t' execs2))) u"
[PROOF STATE]
proof (prove)
using this:
current (step (next_state s execs) (next_action s execs)) = current (step (next_state t' execs2) (next_action t' execs2))
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_execs t' execs = next_execs s execs
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs
purged_relation u execs execs2
ifp\<^sup>*\<^sup>* (current s) u
precondition (next_state t' execs2) (next_action t' execs2)
precondition (next_state s execs) (next_action s execs)
\<lbrakk>\<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v ?s ?t'; current ?s = current ?t'; precondition (next_state ?s ?execs) (next_action s execs) \<and> precondition (next_state ?t' ?execs) (next_action s execs); ifp\<^sup>*\<^sup>* (current ?s) ?u\<rbrakk> \<Longrightarrow> \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v (step (next_state ?s ?execs) (next_action s execs)) (step (next_state ?t' ?execs) (next_action s execs))
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
current s = current t'

goal (1 subgoal):
 1. equivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some (step (next_state t' execs2) (next_action t' execs2))) u
[PROOF STEP]
unfolding purged_relation_def next_state_def
[PROOF STATE]
proof (prove)
using this:
current (step (snd (snd (control s (current s) (execs (current s))))) (next_action s execs)) = current (step (snd (snd (control t' (current t') (execs2 (current t'))))) (next_action t' execs2))
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_execs t' execs = next_execs s execs
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs
\<forall>d. ifp\<^sup>*\<^sup>* d u \<longrightarrow> execs d = execs2 d
ifp\<^sup>*\<^sup>* (current s) u
precondition (snd (snd (control t' (current t') (execs2 (current t'))))) (next_action t' execs2)
precondition (snd (snd (control s (current s) (execs (current s))))) (next_action s execs)
\<lbrakk>\<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v ?s ?t'; current ?s = current ?t'; precondition (snd (snd (control ?s (current ?s) (?execs (current ?s))))) (next_action s execs) \<and> precondition (snd (snd (control ?t' (current ?t') (?execs (current ?t'))))) (next_action s execs); ifp\<^sup>*\<^sup>* (current ?s) ?u\<rbrakk> \<Longrightarrow> \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v (step (snd (snd (control ?s (current ?s) (?execs (current ?s))))) (next_action s execs)) (step (snd (snd (control ?t' (current ?t') (?execs (current ?t'))))) (next_action s execs))
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
current s = current t'

goal (1 subgoal):
 1. equivalent_states (Some (step (snd (snd (control s (current s) (execs (current s))))) (next_action s execs))) (Some (step (snd (snd (control t' (current t') (execs2 (current t'))))) (next_action t' execs2))) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
equivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some (step (next_state t' execs2) (next_action t' execs2))) u

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
[PROOF STEP]
from this
            IH[where u=u and ?execs2.0="(next_execs t' execs2)" and t="Some (step (next_state t' execs2) (next_action t' execs2))"]
            current_ns_nt purged_na_na2
[PROOF STATE]
proof (chain)
picking this:
equivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some (step (next_state t' execs2) (next_action t' execs2))) u
equivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some (step (next_state t' execs2) (next_action t' execs2))) u \<and> purged_relation u (next_execs s execs) (next_execs t' execs2) \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
current (step (next_state s execs) (next_action s execs)) = current (step (next_state t' execs2) (next_action t' execs2))
purged_relation u (next_execs s execs) (next_execs t' execs2)
[PROOF STEP]
have "equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs))
                                    (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u"
[PROOF STATE]
proof (prove)
using this:
equivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some (step (next_state t' execs2) (next_action t' execs2))) u
equivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some (step (next_state t' execs2) (next_action t' execs2))) u \<and> purged_relation u (next_execs s execs) (next_execs t' execs2) \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
current (step (next_state s execs) (next_action s execs)) = current (step (next_state t' execs2) (next_action t' execs2))
purged_relation u (next_execs s execs) (next_execs t' execs2)

goal (1 subgoal):
 1. equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
[PROOF STEP]
from prec_t thread_not_empty_t prec_s and this and not_interrupt and thread_not_empty_s and next_action_s_t
[PROOF STATE]
proof (chain)
picking this:
precondition (next_state t' execs2) (next_action t' execs2)
\<not> thread_empty (execs2 (current t'))
precondition (next_state s execs) (next_action s execs)
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
precondition (next_state t' execs2) (next_action t' execs2)
\<not> thread_empty (execs2 (current t'))
precondition (next_state s execs) (next_action s execs)
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
precondition (next_state t' execs2) (next_action t' execs2)
\<not> thread_empty (execs2 (current t'))
precondition (next_state s execs) (next_action s execs)
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal (1 subgoal):
 1. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
[PROOF STEP]
case prec_not_t
[PROOF STATE]
proof (state)
this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)

goal (1 subgoal):
 1. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
[PROOF STEP]
from curr_ifp_u prec_not_t thread_not_empty_t not_interrupt
[PROOF STATE]
proof (chain)
picking this:
ifp\<^sup>*\<^sup>* (current s) u
\<not> precondition (next_state t' execs2) (next_action t' execs2)
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> \<not> thread_empty (execs2 (current t'))
\<not> interrupt (Suc n)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ifp\<^sup>*\<^sup>* (current s) u
\<not> precondition (next_state t' execs2) (next_action t' execs2)
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> \<not> thread_empty (execs2 (current t'))
\<not> interrupt (Suc n)

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
using rt
[PROOF STATE]
proof (prove)
using this:
ifp\<^sup>*\<^sup>* (current s) u
\<not> precondition (next_state t' execs2) (next_action t' execs2)
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> \<not> thread_empty (execs2 (current t'))
\<not> interrupt (Suc n)
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal (1 subgoal):
 1. unrelated (current s) u \<Longrightarrow> current rs = current rt
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. unrelated (current s) u \<Longrightarrow> current rs = current rt
[PROOF STEP]
case curr_not_ifp_u
[PROOF STATE]
proof (state)
this:
unrelated (current s) u

goal (1 subgoal):
 1. unrelated (current s) u \<Longrightarrow> current rs = current rt
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
proof (cases "thread_empty(execs2 (current t'))" rule :case_split[case_names t_empty t_not_empty])
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> current rs = current rt
 2. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> current rs = current rt
[PROOF STEP]
case t_not_empty
[PROOF STATE]
proof (state)
this:
\<not> thread_empty (execs2 (current t'))

goal (2 subgoals):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> current rs = current rt
 2. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> current rs = current rt
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
proof (cases "precondition (next_state t' execs2) (next_action t' execs2)" rule :case_split[case_names t_prec t_not_prec])
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
[PROOF STEP]
case t_prec
[PROOF STATE]
proof (state)
this:
precondition (next_state t' execs2) (next_action t' execs2)

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
[PROOF STEP]
from curr_not_ifp_u t_prec IH[where u=u and ?execs2.0="(next_execs t' execs2)" and t="Some (step (next_state t' execs2) (next_action t' execs2))"]
                 current_ns_nt next_execs_t purged_na_na2 vpeq_ns_nt_not_ifp_u current_s_t vpeq_s_t prec_s purged_a_a2
[PROOF STATE]
proof (chain)
picking this:
unrelated (current s) u
precondition (next_state t' execs2) (next_action t' execs2)
equivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some (step (next_state t' execs2) (next_action t' execs2))) u \<and> purged_relation u (next_execs s execs) (next_execs t' execs2) \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
current (step (next_state s execs) (next_action s execs)) = current (step (next_state t' execs2) (next_action t' execs2))
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_execs t' execs = next_execs s execs
purged_relation u (next_execs s execs) (next_execs t' execs2)
\<lbrakk>purged_relation ?u ?execs ?execs2.0; precondition (next_state ?s ?execs) (next_action ?s ?execs); current ?s = current ?t'; \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v ?s ?t'\<rbrakk> \<Longrightarrow> unrelated (current ?s) ?u \<and> precondition (next_state ?t' ?execs2.0) (next_action ?t' ?execs2.0) \<longrightarrow> (\<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v (step (next_state ?s ?execs) (next_action ?s ?execs)) (step (next_state ?t' ?execs2.0) (next_action ?t' ?execs2.0)))
current s = current t'
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
precondition (next_state s execs) (next_action s execs)
purged_relation u execs execs2
[PROOF STEP]
have "equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs))
                                     (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u"
[PROOF STATE]
proof (prove)
using this:
unrelated (current s) u
precondition (next_state t' execs2) (next_action t' execs2)
equivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some (step (next_state t' execs2) (next_action t' execs2))) u \<and> purged_relation u (next_execs s execs) (next_execs t' execs2) \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
current (step (next_state s execs) (next_action s execs)) = current (step (next_state t' execs2) (next_action t' execs2))
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_execs t' execs = next_execs s execs
purged_relation u (next_execs s execs) (next_execs t' execs2)
\<lbrakk>purged_relation ?u ?execs ?execs2.0; precondition (next_state ?s ?execs) (next_action ?s ?execs); current ?s = current ?t'; \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v ?s ?t'\<rbrakk> \<Longrightarrow> unrelated (current ?s) ?u \<and> precondition (next_state ?t' ?execs2.0) (next_action ?t' ?execs2.0) \<longrightarrow> (\<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v (step (next_state ?s ?execs) (next_action ?s ?execs)) (step (next_state ?t' ?execs2.0) (next_action ?t' ?execs2.0)))
current s = current t'
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
precondition (next_state s execs) (next_action s execs)
purged_relation u execs execs2

goal (1 subgoal):
 1. equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
[PROOF STEP]
from this t_prec curr_not_ifp_u t_not_empty prec_s not_interrupt thread_not_empty_s
[PROOF STATE]
proof (chain)
picking this:
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
precondition (next_state t' execs2) (next_action t' execs2)
unrelated (current s) u
\<not> thread_empty (execs2 (current t'))
precondition (next_state s execs) (next_action s execs)
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
precondition (next_state t' execs2) (next_action t' execs2)
unrelated (current s) u
\<not> thread_empty (execs2 (current t'))
precondition (next_state s execs) (next_action s execs)
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
precondition (next_state t' execs2) (next_action t' execs2)
unrelated (current s) u
\<not> thread_empty (execs2 (current t'))
precondition (next_state s execs) (next_action s execs)
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal (1 subgoal):
 1. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
[PROOF STEP]
case t_not_prec
[PROOF STATE]
proof (state)
this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)

goal (1 subgoal):
 1. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> current rs = current rt
[PROOF STEP]
from t_not_prec t_not_empty not_interrupt
[PROOF STATE]
proof (chain)
picking this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)
\<not> thread_empty (execs2 (current t'))
\<not> interrupt (Suc n)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)
\<not> thread_empty (execs2 (current t'))
\<not> interrupt (Suc n)

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
using rt
[PROOF STATE]
proof (prove)
using this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)
\<not> thread_empty (execs2 (current t'))
\<not> interrupt (Suc n)
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal (1 subgoal):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> current rs = current rt
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> current rs = current rt
[PROOF STEP]
case t_empty
[PROOF STATE]
proof (state)
this:
thread_empty (execs2 (current t'))

goal (1 subgoal):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> current rs = current rt
[PROOF STEP]
from curr_not_ifp_u and prec_s and vpeq_s_t and locally_respects and vpeq_ns_t current_next_state locally_respects_next_state
[PROOF STATE]
proof (chain)
picking this:
unrelated (current s) u
precondition (next_state s execs) (next_action s execs)
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
\<forall>a s u. \<not> ifp (current s) u \<and> kprecondition s a \<longrightarrow> vpeq u s (kstep s a)
\<lbrakk>precondition (next_state ?s ?execs) (next_action ?s ?execs); unrelated (current ?s) ?u; \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v ?s ?t\<rbrakk> \<Longrightarrow> \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v (step (next_state ?s ?execs) (next_action ?s ?execs)) ?t
\<forall>s execs. current (next_state s execs) = current s
\<forall>s u execs. \<not> ifp (current s) u \<longrightarrow> vpeq u s (next_state s execs)
[PROOF STEP]
have vpeq_ns_t: "(\<forall> v . ifp^** v u \<longrightarrow> vpeq v (step (next_state s execs) (next_action s execs)) t')"
[PROOF STATE]
proof (prove)
using this:
unrelated (current s) u
precondition (next_state s execs) (next_action s execs)
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
\<forall>a s u. \<not> ifp (current s) u \<and> kprecondition s a \<longrightarrow> vpeq u s (kstep s a)
\<lbrakk>precondition (next_state ?s ?execs) (next_action ?s ?execs); unrelated (current ?s) ?u; \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v ?s ?t\<rbrakk> \<Longrightarrow> \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v (step (next_state ?s ?execs) (next_action ?s ?execs)) ?t
\<forall>s execs. current (next_state s execs) = current s
\<forall>s u execs. \<not> ifp (current s) u \<longrightarrow> vpeq u s (next_state s execs)

goal (1 subgoal):
 1. \<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v (step (next_state s execs) (next_action s execs)) t'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v (step (next_state s execs) (next_action s execs)) t'

goal (1 subgoal):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> current rs = current rt
[PROOF STEP]
from curr_not_ifp_u IH[where t="Some t'" and u=u and ?execs2.0=execs2] and current_ns_t and next_execs_t and purged_na_a and vpeq_ns_t and this
[PROOF STATE]
proof (chain)
picking this:
unrelated (current s) u
equivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some t') u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some t') execs2) u
current (step (next_state s execs) (next_action s execs)) = current t'
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_execs t' execs = next_execs s execs
unrelated (current s) u \<longrightarrow> purged_relation u (next_execs s execs) execs2
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v (step (next_state s execs) (next_action s execs)) t'
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v (step (next_state s execs) (next_action s execs)) t'
[PROOF STEP]
have "equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs))
                                  (run n (Some t')  execs2) u"
[PROOF STATE]
proof (prove)
using this:
unrelated (current s) u
equivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some t') u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some t') execs2) u
current (step (next_state s execs) (next_action s execs)) = current t'
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_execs t' execs = next_execs s execs
unrelated (current s) u \<longrightarrow> purged_relation u (next_execs s execs) execs2
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v (step (next_state s execs) (next_action s execs)) t'
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v (step (next_state s execs) (next_action s execs)) t'

goal (1 subgoal):
 1. equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some t') execs2) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some t') execs2) u

goal (1 subgoal):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> current rs = current rt
[PROOF STEP]
from this not_interrupt thread_not_empty_s t_empty prec_s
[PROOF STATE]
proof (chain)
picking this:
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some t') execs2) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
thread_empty (execs2 (current t'))
precondition (next_state s execs) (next_action s execs)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some t') execs2) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
thread_empty (execs2 (current t'))
precondition (next_state s execs) (next_action s execs)

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some t') execs2) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
thread_empty (execs2 (current t'))
precondition (next_state s execs) (next_action s execs)
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. current rs = current rt
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
current rs = current rt

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
fix v
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
assume ia: "ifp^** v u"
[PROOF STATE]
proof (state)
this:
ifp\<^sup>*\<^sup>* v u

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
have "vpeq v rs rt"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
proof (cases "ifp^** (current s) u" rule :case_split[case_names curr_ifp_u curr_not_ifp_u])
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. ifp\<^sup>*\<^sup>* (current s) u \<Longrightarrow> vpeq v rs rt
 2. unrelated (current s) u \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
case curr_ifp_u
[PROOF STATE]
proof (state)
this:
ifp\<^sup>*\<^sup>* (current s) u

goal (2 subgoals):
 1. ifp\<^sup>*\<^sup>* (current s) u \<Longrightarrow> vpeq v rs rt
 2. unrelated (current s) u \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
proof (cases "precondition (next_state t' execs2) (next_action t' execs2)" rule :case_split[case_names t_prec t_not_prec])
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
case t_prec
[PROOF STATE]
proof (state)
this:
precondition (next_state t' execs2) (next_action t' execs2)

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
have thread_not_empty_t: "\<not>thread_empty(execs2 (current t'))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t'))
[PROOF STEP]
using thread_not_empty_t curr_ifp_u
[PROOF STATE]
proof (prove)
using this:
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> \<not> thread_empty (execs2 (current t'))
ifp\<^sup>*\<^sup>* (current s) u

goal (1 subgoal):
 1. \<not> thread_empty (execs2 (current t'))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<not> thread_empty (execs2 (current t'))

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
from
              current_ns_nt next_execs_t next_action_s_t purged_a_a2
              curr_ifp_u t_prec  prec_s vpeq_ns_nt_ifp_u[where a="(next_action s execs)"] vpeq_s_t current_s_t
[PROOF STATE]
proof (chain)
picking this:
current (step (next_state s execs) (next_action s execs)) = current (step (next_state t' execs2) (next_action t' execs2))
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_execs t' execs = next_execs s execs
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs
purged_relation u execs execs2
ifp\<^sup>*\<^sup>* (current s) u
precondition (next_state t' execs2) (next_action t' execs2)
precondition (next_state s execs) (next_action s execs)
\<lbrakk>\<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v ?s ?t'; current ?s = current ?t'; precondition (next_state ?s ?execs) (next_action s execs) \<and> precondition (next_state ?t' ?execs) (next_action s execs); ifp\<^sup>*\<^sup>* (current ?s) ?u\<rbrakk> \<Longrightarrow> \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v (step (next_state ?s ?execs) (next_action s execs)) (step (next_state ?t' ?execs) (next_action s execs))
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
current s = current t'
[PROOF STEP]
have "equivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some (step (next_state t' execs2) (next_action t' execs2))) u"
[PROOF STATE]
proof (prove)
using this:
current (step (next_state s execs) (next_action s execs)) = current (step (next_state t' execs2) (next_action t' execs2))
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_execs t' execs = next_execs s execs
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs
purged_relation u execs execs2
ifp\<^sup>*\<^sup>* (current s) u
precondition (next_state t' execs2) (next_action t' execs2)
precondition (next_state s execs) (next_action s execs)
\<lbrakk>\<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v ?s ?t'; current ?s = current ?t'; precondition (next_state ?s ?execs) (next_action s execs) \<and> precondition (next_state ?t' ?execs) (next_action s execs); ifp\<^sup>*\<^sup>* (current ?s) ?u\<rbrakk> \<Longrightarrow> \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v (step (next_state ?s ?execs) (next_action s execs)) (step (next_state ?t' ?execs) (next_action s execs))
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
current s = current t'

goal (1 subgoal):
 1. equivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some (step (next_state t' execs2) (next_action t' execs2))) u
[PROOF STEP]
unfolding purged_relation_def next_state_def
[PROOF STATE]
proof (prove)
using this:
current (step (snd (snd (control s (current s) (execs (current s))))) (next_action s execs)) = current (step (snd (snd (control t' (current t') (execs2 (current t'))))) (next_action t' execs2))
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_execs t' execs = next_execs s execs
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs
\<forall>d. ifp\<^sup>*\<^sup>* d u \<longrightarrow> execs d = execs2 d
ifp\<^sup>*\<^sup>* (current s) u
precondition (snd (snd (control t' (current t') (execs2 (current t'))))) (next_action t' execs2)
precondition (snd (snd (control s (current s) (execs (current s))))) (next_action s execs)
\<lbrakk>\<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v ?s ?t'; current ?s = current ?t'; precondition (snd (snd (control ?s (current ?s) (?execs (current ?s))))) (next_action s execs) \<and> precondition (snd (snd (control ?t' (current ?t') (?execs (current ?t'))))) (next_action s execs); ifp\<^sup>*\<^sup>* (current ?s) ?u\<rbrakk> \<Longrightarrow> \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v (step (snd (snd (control ?s (current ?s) (?execs (current ?s))))) (next_action s execs)) (step (snd (snd (control ?t' (current ?t') (?execs (current ?t'))))) (next_action s execs))
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
current s = current t'

goal (1 subgoal):
 1. equivalent_states (Some (step (snd (snd (control s (current s) (execs (current s))))) (next_action s execs))) (Some (step (snd (snd (control t' (current t') (execs2 (current t'))))) (next_action t' execs2))) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
equivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some (step (next_state t' execs2) (next_action t' execs2))) u

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
from this
              IH[where u=u and ?execs2.0="(next_execs t' execs2)" and t="Some (step (next_state t' execs2) (next_action t' execs2))"]
              current_ns_nt purged_na_na2
[PROOF STATE]
proof (chain)
picking this:
equivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some (step (next_state t' execs2) (next_action t' execs2))) u
equivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some (step (next_state t' execs2) (next_action t' execs2))) u \<and> purged_relation u (next_execs s execs) (next_execs t' execs2) \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
current (step (next_state s execs) (next_action s execs)) = current (step (next_state t' execs2) (next_action t' execs2))
purged_relation u (next_execs s execs) (next_execs t' execs2)
[PROOF STEP]
have "equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs))
                                      (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u"
[PROOF STATE]
proof (prove)
using this:
equivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some (step (next_state t' execs2) (next_action t' execs2))) u
equivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some (step (next_state t' execs2) (next_action t' execs2))) u \<and> purged_relation u (next_execs s execs) (next_execs t' execs2) \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
current (step (next_state s execs) (next_action s execs)) = current (step (next_state t' execs2) (next_action t' execs2))
purged_relation u (next_execs s execs) (next_execs t' execs2)

goal (1 subgoal):
 1. equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
from ia curr_ifp_u t_prec thread_not_empty_t prec_s and this and not_interrupt and thread_not_empty_s and next_action_s_t
[PROOF STATE]
proof (chain)
picking this:
ifp\<^sup>*\<^sup>* v u
ifp\<^sup>*\<^sup>* (current s) u
precondition (next_state t' execs2) (next_action t' execs2)
\<not> thread_empty (execs2 (current t'))
precondition (next_state s execs) (next_action s execs)
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ifp\<^sup>*\<^sup>* v u
ifp\<^sup>*\<^sup>* (current s) u
precondition (next_state t' execs2) (next_action t' execs2)
\<not> thread_empty (execs2 (current t'))
precondition (next_state s execs) (next_action s execs)
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
ifp\<^sup>*\<^sup>* v u
ifp\<^sup>*\<^sup>* (current s) u
precondition (next_state t' execs2) (next_action t' execs2)
\<not> thread_empty (execs2 (current t'))
precondition (next_state s execs) (next_action s execs)
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_action t' execs2 = next_action s execs
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vpeq v rs rt

goal (1 subgoal):
 1. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
case t_not_prec
[PROOF STATE]
proof (state)
this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)

goal (1 subgoal):
 1. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
from curr_ifp_u t_not_prec thread_not_empty_t not_interrupt
[PROOF STATE]
proof (chain)
picking this:
ifp\<^sup>*\<^sup>* (current s) u
\<not> precondition (next_state t' execs2) (next_action t' execs2)
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> \<not> thread_empty (execs2 (current t'))
\<not> interrupt (Suc n)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ifp\<^sup>*\<^sup>* (current s) u
\<not> precondition (next_state t' execs2) (next_action t' execs2)
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> \<not> thread_empty (execs2 (current t'))
\<not> interrupt (Suc n)

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
using rt
[PROOF STATE]
proof (prove)
using this:
ifp\<^sup>*\<^sup>* (current s) u
\<not> precondition (next_state t' execs2) (next_action t' execs2)
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> \<not> thread_empty (execs2 (current t'))
\<not> interrupt (Suc n)
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
vpeq v rs rt

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
vpeq v rs rt

goal (1 subgoal):
 1. unrelated (current s) u \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. unrelated (current s) u \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
case curr_not_ifp_u
[PROOF STATE]
proof (state)
this:
unrelated (current s) u

goal (1 subgoal):
 1. unrelated (current s) u \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
proof (cases "thread_empty(execs2 (current t'))" rule :case_split[case_names t_empty t_not_empty])
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> vpeq v rs rt
 2. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
case t_not_empty
[PROOF STATE]
proof (state)
this:
\<not> thread_empty (execs2 (current t'))

goal (2 subgoals):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> vpeq v rs rt
 2. \<not> thread_empty (execs2 (current t')) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
proof (cases "precondition (next_state t' execs2) (next_action t' execs2)" rule :case_split[case_names t_prec t_not_prec])
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
case t_prec
[PROOF STATE]
proof (state)
this:
precondition (next_state t' execs2) (next_action t' execs2)

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
from curr_not_ifp_u t_prec IH[where u=u and ?execs2.0="(next_execs t' execs2)" and t="Some (step (next_state t' execs2) (next_action t' execs2))"]
                   current_ns_nt next_execs_t purged_na_na2 vpeq_ns_nt_not_ifp_u current_s_t vpeq_s_t prec_s purged_a_a2
[PROOF STATE]
proof (chain)
picking this:
unrelated (current s) u
precondition (next_state t' execs2) (next_action t' execs2)
equivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some (step (next_state t' execs2) (next_action t' execs2))) u \<and> purged_relation u (next_execs s execs) (next_execs t' execs2) \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
current (step (next_state s execs) (next_action s execs)) = current (step (next_state t' execs2) (next_action t' execs2))
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_execs t' execs = next_execs s execs
purged_relation u (next_execs s execs) (next_execs t' execs2)
\<lbrakk>purged_relation ?u ?execs ?execs2.0; precondition (next_state ?s ?execs) (next_action ?s ?execs); current ?s = current ?t'; \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v ?s ?t'\<rbrakk> \<Longrightarrow> unrelated (current ?s) ?u \<and> precondition (next_state ?t' ?execs2.0) (next_action ?t' ?execs2.0) \<longrightarrow> (\<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v (step (next_state ?s ?execs) (next_action ?s ?execs)) (step (next_state ?t' ?execs2.0) (next_action ?t' ?execs2.0)))
current s = current t'
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
precondition (next_state s execs) (next_action s execs)
purged_relation u execs execs2
[PROOF STEP]
have "equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs))
                                       (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u"
[PROOF STATE]
proof (prove)
using this:
unrelated (current s) u
precondition (next_state t' execs2) (next_action t' execs2)
equivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some (step (next_state t' execs2) (next_action t' execs2))) u \<and> purged_relation u (next_execs s execs) (next_execs t' execs2) \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
current (step (next_state s execs) (next_action s execs)) = current (step (next_state t' execs2) (next_action t' execs2))
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_execs t' execs = next_execs s execs
purged_relation u (next_execs s execs) (next_execs t' execs2)
\<lbrakk>purged_relation ?u ?execs ?execs2.0; precondition (next_state ?s ?execs) (next_action ?s ?execs); current ?s = current ?t'; \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v ?s ?t'\<rbrakk> \<Longrightarrow> unrelated (current ?s) ?u \<and> precondition (next_state ?t' ?execs2.0) (next_action ?t' ?execs2.0) \<longrightarrow> (\<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v (step (next_state ?s ?execs) (next_action ?s ?execs)) (step (next_state ?t' ?execs2.0) (next_action ?t' ?execs2.0)))
current s = current t'
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
precondition (next_state s execs) (next_action s execs)
purged_relation u execs execs2

goal (1 subgoal):
 1. equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u

goal (2 subgoals):
 1. precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
 2. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
from ia this t_prec curr_not_ifp_u t_not_empty prec_s not_interrupt thread_not_empty_s
[PROOF STATE]
proof (chain)
picking this:
ifp\<^sup>*\<^sup>* v u
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
precondition (next_state t' execs2) (next_action t' execs2)
unrelated (current s) u
\<not> thread_empty (execs2 (current t'))
precondition (next_state s execs) (next_action s execs)
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ifp\<^sup>*\<^sup>* v u
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
precondition (next_state t' execs2) (next_action t' execs2)
unrelated (current s) u
\<not> thread_empty (execs2 (current t'))
precondition (next_state s execs) (next_action s execs)
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
ifp\<^sup>*\<^sup>* v u
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some (step (next_state t' execs2) (next_action t' execs2))) (next_execs t' execs2)) u
precondition (next_state t' execs2) (next_action t' execs2)
unrelated (current s) u
\<not> thread_empty (execs2 (current t'))
precondition (next_state s execs) (next_action s execs)
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vpeq v rs rt

goal (1 subgoal):
 1. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
case t_not_prec
[PROOF STATE]
proof (state)
this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)

goal (1 subgoal):
 1. \<not> precondition (next_state t' execs2) (next_action t' execs2) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
from t_not_prec t_not_empty not_interrupt
[PROOF STATE]
proof (chain)
picking this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)
\<not> thread_empty (execs2 (current t'))
\<not> interrupt (Suc n)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)
\<not> thread_empty (execs2 (current t'))
\<not> interrupt (Suc n)

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
using rt
[PROOF STATE]
proof (prove)
using this:
\<not> precondition (next_state t' execs2) (next_action t' execs2)
\<not> thread_empty (execs2 (current t'))
\<not> interrupt (Suc n)
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
vpeq v rs rt

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
vpeq v rs rt

goal (1 subgoal):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
case t_empty
[PROOF STATE]
proof (state)
this:
thread_empty (execs2 (current t'))

goal (1 subgoal):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
from curr_not_ifp_u prec_s and vpeq_s_t and locally_respects and vpeq_ns_t current_next_state locally_respects_next_state
[PROOF STATE]
proof (chain)
picking this:
unrelated (current s) u
precondition (next_state s execs) (next_action s execs)
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
\<forall>a s u. \<not> ifp (current s) u \<and> kprecondition s a \<longrightarrow> vpeq u s (kstep s a)
\<lbrakk>precondition (next_state ?s ?execs) (next_action ?s ?execs); unrelated (current ?s) ?u; \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v ?s ?t\<rbrakk> \<Longrightarrow> \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v (step (next_state ?s ?execs) (next_action ?s ?execs)) ?t
\<forall>s execs. current (next_state s execs) = current s
\<forall>s u execs. \<not> ifp (current s) u \<longrightarrow> vpeq u s (next_state s execs)
[PROOF STEP]
have vpeq_ns_t: "(\<forall> v . ifp^** v u \<longrightarrow> vpeq v (step (next_state s execs) (next_action s execs)) t')"
[PROOF STATE]
proof (prove)
using this:
unrelated (current s) u
precondition (next_state s execs) (next_action s execs)
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s t'
\<forall>a s u. \<not> ifp (current s) u \<and> kprecondition s a \<longrightarrow> vpeq u s (kstep s a)
\<lbrakk>precondition (next_state ?s ?execs) (next_action ?s ?execs); unrelated (current ?s) ?u; \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v ?s ?t\<rbrakk> \<Longrightarrow> \<forall>v. ifp\<^sup>*\<^sup>* v ?u \<longrightarrow> vpeq v (step (next_state ?s ?execs) (next_action ?s ?execs)) ?t
\<forall>s execs. current (next_state s execs) = current s
\<forall>s u execs. \<not> ifp (current s) u \<longrightarrow> vpeq u s (next_state s execs)

goal (1 subgoal):
 1. \<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v (step (next_state s execs) (next_action s execs)) t'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v (step (next_state s execs) (next_action s execs)) t'

goal (1 subgoal):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
from curr_not_ifp_u IH[where t="Some t'" and u=u and ?execs2.0=execs2] and current_ns_t and next_execs_t and purged_na_a and vpeq_ns_t and this
[PROOF STATE]
proof (chain)
picking this:
unrelated (current s) u
equivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some t') u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some t') execs2) u
current (step (next_state s execs) (next_action s execs)) = current t'
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_execs t' execs = next_execs s execs
unrelated (current s) u \<longrightarrow> purged_relation u (next_execs s execs) execs2
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v (step (next_state s execs) (next_action s execs)) t'
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v (step (next_state s execs) (next_action s execs)) t'
[PROOF STEP]
have "equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs))
                                    (run n (Some t')  execs2) u"
[PROOF STATE]
proof (prove)
using this:
unrelated (current s) u
equivalent_states (Some (step (next_state s execs) (next_action s execs))) (Some t') u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some t') execs2) u
current (step (next_state s execs) (next_action s execs)) = current t'
ifp\<^sup>*\<^sup>* (current s) u \<longrightarrow> next_execs t' execs = next_execs s execs
unrelated (current s) u \<longrightarrow> purged_relation u (next_execs s execs) execs2
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v (step (next_state s execs) (next_action s execs)) t'
\<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v (step (next_state s execs) (next_action s execs)) t'

goal (1 subgoal):
 1. equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some t') execs2) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some t') execs2) u

goal (1 subgoal):
 1. thread_empty (execs2 (current t')) \<Longrightarrow> vpeq v rs rt
[PROOF STEP]
from ia this not_interrupt thread_not_empty_s t_empty prec_s
[PROOF STATE]
proof (chain)
picking this:
ifp\<^sup>*\<^sup>* v u
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some t') execs2) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
thread_empty (execs2 (current t'))
precondition (next_state s execs) (next_action s execs)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ifp\<^sup>*\<^sup>* v u
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some t') execs2) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
thread_empty (execs2 (current t'))
precondition (next_state s execs) (next_action s execs)

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
using rs rt
[PROOF STATE]
proof (prove)
using this:
ifp\<^sup>*\<^sup>* v u
equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n (Some t') execs2) u
\<not> interrupt (Suc n)
\<not> thread_empty (execs (current s))
thread_empty (execs2 (current t'))
precondition (next_state s execs) (next_action s execs)
run (Suc n) (Some s) execs = Some rs
run (Suc n) (Some t') execs2 = Some rt

goal (1 subgoal):
 1. vpeq v rs rt
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vpeq v rs rt

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
vpeq v rs rt

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
vpeq v rs rt

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
ifp\<^sup>*\<^sup>* ?v2 u \<Longrightarrow> vpeq ?v2 rs rt

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
from current_rs_rt and this
[PROOF STATE]
proof (chain)
picking this:
current rs = current rt
ifp\<^sup>*\<^sup>* ?v2 u \<Longrightarrow> vpeq ?v2 rs rt
[PROOF STEP]
have "equivalent_states (Some rs) (Some rt) u"
[PROOF STATE]
proof (prove)
using this:
current rs = current rt
ifp\<^sup>*\<^sup>* ?v2 u \<Longrightarrow> vpeq ?v2 rs rt

goal (1 subgoal):
 1. equivalent_states (Some rs) (Some rt) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
equivalent_states (Some rs) (Some rt) u

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>t = Some ?t'2; run (Suc n) (Some s) execs = Some ?rs2; run (Suc n) (Some ?t'2) execs2 = Some ?rt2; \<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s ?t'2; current s = current ?t'2; purged_relation u execs execs2\<rbrakk> \<Longrightarrow> equivalent_states (Some ?rs2) (Some ?rt2) u

goal (1 subgoal):
 1. \<And>n execs s t u execs2. \<lbrakk>\<not> interrupt (Suc n); \<not> thread_empty (execs (current s)); precondition (next_state s execs) (next_action s execs); \<And>t u execs2. equivalent_states (Some (step (next_state s execs) (next_action s execs))) t u \<and> purged_relation u (next_execs s execs) execs2 \<longrightarrow> equivalent_states (run n (Some (step (next_state s execs) (next_action s execs))) (next_execs s execs)) (run n t execs2) u\<rbrakk> \<Longrightarrow> equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>t = Some ?t'2; run (Suc n) (Some s) execs = Some ?rs2; run (Suc n) (Some ?t'2) execs2 = Some ?rt2; \<forall>v. ifp\<^sup>*\<^sup>* v u \<longrightarrow> vpeq v s ?t'2; current s = current ?t'2; purged_relation u execs execs2\<rbrakk> \<Longrightarrow> equivalent_states (Some ?rs2) (Some ?rt2) u

goal (1 subgoal):
 1. equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u
[PROOF STEP]
by(simp add:option.splits,cases t,simp+)
[PROOF STATE]
proof (state)
this:
equivalent_states (Some s) t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run (Suc n) (Some s) execs) (run (Suc n) t execs2) u

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
equivalent_states s t u \<and> purged_relation u execs execs2 \<longrightarrow> equivalent_states (run n s execs) (run n t execs2) u

goal (1 subgoal):
 1. view_partitioned_ind
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
equivalent_states ?s2 ?t2 ?u2 \<and> purged_relation ?u2 ?execs2 ?execs2.2 \<longrightarrow> equivalent_states (run ?n2 ?s2 ?execs2) (run ?n2 ?t2 ?execs2.2) ?u2

goal (1 subgoal):
 1. view_partitioned_ind
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
equivalent_states ?s2 ?t2 ?u2 \<and> purged_relation ?u2 ?execs2 ?execs2.2 \<longrightarrow> equivalent_states (run ?n2 ?s2 ?execs2) (run ?n2 ?t2 ?execs2.2) ?u2

goal (1 subgoal):
 1. view_partitioned_ind
[PROOF STEP]
unfolding view_partitioned_ind_def
[PROOF STATE]
proof (prove)
using this:
equivalent_states ?s2 ?t2 ?u2 \<and> purged_relation ?u2 ?execs2 ?execs2.2 \<longrightarrow> equivalent_states (run ?n2 ?s2 ?execs2) (run ?n2 ?t2 ?execs2.2) ?u2

goal (1 subgoal):
 1. \<forall>execs1 execs2 s t n u. equivalent_states s t u \<and> purged_relation u execs1 execs2 \<longrightarrow> equivalent_states (run n s execs1) (run n t execs2) u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
view_partitioned_ind

goal:
No subgoals!
[PROOF STEP]
qed