[STATEMENT]
lemma distinguish_from_set_properties :
  assumes "observable M1"
      and "observable M2"
      and "minimal M1"
      and "minimal M2"
      and "inputs M2 = inputs M1"
      and "outputs M2 = outputs M1"
      and "is_state_cover_assignment M1 V"
      and "V ` reachable_states M1 \<subseteq> list.set X"
      and "preserves_divergence M1 M2 (list.set X)"
      and "\<And> w . w \<in> list.set X \<Longrightarrow> \<exists> w' . converge M1 w w' \<and> converge M2 w w'"
      and "converge M1 u v"
      and "u \<in> L M2"
      and "v \<in> L M2"
      and "convergence_graph_lookup_invar M1 M2 cg_lookup G"
      and "convergence_graph_insert_invar M1 M2 cg_lookup cg_insert"
      and "\<And> \<alpha> \<beta> q1 q2 . q1 \<in> states M1 \<Longrightarrow> q2 \<in> states M1 \<Longrightarrow> q1 \<noteq> q2 \<Longrightarrow> distinguishes M1 q1 q2 (get_distinguishing_trace q1 q2)"
      and "L M1 \<inter> set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))"
      and "\<And> T w u' uBest lBest . fst (append_heuristic T w (uBest,lBest) u') \<in> {u',uBest}"
shows "\<forall> \<gamma> x y . length (\<gamma>@[(x,y)]) \<le> depth \<longrightarrow>
                  \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow>
                  x \<in> inputs M1 \<longrightarrow> y \<in> outputs M1 \<longrightarrow>
                  L M1 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma>@[(x,y)]))}) = L M2 \<inter>  (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma>@[(x,y)]))})
                  \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma>@[(x,y)]))})"
(is "?P1a X u v depth")
and     "preserves_divergence M1 M2 (list.set X \<union> {u,v})"
(is "?P1b X u v")
and   "convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))"
(is "?P2 T G u v X depth")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) &&& preserves_divergence M1 M2 (list.set X \<union> {u, v}) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (list.set X \<union> {u, v})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "?P1a X u v depth \<and> ?P1b X u v \<and> ?P2 T G u v X depth"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
using assms(8-14) assms(17)
[PROOF STATE]
proof (prove)
using this:
V ` reachable_states M1 \<subseteq> list.set X
preserves_divergence M1 M2 (list.set X)
?w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 ?w w' \<and> converge M2 ?w w'
converge M1 u v
u \<in> L M2
v \<in> L M2
convergence_graph_lookup_invar M1 M2 cg_lookup G
L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))

goal (1 subgoal):
 1. (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
proof (induction depth arbitrary: T G u v X)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
case 0
[PROOF STATE]
proof (state)
this:
V ` reachable_states M1 \<subseteq> list.set X
preserves_divergence M1 M2 (list.set X)
?w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 ?w w' \<and> converge M2 ?w w'
converge M1 u v
u \<in> L M2
v \<in> L M2
convergence_graph_lookup_invar M1 M2 cg_lookup G
L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
define TG' where TG': "TG' = spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic"
[PROOF STATE]
proof (state)
this:
TG' = spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
define vClass where vClass: "vClass = Set.insert v (list.set (cg_lookup (snd TG') v))"
[PROOF STATE]
proof (state)
this:
vClass = Set.insert v (list.set (cg_lookup (snd TG') v))

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
define notReferenced where notReferenced: "notReferenced = ((\<not> (u = v)) \<and> (\<forall> q \<in> reachable_states M1 . V q \<notin> vClass))"
[PROOF STATE]
proof (state)
this:
notReferenced = (u \<noteq> v \<and> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass))

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
define TG'' where TG'': "TG'' = (if notReferenced then spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic else TG')"
[PROOF STATE]
proof (state)
this:
TG'' = (if notReferenced then spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic else TG')

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v) = TG''"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v) = TG''
[PROOF STEP]
apply (subst distinguish_from_set.simps)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (let TG' = spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic; vClass = Set.insert v (list.set (cg_lookup (snd TG') v)); notReferenced = u \<noteq> v \<and> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass); TG'' = if notReferenced then spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic else TG' in if 0 < 0 then let X' = if notReferenced then v # u # X else u # X; XY = List.product (inputs_as_list M1) (outputs_as_list M1); handleIO = \<lambda>(T, G) (x, y). let TGu = distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic; TGv = if u = v then TGu else distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic in if is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) then distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k (0 - 1) completeInputTraces append_heuristic (u = v) else TGv in foldl handleIO TG'' XY else TG'') = TG''
[PROOF STEP]
unfolding TG' vClass notReferenced TG'' Let_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if 0 < 0 then foldl (\<lambda>(T, G) (x, y). if is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) then distinguish_from_set M1 V (fst (if u = v then distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic else distribute_extension M1 (fst (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) (snd (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)) (snd (if u = v then distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic else distribute_extension M1 (fst (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) (snd (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) (if u \<noteq> v \<and> (\<forall>q\<in>reachable_states M1. V q \<notin> Set.insert v (list.set (cg_lookup (snd (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) v))) then v # u # X else u # X) k (0 - 1) completeInputTraces append_heuristic (u = v) else if u = v then distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic else distribute_extension M1 (fst (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) (snd (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic) (if u \<noteq> v \<and> (\<forall>q\<in>reachable_states M1. V q \<notin> Set.insert v (list.set (cg_lookup (snd (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) v))) then spyh_distinguish M1 (fst (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) (snd (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic else spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic) (List.product (inputs_as_list M1) (outputs_as_list M1)) else if u \<noteq> v \<and> (\<forall>q\<in>reachable_states M1. V q \<notin> Set.insert v (list.set (cg_lookup (snd (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) v))) then spyh_distinguish M1 (fst (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) (snd (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic else spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic) = (if u \<noteq> v \<and> (\<forall>q\<in>reachable_states M1. V q \<notin> Set.insert v (list.set (cg_lookup (snd (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) v))) then spyh_distinguish M1 (fst (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) (snd (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic else spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v) = TG''

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "set T \<subseteq> set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
using distinguish_from_set_subset
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (distinguish_from_set ?M ?V ?T ?G ?cg_lookup ?cg_insert ?get_distinguishing_trace ?u ?v ?X ?k ?depth ?completeInputTraces ?append_heuristic ?u_is_v))

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "L M1 \<inter> set T = L M2 \<inter> set T"
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
[PROOF STEP]
using  "0.prems"(8)
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "list.set X \<subseteq> L M1" and "list.set X \<subseteq> L M2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list.set X \<subseteq> L M1 &&& list.set X \<subseteq> L M2
[PROOF STEP]
using "0.prems"(3)
[PROOF STATE]
proof (prove)
using this:
?w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 ?w w' \<and> converge M2 ?w w'

goal (1 subgoal):
 1. list.set X \<subseteq> L M1 &&& list.set X \<subseteq> L M2
[PROOF STEP]
by (meson converge.elims(2) subsetI)+
[PROOF STATE]
proof (state)
this:
list.set X \<subseteq> L M1
list.set X \<subseteq> L M2

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "set (fst TG') \<subseteq> set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (fst TG') \<subseteq> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
by (metis TG'' \<open>distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v) = TG''\<close> order_refl spyh_distinguish_subset)
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst TG') \<subseteq> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set (fst TG') \<subseteq> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have *: "L M1 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) =
                    L M2 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic))"
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TG') \<subseteq> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic))
[PROOF STEP]
using "0.prems"(8)
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TG') \<subseteq> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic))
[PROOF STEP]
unfolding TG'
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) \<subseteq> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic))

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "u \<in> L M1" and "v \<in> L M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. u \<in> L M1 &&& v \<in> L M1
[PROOF STEP]
using \<open>converge M1 u v\<close>
[PROOF STATE]
proof (prove)
using this:
converge M1 u v

goal (1 subgoal):
 1. u \<in> L M1 &&& v \<in> L M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
u \<in> L M1
v \<in> L M1

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "preserves_divergence M1 M2 (Set.insert u (list.set X))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert u (list.set X))
[PROOF STEP]
using spyh_distinguish_preserves_divergence[OF assms(1-4) \<open>u \<in> L M1\<close> \<open>u \<in> L M2\<close> assms(16) "0.prems"(7) assms(15) \<open>list.set X \<subseteq> L M1\<close> \<open>list.set X \<subseteq> L M2\<close> * assms(18) "0.prems"(2)]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (Set.insert u (list.set X))

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert u (list.set X))
[PROOF STEP]
unfolding TG'
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (Set.insert u (list.set X))

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert u (list.set X))
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (Set.insert u (list.set X))

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')
[PROOF STEP]
unfolding TG'
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic))
[PROOF STEP]
using spyh_distinguish_establishes_divergence[OF assms(1-4) \<open>u \<in> L M1\<close> \<open>u \<in> L M2\<close> assms(16) "0.prems"(7) assms(15) \<open>list.set X \<subseteq> L M1\<close> \<open>list.set X \<subseteq> L M2\<close> * assms(18)]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2\<rbrakk> \<Longrightarrow> \<forall>v. v \<in> list.set X \<longrightarrow> \<not> converge M1 u v \<longrightarrow> \<not> converge M2 u v
\<lbrakk>\<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic))
[PROOF STEP]
by linarith
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "L M1 \<inter> set (fst TG'') = L M2 \<inter> set (fst TG'')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst TG'') = L M2 \<inter> Prefix_Tree.set (fst TG'')
[PROOF STEP]
using "0.prems"(8)
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst TG'') = L M2 \<inter> Prefix_Tree.set (fst TG'')
[PROOF STEP]
unfolding \<open>distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v) = TG''\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst TG'') = L M2 \<inter> Prefix_Tree.set (fst TG'')

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst TG'') = L M2 \<inter> Prefix_Tree.set (fst TG'')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst TG'') = L M2 \<inter> Prefix_Tree.set (fst TG'')

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "preserves_divergence M1 M2 (Set.insert v (list.set X))"
    and  "convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X))
 2. convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
have "preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
proof (cases "notReferenced")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
 2. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
notReferenced

goal (2 subgoals):
 1. notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
 2. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
notReferenced
[PROOF STEP]
have "TG'' = spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic"
[PROOF STATE]
proof (prove)
using this:
notReferenced

goal (1 subgoal):
 1. TG'' = spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic
[PROOF STEP]
unfolding TG''
[PROOF STATE]
proof (prove)
using this:
notReferenced

goal (1 subgoal):
 1. (if notReferenced then spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic else TG') = spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
TG'' = spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic

goal (2 subgoals):
 1. notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
 2. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
TG'' = spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic
[PROOF STEP]
have *: "L M1 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic)) =
                    L M2 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic))"
[PROOF STATE]
proof (prove)
using this:
TG'' = spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic))
[PROOF STEP]
using \<open>L M1 \<inter> set (fst TG'') = L M2 \<inter> set (fst TG'')\<close>
[PROOF STATE]
proof (prove)
using this:
TG'' = spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic
L M1 \<inter> Prefix_Tree.set (fst TG'') = L M2 \<inter> Prefix_Tree.set (fst TG'')

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic))

goal (2 subgoals):
 1. notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
 2. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
using spyh_distinguish_preserves_divergence[OF assms(1-4) \<open>v \<in> L M1\<close> \<open>v \<in> L M2\<close> assms(16) \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')\<close> assms(15) \<open>list.set X \<subseteq> L M1\<close> \<open>list.set X \<subseteq> L M2\<close> * assms(18) "0.prems"(2)]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X))

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
using spyh_distinguish_establishes_divergence(2)[OF assms(1-4) \<open>v \<in> L M1\<close> \<open>v \<in> L M2\<close> assms(16) \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')\<close> assms(15) \<open>list.set X \<subseteq> L M1\<close> \<open>list.set X \<subseteq> L M2\<close> * assms(18)]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X))
\<lbrakk>\<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic))

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
unfolding \<open>TG'' = spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic\<close>
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X))
\<lbrakk>\<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic))

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic))
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')

goal (1 subgoal):
 1. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> notReferenced

goal (1 subgoal):
 1. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> notReferenced
[PROOF STEP]
consider "u = v" | "(u \<noteq> v) \<and> \<not>(\<forall> q \<in> reachable_states M1 . V q \<notin> vClass)"
[PROOF STATE]
proof (prove)
using this:
\<not> notReferenced

goal (1 subgoal):
 1. \<lbrakk>u = v \<Longrightarrow> thesis; u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
unfolding notReferenced
[PROOF STATE]
proof (prove)
using this:
\<not> (u \<noteq> v \<and> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass))

goal (1 subgoal):
 1. \<lbrakk>u = v \<Longrightarrow> thesis; u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>u = v \<Longrightarrow> ?thesis; u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>u = v \<Longrightarrow> ?thesis; u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>u = v \<Longrightarrow> ?thesis; u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
proof cases
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. u = v \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
 2. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:
u = v

goal (2 subgoals):
 1. u = v \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
 2. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u = v
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
u = v

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
using False TG'' \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')\<close> \<open>preserves_divergence M1 M2 (Set.insert u (list.set X))\<close>
[PROOF STATE]
proof (prove)
using this:
u = v
\<not> notReferenced
TG'' = (if notReferenced then spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic else TG')
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')
preserves_divergence M1 M2 (Set.insert u (list.set X))

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass)

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass)
[PROOF STEP]
have "TG'' = TG'"
[PROOF STATE]
proof (prove)
using this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass)

goal (1 subgoal):
 1. TG'' = TG'
[PROOF STEP]
unfolding TG''
[PROOF STATE]
proof (prove)
using this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass)

goal (1 subgoal):
 1. (if notReferenced then spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic else TG') = TG'
[PROOF STEP]
using False
[PROOF STATE]
proof (prove)
using this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass)
\<not> notReferenced

goal (1 subgoal):
 1. (if notReferenced then spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic else TG') = TG'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
TG'' = TG'

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
obtain q where "q \<in> reachable_states M1"
                     and "V q \<in> Set.insert v (list.set (cg_lookup (snd TG') v))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>q. \<lbrakk>q \<in> reachable_states M1; V q \<in> Set.insert v (list.set (cg_lookup (snd TG') v))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using 2
[PROOF STATE]
proof (prove)
using this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass)

goal (1 subgoal):
 1. (\<And>q. \<lbrakk>q \<in> reachable_states M1; V q \<in> Set.insert v (list.set (cg_lookup (snd TG') v))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding notReferenced vClass
[PROOF STATE]
proof (prove)
using this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> Set.insert v (list.set (cg_lookup (snd TG') v)))

goal (1 subgoal):
 1. (\<And>q. \<lbrakk>q \<in> reachable_states M1; V q \<in> Set.insert v (list.set (cg_lookup (snd TG') v))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
q \<in> reachable_states M1
V q \<in> Set.insert v (list.set (cg_lookup (snd TG') v))

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
have "converge M1 (V q) v" and "converge M2 (V q) v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. converge M1 (V q) v &&& converge M2 (V q) v
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. converge M1 (V q) v
 2. converge M2 (V q) v
[PROOF STEP]
have "converge M1 v (V q) \<and> converge M2 v (V q)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
proof (cases "V q = v")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. V q = v \<Longrightarrow> converge M1 v (V q) \<and> converge M2 v (V q)
 2. V q \<noteq> v \<Longrightarrow> converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
V q = v

goal (2 subgoals):
 1. V q = v \<Longrightarrow> converge M1 v (V q) \<and> converge M2 v (V q)
 2. V q \<noteq> v \<Longrightarrow> converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V q = v
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
V q = v

goal (1 subgoal):
 1. converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
using \<open>v \<in> L M1\<close> \<open>v \<in> L M2\<close>
[PROOF STATE]
proof (prove)
using this:
V q = v
v \<in> L M1
v \<in> L M2

goal (1 subgoal):
 1. converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M1 v (V q) \<and> converge M2 v (V q)

goal (1 subgoal):
 1. V q \<noteq> v \<Longrightarrow> converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. V q \<noteq> v \<Longrightarrow> converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
V q \<noteq> v

goal (1 subgoal):
 1. V q \<noteq> v \<Longrightarrow> converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V q \<noteq> v
[PROOF STEP]
have "V q \<in> list.set (cg_lookup (snd TG') v)"
[PROOF STATE]
proof (prove)
using this:
V q \<noteq> v

goal (1 subgoal):
 1. V q \<in> list.set (cg_lookup (snd TG') v)
[PROOF STEP]
using \<open>V q \<in> Set.insert v (list.set (cg_lookup (snd TG') v))\<close>
[PROOF STATE]
proof (prove)
using this:
V q \<noteq> v
V q \<in> Set.insert v (list.set (cg_lookup (snd TG') v))

goal (1 subgoal):
 1. V q \<in> list.set (cg_lookup (snd TG') v)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V q \<in> list.set (cg_lookup (snd TG') v)

goal (1 subgoal):
 1. V q \<noteq> v \<Longrightarrow> converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V q \<in> list.set (cg_lookup (snd TG') v)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
V q \<in> list.set (cg_lookup (snd TG') v)

goal (1 subgoal):
 1. converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
using \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')\<close>
[PROOF STATE]
proof (prove)
using this:
V q \<in> list.set (cg_lookup (snd TG') v)
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')

goal (1 subgoal):
 1. converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
unfolding convergence_graph_lookup_invar_def
[PROOF STATE]
proof (prove)
using this:
V q \<in> list.set (cg_lookup (snd TG') v)
\<forall>\<alpha>. \<alpha> \<in> L M1 \<longrightarrow> \<alpha> \<in> L M2 \<longrightarrow> \<alpha> \<in> list.set (cg_lookup (snd TG') \<alpha>) \<and> (\<forall>\<beta>. \<beta> \<in> list.set (cg_lookup (snd TG') \<alpha>) \<longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)

goal (1 subgoal):
 1. converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
using "0.prems"(6) \<open>v \<in> L M1\<close>
[PROOF STATE]
proof (prove)
using this:
V q \<in> list.set (cg_lookup (snd TG') v)
\<forall>\<alpha>. \<alpha> \<in> L M1 \<longrightarrow> \<alpha> \<in> L M2 \<longrightarrow> \<alpha> \<in> list.set (cg_lookup (snd TG') \<alpha>) \<and> (\<forall>\<beta>. \<beta> \<in> list.set (cg_lookup (snd TG') \<alpha>) \<longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)
v \<in> L M2
v \<in> L M1

goal (1 subgoal):
 1. converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
converge M1 v (V q) \<and> converge M2 v (V q)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
converge M1 v (V q) \<and> converge M2 v (V q)

goal (2 subgoals):
 1. converge M1 (V q) v
 2. converge M2 (V q) v
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
show "converge M1 (V q) v" and "converge M2 (V q) v"
[PROOF STATE]
proof (prove)
using this:
converge M1 v (V q) \<and> converge M2 v (V q)

goal (1 subgoal):
 1. converge M1 (V q) v &&& converge M2 (V q) v
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M1 (V q) v
converge M2 (V q) v

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
converge M1 (V q) v
converge M2 (V q) v

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
have "V q \<in> Set.insert u (list.set X)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V q \<in> Set.insert u (list.set X)
[PROOF STEP]
using \<open>q \<in> reachable_states M1\<close> "0.prems"(1)
[PROOF STATE]
proof (prove)
using this:
q \<in> reachable_states M1
V ` reachable_states M1 \<subseteq> list.set X

goal (1 subgoal):
 1. V q \<in> Set.insert u (list.set X)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V q \<in> Set.insert u (list.set X)

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
have "preserves_divergence M1 M2 (Set.insert v (list.set X))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X))
[PROOF STEP]
using preserves_divergence_converge_insert[OF assms(1-4) \<open>converge M1 (V q) v\<close> \<open>converge M2 (V q) v\<close> \<open>preserves_divergence M1 M2 (Set.insert u (list.set X))\<close> \<open>V q \<in> Set.insert u (list.set X)\<close>]
[PROOF STATE]
proof (prove)
using this:
preserves_divergence M1 M2 (Set.insert v (Set.insert u (list.set X)))

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X))
[PROOF STEP]
unfolding preserves_divergence.simps
[PROOF STATE]
proof (prove)
using this:
\<forall>\<alpha>\<in>L M1 \<inter> Set.insert v (Set.insert u (list.set X)). \<forall>\<beta>\<in>L M1 \<inter> Set.insert v (Set.insert u (list.set X)). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>

goal (1 subgoal):
 1. \<forall>\<alpha>\<in>L M1 \<inter> Set.insert v (list.set X). \<forall>\<beta>\<in>L M1 \<inter> Set.insert v (list.set X). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (Set.insert v (list.set X))

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
preserves_divergence M1 M2 (Set.insert v (list.set X))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
preserves_divergence M1 M2 (Set.insert v (list.set X))

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
unfolding \<open>TG'' = TG'\<close>
[PROOF STATE]
proof (prove)
using this:
preserves_divergence M1 M2 (Set.insert v (list.set X))

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')
[PROOF STEP]
using \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')\<close>
[PROOF STATE]
proof (prove)
using this:
preserves_divergence M1 M2 (Set.insert v (list.set X))
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')

goal (2 subgoals):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X))
 2. convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
show "preserves_divergence M1 M2 (Set.insert v (list.set X))" and  "convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')"
[PROOF STATE]
proof (prove)
using this:
preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (Set.insert v (list.set X))
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (Set.insert v (list.set X))
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "converge M1 u u" and "converge M1 v v" and "converge M1 v u" and "converge M1 u v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (converge M1 u u &&& converge M1 v v) &&& converge M1 v u &&& converge M1 u v
[PROOF STEP]
using \<open>u \<in> L M1\<close> \<open>v \<in> L M1\<close> \<open>converge M1 u v\<close>
[PROOF STATE]
proof (prove)
using this:
u \<in> L M1
v \<in> L M1
converge M1 u v

goal (1 subgoal):
 1. (converge M1 u u &&& converge M1 v v) &&& converge M1 v u &&& converge M1 u v
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M1 u u
converge M1 v v
converge M1 v u
converge M1 u v

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
converge M1 u u
converge M1 v v
converge M1 v u
converge M1 u v
[PROOF STEP]
have "preserves_divergence M1 M2 (Set.insert u (Set.insert v (list.set X)))"
[PROOF STATE]
proof (prove)
using this:
converge M1 u u
converge M1 v v
converge M1 v u
converge M1 u v

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert u (Set.insert v (list.set X)))
[PROOF STEP]
using \<open>preserves_divergence M1 M2 (Set.insert v (list.set X))\<close>
            \<open>preserves_divergence M1 M2 (Set.insert u (list.set X))\<close>
[PROOF STATE]
proof (prove)
using this:
converge M1 u u
converge M1 v v
converge M1 v u
converge M1 u v
preserves_divergence M1 M2 (Set.insert v (list.set X))
preserves_divergence M1 M2 (Set.insert u (list.set X))

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert u (Set.insert v (list.set X)))
[PROOF STEP]
unfolding preserves_divergence.simps
[PROOF STATE]
proof (prove)
using this:
converge M1 u u
converge M1 v v
converge M1 v u
converge M1 u v
\<forall>\<alpha>\<in>L M1 \<inter> Set.insert v (list.set X). \<forall>\<beta>\<in>L M1 \<inter> Set.insert v (list.set X). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>
\<forall>\<alpha>\<in>L M1 \<inter> Set.insert u (list.set X). \<forall>\<beta>\<in>L M1 \<inter> Set.insert u (list.set X). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>

goal (1 subgoal):
 1. \<forall>\<alpha>\<in>L M1 \<inter> Set.insert u (Set.insert v (list.set X)). \<forall>\<beta>\<in>L M1 \<inter> Set.insert u (Set.insert v (list.set X)). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (Set.insert u (Set.insert v (list.set X)))

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
preserves_divergence M1 M2 (Set.insert u (Set.insert v (list.set X)))
[PROOF STEP]
have "?P1b X u v"
[PROOF STATE]
proof (prove)
using this:
preserves_divergence M1 M2 (Set.insert u (Set.insert v (list.set X)))

goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set X \<union> {u, v})
[PROOF STEP]
by (metis Un_insert_right sup_bot_right)
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (list.set X \<union> {u, v})

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (list.set X \<union> {u, v})

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "?P2 T G u v X 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
using \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')\<close>
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
using \<open>distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v) = TG''\<close>
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v) = TG''

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have P1: "?P1a X u v 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})

goal (2 subgoals):
 1. \<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
 2. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
preserves_divergence M1 M2 (list.set X \<union> {u, v})
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
preserves_divergence M1 M2 (list.set X \<union> {u, v})
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})

goal (1 subgoal):
 1. (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> 0 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k 0 completeInputTraces append_heuristic (u = v)))

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
case (Suc depth)
[PROOF STATE]
proof (state)
this:
\<lbrakk>V ` reachable_states M1 \<subseteq> list.set ?X; preserves_divergence M1 M2 (list.set ?X); \<And>w. w \<in> list.set ?X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 ?u ?v; ?u \<in> L M2; ?v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup ?G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V ?T ?G cg_lookup cg_insert get_distinguishing_trace ?u ?v ?X k depth completeInputTraces append_heuristic (?u = ?v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V ?T ?G cg_lookup cg_insert get_distinguishing_trace ?u ?v ?X k depth completeInputTraces append_heuristic (?u = ?v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 ?u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set ?X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {?u, ?v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set ?X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {?u, ?v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set ?X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {?u, ?v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set ?X \<union> {?u, ?v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V ?T ?G cg_lookup cg_insert get_distinguishing_trace ?u ?v ?X k depth completeInputTraces append_heuristic (?u = ?v)))
V ` reachable_states M1 \<subseteq> list.set X
preserves_divergence M1 M2 (list.set X)
?w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 ?w w' \<and> converge M2 ?w w'
converge M1 u v
u \<in> L M2
v \<in> L M2
convergence_graph_lookup_invar M1 M2 cg_lookup G
L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "0 < Suc depth = True"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (0 < Suc depth) = True
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(0 < Suc depth) = True

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "Suc depth - 1 = depth"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Suc depth - 1 = depth
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Suc depth - 1 = depth

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "u \<in> L M1" and "v \<in> L M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. u \<in> L M1 &&& v \<in> L M1
[PROOF STEP]
using \<open>converge M1 u v\<close>
[PROOF STATE]
proof (prove)
using this:
converge M1 u v

goal (1 subgoal):
 1. u \<in> L M1 &&& v \<in> L M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
u \<in> L M1
v \<in> L M1

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
define TG' where TG': "TG' = spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic"
[PROOF STATE]
proof (state)
this:
TG' = spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
define vClass where vClass: "vClass = Set.insert v (list.set (cg_lookup (snd TG') v))"
[PROOF STATE]
proof (state)
this:
vClass = Set.insert v (list.set (cg_lookup (snd TG') v))

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
define notReferenced where notReferenced: "notReferenced = (\<not>(u = v) \<and> (\<forall> q \<in> reachable_states M1 . V q \<notin> vClass))"
[PROOF STATE]
proof (state)
this:
notReferenced = (u \<noteq> v \<and> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass))

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
define TG'' where TG'': "TG'' = (if notReferenced then spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic else TG')"
[PROOF STATE]
proof (state)
this:
TG'' = (if notReferenced then spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic else TG')

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
define X' where X': "X' = (if notReferenced then (v#u#X) else (u#X))"
[PROOF STATE]
proof (state)
this:
X' = (if notReferenced then v # u # X else u # X)

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
define XY where XY: "XY = List.product (inputs_as_list M1) (outputs_as_list M1)"
[PROOF STATE]
proof (state)
this:
XY = List.product (inputs_as_list M1) (outputs_as_list M1)

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
define handleIO where handleIO: "handleIO = (\<lambda> (T,G) (x,y). (let TGu = distribute_extension M1 T G cg_lookup cg_insert u [(x,y)] completeInputTraces append_heuristic;
                                                 TGv = if (u = v) then TGu else distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x,y)] completeInputTraces append_heuristic
                                             in if is_in_language M1 (initial M1) (u@[(x,y)])
                                                  then distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u@[(x,y)]) (v@[(x,y)]) X' k depth completeInputTraces append_heuristic (u = v)
                                                  else TGv))"
[PROOF STATE]
proof (state)
this:
handleIO = (\<lambda>(T, G) (x, y). let TGu = distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic; TGv = if u = v then TGu else distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic in if is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) then distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u = v) else TGv)

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have result: "distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v) = foldl handleIO TG'' XY"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v) = foldl handleIO TG'' XY
[PROOF STEP]
apply (subst distinguish_from_set.simps)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (let TG' = spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic; vClass = Set.insert v (list.set (cg_lookup (snd TG') v)); notReferenced = u \<noteq> v \<and> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass); TG'' = if notReferenced then spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic else TG' in if 0 < Suc depth then let X' = if notReferenced then v # u # X else u # X; XY = List.product (inputs_as_list M1) (outputs_as_list M1); handleIO = \<lambda>(T, G) (x, y). let TGu = distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic; TGv = if u = v then TGu else distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic in if is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) then distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k (Suc depth - 1) completeInputTraces append_heuristic (u = v) else TGv in foldl handleIO TG'' XY else TG'') = foldl handleIO TG'' XY
[PROOF STEP]
unfolding TG' vClass notReferenced TG'' X' XY handleIO \<open>0 < Suc depth = True\<close> case_prod_conv \<open>Suc depth - 1 = depth\<close> if_True Let_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. foldl (\<lambda>(T, G) (x, y). if is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) then distinguish_from_set M1 V (fst (if u = v then distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic else distribute_extension M1 (fst (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) (snd (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)) (snd (if u = v then distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic else distribute_extension M1 (fst (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) (snd (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) (if u \<noteq> v \<and> (\<forall>q\<in>reachable_states M1. V q \<notin> Set.insert v (list.set (cg_lookup (snd (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) v))) then v # u # X else u # X) k depth completeInputTraces append_heuristic (u = v) else if u = v then distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic else distribute_extension M1 (fst (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) (snd (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic) (if u \<noteq> v \<and> (\<forall>q\<in>reachable_states M1. V q \<notin> Set.insert v (list.set (cg_lookup (snd (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) v))) then spyh_distinguish M1 (fst (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) (snd (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic else spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic) (List.product (inputs_as_list M1) (outputs_as_list M1)) = foldl (\<lambda>(T, G) (x, y). if is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) then distinguish_from_set M1 V (fst (if u = v then distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic else distribute_extension M1 (fst (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) (snd (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)) (snd (if u = v then distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic else distribute_extension M1 (fst (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) (snd (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) (if u \<noteq> v \<and> (\<forall>q\<in>reachable_states M1. V q \<notin> Set.insert v (list.set (cg_lookup (snd (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) v))) then v # u # X else u # X) k depth completeInputTraces append_heuristic (u = v) else if u = v then distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic else distribute_extension M1 (fst (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) (snd (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic) (if u \<noteq> v \<and> (\<forall>q\<in>reachable_states M1. V q \<notin> Set.insert v (list.set (cg_lookup (snd (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) v))) then spyh_distinguish M1 (fst (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) (snd (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic else spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic) (List.product (inputs_as_list M1) (outputs_as_list M1))
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v) = foldl handleIO TG'' XY

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v) = foldl handleIO TG'' XY
[PROOF STEP]
have pass_result: "L M1 \<inter> set (fst (foldl handleIO TG'' XY)) = L M2 \<inter> set (fst (foldl handleIO TG'' XY))"
[PROOF STATE]
proof (prove)
using this:
distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v) = foldl handleIO TG'' XY

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO TG'' XY)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO TG'' XY))
[PROOF STEP]
using Suc.prems(8)
[PROOF STATE]
proof (prove)
using this:
distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v) = foldl handleIO TG'' XY
L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO TG'' XY)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO TG'' XY))
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO TG'' XY)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO TG'' XY))

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have handleIO_subset : "\<And> x y T G . set T \<subseteq> set (fst (handleIO (T,G) (x,y)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x y T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (handleIO (T, G) (x, y)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x y T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (handleIO (T, G) (x, y)))
[PROOF STEP]
fix x y T G
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x y T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (handleIO (T, G) (x, y)))
[PROOF STEP]
define TGu where TGu: "TGu = distribute_extension M1 T G cg_lookup cg_insert u [(x,y)] completeInputTraces append_heuristic"
[PROOF STATE]
proof (state)
this:
TGu = distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic

goal (1 subgoal):
 1. \<And>x y T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (handleIO (T, G) (x, y)))
[PROOF STEP]
define TGv where TGv: "TGv = (if (u = v) then TGu else distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x,y)] completeInputTraces append_heuristic)"
[PROOF STATE]
proof (state)
this:
TGv = (if u = v then TGu else distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)

goal (1 subgoal):
 1. \<And>x y T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (handleIO (T, G) (x, y)))
[PROOF STEP]
have handleIO: "handleIO (T,G) (x,y) = (if is_in_language M1 (initial M1) (u@[(x,y)])
                                                  then distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u@[(x,y)]) (v@[(x,y)]) X' k depth completeInputTraces append_heuristic (u = v)
                                                  else TGv)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. handleIO (T, G) (x, y) = (if is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) then distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u = v) else TGv)
[PROOF STEP]
unfolding handleIO TGu TGv case_prod_conv Let_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) then distinguish_from_set M1 V (fst (if u = v then distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic else distribute_extension M1 (fst (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) (snd (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)) (snd (if u = v then distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic else distribute_extension M1 (fst (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) (snd (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u = v) else if u = v then distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic else distribute_extension M1 (fst (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) (snd (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic) = (if is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) then distinguish_from_set M1 V (fst (if u = v then distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic else distribute_extension M1 (fst (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) (snd (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)) (snd (if u = v then distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic else distribute_extension M1 (fst (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) (snd (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u = v) else if u = v then distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic else distribute_extension M1 (fst (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) (snd (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
handleIO (T, G) (x, y) = (if is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) then distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u = v) else TGv)

goal (1 subgoal):
 1. \<And>x y T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (handleIO (T, G) (x, y)))
[PROOF STEP]
have "set T \<subseteq> set (fst TGu)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TGu)
[PROOF STEP]
using distribute_extension_subset[of T]
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (distribute_extension ?M T ?G ?cg_lookup ?cg_insert ?u ?w ?b ?heuristic))

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TGu)
[PROOF STEP]
unfolding TGu
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (distribute_extension ?M T ?G ?cg_lookup ?cg_insert ?u ?w ?b ?heuristic))

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T G cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic))
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TGu)

goal (1 subgoal):
 1. \<And>x y T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (handleIO (T, G) (x, y)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TGu)

goal (1 subgoal):
 1. \<And>x y T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (handleIO (T, G) (x, y)))
[PROOF STEP]
have "set (fst TGu) \<subseteq> set (fst TGv)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (fst TGu) \<subseteq> Prefix_Tree.set (fst TGv)
[PROOF STEP]
using distribute_extension_subset[of "fst TGu"]
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TGu) \<subseteq> Prefix_Tree.set (fst (distribute_extension ?M (fst TGu) ?G ?cg_lookup ?cg_insert ?u ?w ?b ?heuristic))

goal (1 subgoal):
 1. Prefix_Tree.set (fst TGu) \<subseteq> Prefix_Tree.set (fst TGv)
[PROOF STEP]
unfolding TGv
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TGu) \<subseteq> Prefix_Tree.set (fst (distribute_extension ?M (fst TGu) ?G ?cg_lookup ?cg_insert ?u ?w ?b ?heuristic))

goal (1 subgoal):
 1. Prefix_Tree.set (fst TGu) \<subseteq> Prefix_Tree.set (fst (if u = v then TGu else distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic))
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst TGu) \<subseteq> Prefix_Tree.set (fst TGv)

goal (1 subgoal):
 1. \<And>x y T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (handleIO (T, G) (x, y)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst TGu) \<subseteq> Prefix_Tree.set (fst TGv)

goal (1 subgoal):
 1. \<And>x y T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (handleIO (T, G) (x, y)))
[PROOF STEP]
have "set (fst TGv) \<subseteq> set (fst (handleIO (T,G) (x,y)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (fst TGv) \<subseteq> Prefix_Tree.set (fst (handleIO (T, G) (x, y)))
[PROOF STEP]
unfolding handleIO
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (fst TGv) \<subseteq> Prefix_Tree.set (fst (if is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) then distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u = v) else TGv))
[PROOF STEP]
using distinguish_from_set_subset[of "fst TGv" M1 V "snd TGv" cg_lookup cg_insert get_distinguishing_trace "u@[(x,y)]" "v@[(x,y)]" X' k depth]
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TGv) \<subseteq> Prefix_Tree.set (fst (distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth ?completeInputTraces ?append_heuristic ?u_is_v))

goal (1 subgoal):
 1. Prefix_Tree.set (fst TGv) \<subseteq> Prefix_Tree.set (fst (if is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) then distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u = v) else TGv))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst TGv) \<subseteq> Prefix_Tree.set (fst (handleIO (T, G) (x, y)))

goal (1 subgoal):
 1. \<And>x y T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (handleIO (T, G) (x, y)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TGu)
Prefix_Tree.set (fst TGu) \<subseteq> Prefix_Tree.set (fst TGv)
Prefix_Tree.set (fst TGv) \<subseteq> Prefix_Tree.set (fst (handleIO (T, G) (x, y)))
[PROOF STEP]
show "set T \<subseteq> set (fst (handleIO (T,G) (x,y)))"
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TGu)
Prefix_Tree.set (fst TGu) \<subseteq> Prefix_Tree.set (fst TGv)
Prefix_Tree.set (fst TGv) \<subseteq> Prefix_Tree.set (fst (handleIO (T, G) (x, y)))

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (handleIO (T, G) (x, y)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (handleIO (T, G) (x, y)))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (handleIO (?T, ?G) (?x, ?y)))

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have result_subset: "set (fst TG'') \<subseteq> set (fst (foldl handleIO TG'' XY))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' XY))
[PROOF STEP]
proof (induction XY rule: rev_induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' []))
 2. \<And>x xs. Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' xs)) \<Longrightarrow> Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' (xs @ [x])))
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:

goal (2 subgoals):
 1. Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' []))
 2. \<And>x xs. Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' xs)) \<Longrightarrow> Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' (xs @ [x])))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' []))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' []))

goal (1 subgoal):
 1. \<And>x xs. Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' xs)) \<Longrightarrow> Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' (xs @ [x])))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x xs. Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' xs)) \<Longrightarrow> Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' (xs @ [x])))
[PROOF STEP]
case (snoc x xs)
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' xs))

goal (1 subgoal):
 1. \<And>x xs. Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' xs)) \<Longrightarrow> Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' (xs @ [x])))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' xs))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' xs))

goal (1 subgoal):
 1. Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' (xs @ [x])))
[PROOF STEP]
using handleIO_subset[of "fst (foldl handleIO TG'' xs)" "snd (foldl handleIO TG'' xs)" "fst x" "snd x"]
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' xs))
Prefix_Tree.set (fst (foldl handleIO TG'' xs)) \<subseteq> Prefix_Tree.set (fst (handleIO (fst (foldl handleIO TG'' xs), snd (foldl handleIO TG'' xs)) (fst x, snd x)))

goal (1 subgoal):
 1. Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' (xs @ [x])))
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' (xs @ [x])))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' XY))

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' XY))
[PROOF STEP]
have pass_TG'' : "L M1 \<inter> set (fst TG'') = L M2 \<inter> set (fst TG'')"
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' XY))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst TG'') = L M2 \<inter> Prefix_Tree.set (fst TG'')
[PROOF STEP]
using pass_result
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TG'') \<subseteq> Prefix_Tree.set (fst (foldl handleIO TG'' XY))
L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO TG'' XY)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO TG'' XY))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst TG'') = L M2 \<inter> Prefix_Tree.set (fst TG'')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst TG'') = L M2 \<inter> Prefix_Tree.set (fst TG'')

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "set (fst TG') \<subseteq> set (fst TG'')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (fst TG') \<subseteq> Prefix_Tree.set (fst TG'')
[PROOF STEP]
unfolding TG''
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (fst TG') \<subseteq> Prefix_Tree.set (fst (if notReferenced then spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic else TG'))
[PROOF STEP]
using spyh_distinguish_subset
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (spyh_distinguish ?M ?T ?G ?cg_lookup ?cg_insert ?get_distinguishing_trace ?u ?X ?k ?completeInputTraces ?append_heuristic))

goal (1 subgoal):
 1. Prefix_Tree.set (fst TG') \<subseteq> Prefix_Tree.set (fst (if notReferenced then spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic else TG'))
[PROOF STEP]
by (metis (mono_tags, lifting) equalityE)
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst TG') \<subseteq> Prefix_Tree.set (fst TG'')

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set (fst TG') \<subseteq> Prefix_Tree.set (fst TG'')
[PROOF STEP]
have pass_TG': "L M1 \<inter> set (fst TG') = L M2 \<inter> set (fst TG')"
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TG') \<subseteq> Prefix_Tree.set (fst TG'')

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst TG') = L M2 \<inter> Prefix_Tree.set (fst TG')
[PROOF STEP]
using pass_TG''
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TG') \<subseteq> Prefix_Tree.set (fst TG'')
L M1 \<inter> Prefix_Tree.set (fst TG'') = L M2 \<inter> Prefix_Tree.set (fst TG'')

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst TG') = L M2 \<inter> Prefix_Tree.set (fst TG')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst TG') = L M2 \<inter> Prefix_Tree.set (fst TG')

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "set T \<subseteq> set (fst TG')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TG')
[PROOF STEP]
unfolding TG'
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic))
[PROOF STEP]
using spyh_distinguish_subset
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (spyh_distinguish ?M ?T ?G ?cg_lookup ?cg_insert ?get_distinguishing_trace ?u ?X ?k ?completeInputTraces ?append_heuristic))

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic))
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TG')

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TG')
[PROOF STEP]
have pass_T: "L M1 \<inter> set T = L M2 \<inter> set T"
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TG')

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
[PROOF STEP]
using pass_TG'
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TG')
L M1 \<inter> Prefix_Tree.set (fst TG') = L M2 \<inter> Prefix_Tree.set (fst TG')

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "list.set X \<subseteq> L M1" and "list.set X \<subseteq> L M2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list.set X \<subseteq> L M1 &&& list.set X \<subseteq> L M2
[PROOF STEP]
using Suc.prems(3)
[PROOF STATE]
proof (prove)
using this:
?w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 ?w w' \<and> converge M2 ?w w'

goal (1 subgoal):
 1. list.set X \<subseteq> L M1 &&& list.set X \<subseteq> L M2
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
list.set X \<subseteq> L M1
list.set X \<subseteq> L M2

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "preserves_divergence M1 M2 (Set.insert u (list.set X))"
    and  "convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert u (list.set X)) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')
[PROOF STEP]
using spyh_distinguish_preserves_divergence[OF assms(1-4) \<open>u \<in> L M1\<close> \<open>u \<in> L M2\<close> assms(16) Suc.prems(7) assms(15) \<open>list.set X \<subseteq> L M1\<close> \<open>list.set X \<subseteq> L M2\<close> _ _Suc.prems(2), of T k completeInputTraces append_heuristic, OF _ _ _ _ assms(18)]
            spyh_distinguish_establishes_divergence(2)[OF assms(1-4) \<open>u \<in> L M1\<close> \<open>u \<in> L M2\<close> assms(16) Suc.prems(7) assms(15) \<open>list.set X \<subseteq> L M1\<close> \<open>list.set X \<subseteq> L M2\<close>, of T k completeInputTraces append_heuristic, OF _ _ _ _ assms(18)]
            pass_TG'
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2; L M1 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic))\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (Set.insert u (list.set X))
\<lbrakk>\<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2; L M1 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (spyh_distinguish M1 T G cg_lookup cg_insert get_distinguishing_trace u X k completeInputTraces append_heuristic))
L M1 \<inter> Prefix_Tree.set (fst TG') = L M2 \<inter> Prefix_Tree.set (fst TG')

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert u (list.set X)) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')
[PROOF STEP]
unfolding TG'[symmetric]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2; L M1 \<inter> Prefix_Tree.set (fst TG') = L M2 \<inter> Prefix_Tree.set (fst TG')\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (Set.insert u (list.set X))
\<lbrakk>\<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2; L M1 \<inter> Prefix_Tree.set (fst TG') = L M2 \<inter> Prefix_Tree.set (fst TG')\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')
L M1 \<inter> Prefix_Tree.set (fst TG') = L M2 \<inter> Prefix_Tree.set (fst TG')

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert u (list.set X)) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')
[PROOF STEP]
by linarith+
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (Set.insert u (list.set X))
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "preserves_divergence M1 M2 (Set.insert v (list.set X))"
    and  "convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X))
 2. convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
have "preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
proof (cases "notReferenced")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
 2. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
notReferenced

goal (2 subgoals):
 1. notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
 2. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
notReferenced
[PROOF STEP]
have "TG'' = spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic"
[PROOF STATE]
proof (prove)
using this:
notReferenced

goal (1 subgoal):
 1. TG'' = spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic
[PROOF STEP]
unfolding TG''
[PROOF STATE]
proof (prove)
using this:
notReferenced

goal (1 subgoal):
 1. (if notReferenced then spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic else TG') = spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
TG'' = spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic

goal (2 subgoals):
 1. notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
 2. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
TG'' = spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic
[PROOF STEP]
have *: "L M1 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic)) =
                    L M2 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic))"
[PROOF STATE]
proof (prove)
using this:
TG'' = spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic))
[PROOF STEP]
using \<open>L M1 \<inter> set (fst TG'') = L M2 \<inter> set (fst TG'')\<close>
[PROOF STATE]
proof (prove)
using this:
TG'' = spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic
L M1 \<inter> Prefix_Tree.set (fst TG'') = L M2 \<inter> Prefix_Tree.set (fst TG'')

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic))

goal (2 subgoals):
 1. notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
 2. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
using spyh_distinguish_preserves_divergence[OF assms(1-4) \<open>v \<in> L M1\<close> \<open>v \<in> L M2\<close> assms(16) \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')\<close> assms(15) \<open>list.set X \<subseteq> L M1\<close> \<open>list.set X \<subseteq> L M2\<close> * assms(18) Suc.prems(2)]
                spyh_distinguish_establishes_divergence(2)[OF assms(1-4) \<open>v \<in> L M1\<close> \<open>v \<in> L M2\<close> assms(16) \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')\<close> assms(15) \<open>list.set X \<subseteq> L M1\<close> \<open>list.set X \<subseteq> L M2\<close> * assms(18)]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X))
\<lbrakk>\<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic))

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
unfolding \<open>TG'' = spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic\<close>
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X))
\<lbrakk>\<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q2 \<in> FSM.states M1; \<And>\<alpha> \<beta> q1 q2. \<lbrakk>q1 \<in> FSM.states M1; q2 \<in> FSM.states M1; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> q1 \<noteq> q2\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic))

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic))
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')

goal (1 subgoal):
 1. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> notReferenced

goal (1 subgoal):
 1. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> notReferenced
[PROOF STEP]
consider "u = v" | "(u \<noteq> v) \<and> \<not>(\<forall> q \<in> reachable_states M1 . V q \<notin> vClass)"
[PROOF STATE]
proof (prove)
using this:
\<not> notReferenced

goal (1 subgoal):
 1. \<lbrakk>u = v \<Longrightarrow> thesis; u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
unfolding notReferenced
[PROOF STATE]
proof (prove)
using this:
\<not> (u \<noteq> v \<and> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass))

goal (1 subgoal):
 1. \<lbrakk>u = v \<Longrightarrow> thesis; u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>u = v \<Longrightarrow> ?thesis; u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>u = v \<Longrightarrow> ?thesis; u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>u = v \<Longrightarrow> ?thesis; u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
proof cases
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. u = v \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
 2. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:
u = v

goal (2 subgoals):
 1. u = v \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
 2. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u = v
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
u = v

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
using False TG'' \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')\<close> \<open>preserves_divergence M1 M2 (Set.insert u (list.set X))\<close>
[PROOF STATE]
proof (prove)
using this:
u = v
\<not> notReferenced
TG'' = (if notReferenced then spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic else TG')
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')
preserves_divergence M1 M2 (Set.insert u (list.set X))

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass)

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass)
[PROOF STEP]
have "TG'' = TG'"
[PROOF STATE]
proof (prove)
using this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass)

goal (1 subgoal):
 1. TG'' = TG'
[PROOF STEP]
unfolding TG''
[PROOF STATE]
proof (prove)
using this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass)

goal (1 subgoal):
 1. (if notReferenced then spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic else TG') = TG'
[PROOF STEP]
using False
[PROOF STATE]
proof (prove)
using this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass)
\<not> notReferenced

goal (1 subgoal):
 1. (if notReferenced then spyh_distinguish M1 (fst TG') (snd TG') cg_lookup cg_insert get_distinguishing_trace v X k completeInputTraces append_heuristic else TG') = TG'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
TG'' = TG'

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
obtain q where "q \<in> reachable_states M1"
                     and "V q \<in> Set.insert v (list.set (cg_lookup (snd TG') v))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>q. \<lbrakk>q \<in> reachable_states M1; V q \<in> Set.insert v (list.set (cg_lookup (snd TG') v))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using 2
[PROOF STATE]
proof (prove)
using this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass)

goal (1 subgoal):
 1. (\<And>q. \<lbrakk>q \<in> reachable_states M1; V q \<in> Set.insert v (list.set (cg_lookup (snd TG') v))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding notReferenced vClass
[PROOF STATE]
proof (prove)
using this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> Set.insert v (list.set (cg_lookup (snd TG') v)))

goal (1 subgoal):
 1. (\<And>q. \<lbrakk>q \<in> reachable_states M1; V q \<in> Set.insert v (list.set (cg_lookup (snd TG') v))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
q \<in> reachable_states M1
V q \<in> Set.insert v (list.set (cg_lookup (snd TG') v))

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
have "converge M1 (V q) v" and "converge M2 (V q) v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. converge M1 (V q) v &&& converge M2 (V q) v
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. converge M1 (V q) v
 2. converge M2 (V q) v
[PROOF STEP]
have "converge M1 v (V q) \<and> converge M2 v (V q)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
proof (cases "V q = v")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. V q = v \<Longrightarrow> converge M1 v (V q) \<and> converge M2 v (V q)
 2. V q \<noteq> v \<Longrightarrow> converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
V q = v

goal (2 subgoals):
 1. V q = v \<Longrightarrow> converge M1 v (V q) \<and> converge M2 v (V q)
 2. V q \<noteq> v \<Longrightarrow> converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V q = v
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
V q = v

goal (1 subgoal):
 1. converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
using \<open>v \<in> L M1\<close> \<open>v \<in> L M2\<close>
[PROOF STATE]
proof (prove)
using this:
V q = v
v \<in> L M1
v \<in> L M2

goal (1 subgoal):
 1. converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M1 v (V q) \<and> converge M2 v (V q)

goal (1 subgoal):
 1. V q \<noteq> v \<Longrightarrow> converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. V q \<noteq> v \<Longrightarrow> converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
V q \<noteq> v

goal (1 subgoal):
 1. V q \<noteq> v \<Longrightarrow> converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V q \<noteq> v
[PROOF STEP]
have "V q \<in> list.set (cg_lookup (snd TG') v)"
[PROOF STATE]
proof (prove)
using this:
V q \<noteq> v

goal (1 subgoal):
 1. V q \<in> list.set (cg_lookup (snd TG') v)
[PROOF STEP]
using \<open>V q \<in> Set.insert v (list.set (cg_lookup (snd TG') v))\<close>
[PROOF STATE]
proof (prove)
using this:
V q \<noteq> v
V q \<in> Set.insert v (list.set (cg_lookup (snd TG') v))

goal (1 subgoal):
 1. V q \<in> list.set (cg_lookup (snd TG') v)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V q \<in> list.set (cg_lookup (snd TG') v)

goal (1 subgoal):
 1. V q \<noteq> v \<Longrightarrow> converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V q \<in> list.set (cg_lookup (snd TG') v)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
V q \<in> list.set (cg_lookup (snd TG') v)

goal (1 subgoal):
 1. converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
using \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')\<close>
[PROOF STATE]
proof (prove)
using this:
V q \<in> list.set (cg_lookup (snd TG') v)
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')

goal (1 subgoal):
 1. converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
unfolding convergence_graph_lookup_invar_def
[PROOF STATE]
proof (prove)
using this:
V q \<in> list.set (cg_lookup (snd TG') v)
\<forall>\<alpha>. \<alpha> \<in> L M1 \<longrightarrow> \<alpha> \<in> L M2 \<longrightarrow> \<alpha> \<in> list.set (cg_lookup (snd TG') \<alpha>) \<and> (\<forall>\<beta>. \<beta> \<in> list.set (cg_lookup (snd TG') \<alpha>) \<longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)

goal (1 subgoal):
 1. converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
using Suc.prems(6) \<open>v \<in> L M1\<close>
[PROOF STATE]
proof (prove)
using this:
V q \<in> list.set (cg_lookup (snd TG') v)
\<forall>\<alpha>. \<alpha> \<in> L M1 \<longrightarrow> \<alpha> \<in> L M2 \<longrightarrow> \<alpha> \<in> list.set (cg_lookup (snd TG') \<alpha>) \<and> (\<forall>\<beta>. \<beta> \<in> list.set (cg_lookup (snd TG') \<alpha>) \<longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)
v \<in> L M2
v \<in> L M1

goal (1 subgoal):
 1. converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
converge M1 v (V q) \<and> converge M2 v (V q)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
converge M1 v (V q) \<and> converge M2 v (V q)

goal (2 subgoals):
 1. converge M1 (V q) v
 2. converge M2 (V q) v
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
converge M1 v (V q) \<and> converge M2 v (V q)
[PROOF STEP]
show "converge M1 (V q) v" and "converge M2 (V q) v"
[PROOF STATE]
proof (prove)
using this:
converge M1 v (V q) \<and> converge M2 v (V q)

goal (1 subgoal):
 1. converge M1 (V q) v &&& converge M2 (V q) v
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M1 (V q) v
converge M2 (V q) v

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
converge M1 (V q) v
converge M2 (V q) v

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
have "V q \<in> Set.insert u (list.set X)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V q \<in> Set.insert u (list.set X)
[PROOF STEP]
using \<open>q \<in> reachable_states M1\<close> Suc.prems(1)
[PROOF STATE]
proof (prove)
using this:
q \<in> reachable_states M1
V ` reachable_states M1 \<subseteq> list.set X

goal (1 subgoal):
 1. V q \<in> Set.insert u (list.set X)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V q \<in> Set.insert u (list.set X)

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
have "preserves_divergence M1 M2 (Set.insert v (list.set X))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X))
[PROOF STEP]
using preserves_divergence_converge_insert[OF assms(1-4) \<open>converge M1 (V q) v\<close> \<open>converge M2 (V q) v\<close> \<open>preserves_divergence M1 M2 (Set.insert u (list.set X))\<close> \<open>V q \<in> Set.insert u (list.set X)\<close>]
[PROOF STATE]
proof (prove)
using this:
preserves_divergence M1 M2 (Set.insert v (Set.insert u (list.set X)))

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X))
[PROOF STEP]
unfolding preserves_divergence.simps
[PROOF STATE]
proof (prove)
using this:
\<forall>\<alpha>\<in>L M1 \<inter> Set.insert v (Set.insert u (list.set X)). \<forall>\<beta>\<in>L M1 \<inter> Set.insert v (Set.insert u (list.set X)). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>

goal (1 subgoal):
 1. \<forall>\<alpha>\<in>L M1 \<inter> Set.insert v (list.set X). \<forall>\<beta>\<in>L M1 \<inter> Set.insert v (list.set X). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (Set.insert v (list.set X))

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
preserves_divergence M1 M2 (Set.insert v (list.set X))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
preserves_divergence M1 M2 (Set.insert v (list.set X))

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
unfolding \<open>TG'' = TG'\<close>
[PROOF STATE]
proof (prove)
using this:
preserves_divergence M1 M2 (Set.insert v (list.set X))

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')
[PROOF STEP]
using \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')\<close>
[PROOF STATE]
proof (prove)
using this:
preserves_divergence M1 M2 (Set.insert v (list.set X))
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')

goal (2 subgoals):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X))
 2. convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
show "preserves_divergence M1 M2 (Set.insert v (list.set X))" and  "convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')"
[PROOF STATE]
proof (prove)
using this:
preserves_divergence M1 M2 (Set.insert v (list.set X)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert v (list.set X)) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (Set.insert v (list.set X))
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (Set.insert v (list.set X))
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "converge M1 u u" and "converge M1 v v" and "converge M1 v u" and "converge M1 u v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (converge M1 u u &&& converge M1 v v) &&& converge M1 v u &&& converge M1 u v
[PROOF STEP]
using \<open>u \<in> L M1\<close> \<open>v \<in> L M1\<close> \<open>converge M1 u v\<close>
[PROOF STATE]
proof (prove)
using this:
u \<in> L M1
v \<in> L M1
converge M1 u v

goal (1 subgoal):
 1. (converge M1 u u &&& converge M1 v v) &&& converge M1 v u &&& converge M1 u v
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M1 u u
converge M1 v v
converge M1 v u
converge M1 u v

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
converge M1 u u
converge M1 v v
converge M1 v u
converge M1 u v
[PROOF STEP]
have "preserves_divergence M1 M2 (Set.insert u (Set.insert v (list.set X)))"
[PROOF STATE]
proof (prove)
using this:
converge M1 u u
converge M1 v v
converge M1 v u
converge M1 u v

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert u (Set.insert v (list.set X)))
[PROOF STEP]
using \<open>preserves_divergence M1 M2 (Set.insert v (list.set X))\<close>
            \<open>preserves_divergence M1 M2 (Set.insert u (list.set X))\<close>
[PROOF STATE]
proof (prove)
using this:
converge M1 u u
converge M1 v v
converge M1 v u
converge M1 u v
preserves_divergence M1 M2 (Set.insert v (list.set X))
preserves_divergence M1 M2 (Set.insert u (list.set X))

goal (1 subgoal):
 1. preserves_divergence M1 M2 (Set.insert u (Set.insert v (list.set X)))
[PROOF STEP]
unfolding preserves_divergence.simps
[PROOF STATE]
proof (prove)
using this:
converge M1 u u
converge M1 v v
converge M1 v u
converge M1 u v
\<forall>\<alpha>\<in>L M1 \<inter> Set.insert v (list.set X). \<forall>\<beta>\<in>L M1 \<inter> Set.insert v (list.set X). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>
\<forall>\<alpha>\<in>L M1 \<inter> Set.insert u (list.set X). \<forall>\<beta>\<in>L M1 \<inter> Set.insert u (list.set X). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>

goal (1 subgoal):
 1. \<forall>\<alpha>\<in>L M1 \<inter> Set.insert u (Set.insert v (list.set X)). \<forall>\<beta>\<in>L M1 \<inter> Set.insert u (Set.insert v (list.set X)). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (Set.insert u (Set.insert v (list.set X)))

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have IS1: "V ` reachable_states M1 \<subseteq> list.set X'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V ` reachable_states M1 \<subseteq> list.set X'
[PROOF STEP]
using Suc.prems(1)
[PROOF STATE]
proof (prove)
using this:
V ` reachable_states M1 \<subseteq> list.set X

goal (1 subgoal):
 1. V ` reachable_states M1 \<subseteq> list.set X'
[PROOF STEP]
unfolding X'
[PROOF STATE]
proof (prove)
using this:
V ` reachable_states M1 \<subseteq> list.set X

goal (1 subgoal):
 1. V ` reachable_states M1 \<subseteq> list.set (if notReferenced then v # u # X else u # X)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
V ` reachable_states M1 \<subseteq> list.set X'

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have IS2: "preserves_divergence M1 M2 (list.set X')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set X')
[PROOF STEP]
using \<open>preserves_divergence M1 M2 (Set.insert u (Set.insert v (list.set X)))\<close>
            \<open>preserves_divergence M1 M2 (Set.insert u (list.set X))\<close>
[PROOF STATE]
proof (prove)
using this:
preserves_divergence M1 M2 (Set.insert u (Set.insert v (list.set X)))
preserves_divergence M1 M2 (Set.insert u (list.set X))

goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set X')
[PROOF STEP]
unfolding X'
[PROOF STATE]
proof (prove)
using this:
preserves_divergence M1 M2 (Set.insert u (Set.insert v (list.set X)))
preserves_divergence M1 M2 (Set.insert u (list.set X))

goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set (if notReferenced then v # u # X else u # X))
[PROOF STEP]
by (simp add: insert_commute)
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (list.set X')

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have handleIO_props : "\<And> x y T' G' . set T \<subseteq> set T' \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G' \<Longrightarrow> L M1 \<inter> set (fst (handleIO (T',G') (x,y))) = L M2 \<inter> set (fst (handleIO (T',G') (x,y))) \<Longrightarrow>
                                          x \<in> inputs M1 \<Longrightarrow> y \<in> outputs M1 \<Longrightarrow>
                                          convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T',G') (x,y)))
                                          \<and> L M1 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])}) = L M2 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])})
                                          \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])})
                                          \<and> (\<forall> \<gamma> x' y' . length ((x,y)#\<gamma>@[(x',y')]) \<le> Suc depth \<longrightarrow>
                                                      ((x,y)#\<gamma>) \<in> LS M1 (after_initial M1 u) \<longrightarrow>
                                                      x' \<in> inputs M1 \<longrightarrow> y' \<in> outputs M1 \<longrightarrow>
                                                      L M1 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes ((x,y)#\<gamma>@[(x',y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes ((x,y)#\<gamma>@[(x',y')]))})
                                                      \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes ((x,y)#\<gamma>@[(x',y')]))}))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
fix x y T' G'
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
assume "convergence_graph_lookup_invar M1 M2 cg_lookup G'"
         and "L M1 \<inter> set (fst (handleIO (T',G') (x,y))) = L M2 \<inter> set (fst (handleIO (T',G') (x,y)))"
         and "x \<in> inputs M1"
         and "y \<in> outputs M1"
         and "set T \<subseteq> set T'"
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup G'
L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y)))
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1
Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
define TGu where TGu: "TGu = distribute_extension M1 T' G' cg_lookup cg_insert u [(x,y)] completeInputTraces append_heuristic"
[PROOF STATE]
proof (state)
this:
TGu = distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
define TGv where TGv: "TGv = (if (u=v) then TGu else distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x,y)] completeInputTraces append_heuristic)"
[PROOF STATE]
proof (state)
this:
TGv = (if u = v then TGu else distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have handleIO: "handleIO (T',G') (x,y) = (if is_in_language M1 (initial M1) (u@[(x,y)])
                                                  then distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u@[(x,y)]) (v@[(x,y)]) X' k depth completeInputTraces append_heuristic (u=v)
                                                  else TGv)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. handleIO (T', G') (x, y) = (if is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) then distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u = v) else TGv)
[PROOF STEP]
unfolding handleIO TGu TGv case_prod_conv Let_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) then distinguish_from_set M1 V (fst (if u = v then distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic else distribute_extension M1 (fst (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) (snd (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)) (snd (if u = v then distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic else distribute_extension M1 (fst (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) (snd (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u = v) else if u = v then distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic else distribute_extension M1 (fst (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) (snd (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic) = (if is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) then distinguish_from_set M1 V (fst (if u = v then distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic else distribute_extension M1 (fst (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) (snd (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)) (snd (if u = v then distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic else distribute_extension M1 (fst (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) (snd (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u = v) else if u = v then distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic else distribute_extension M1 (fst (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) (snd (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
handleIO (T', G') (x, y) = (if is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) then distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u = v) else TGv)

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "set T' \<subseteq> set (fst TGu)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T' \<subseteq> Prefix_Tree.set (fst TGu)
[PROOF STEP]
using distribute_extension_subset[of T']
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T' \<subseteq> Prefix_Tree.set (fst (distribute_extension ?M T' ?G ?cg_lookup ?cg_insert ?u ?w ?b ?heuristic))

goal (1 subgoal):
 1. Prefix_Tree.set T' \<subseteq> Prefix_Tree.set (fst TGu)
[PROOF STEP]
unfolding TGu
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T' \<subseteq> Prefix_Tree.set (fst (distribute_extension ?M T' ?G ?cg_lookup ?cg_insert ?u ?w ?b ?heuristic))

goal (1 subgoal):
 1. Prefix_Tree.set T' \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic))
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T' \<subseteq> Prefix_Tree.set (fst TGu)

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "set (fst TGu) \<subseteq> set (fst TGv)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (fst TGu) \<subseteq> Prefix_Tree.set (fst TGv)
[PROOF STEP]
using distribute_extension_subset[of "fst TGu"]
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TGu) \<subseteq> Prefix_Tree.set (fst (distribute_extension ?M (fst TGu) ?G ?cg_lookup ?cg_insert ?u ?w ?b ?heuristic))

goal (1 subgoal):
 1. Prefix_Tree.set (fst TGu) \<subseteq> Prefix_Tree.set (fst TGv)
[PROOF STEP]
unfolding TGv
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TGu) \<subseteq> Prefix_Tree.set (fst (distribute_extension ?M (fst TGu) ?G ?cg_lookup ?cg_insert ?u ?w ?b ?heuristic))

goal (1 subgoal):
 1. Prefix_Tree.set (fst TGu) \<subseteq> Prefix_Tree.set (fst (if u = v then TGu else distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic))
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst TGu) \<subseteq> Prefix_Tree.set (fst TGv)

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "set (fst TGv) \<subseteq> set (fst (handleIO (T',G') (x,y)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (fst TGv) \<subseteq> Prefix_Tree.set (fst (handleIO (T', G') (x, y)))
[PROOF STEP]
unfolding handleIO
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (fst TGv) \<subseteq> Prefix_Tree.set (fst (if is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) then distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u = v) else TGv))
[PROOF STEP]
using distinguish_from_set_subset[of "fst TGv" M1 V "snd TGv" cg_lookup cg_insert get_distinguishing_trace "u@[(x,y)]" "v@[(x,y)]" X' k depth]
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TGv) \<subseteq> Prefix_Tree.set (fst (distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth ?completeInputTraces ?append_heuristic ?u_is_v))

goal (1 subgoal):
 1. Prefix_Tree.set (fst TGv) \<subseteq> Prefix_Tree.set (fst (if is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) then distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u = v) else TGv))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst TGv) \<subseteq> Prefix_Tree.set (fst (handleIO (T', G') (x, y)))

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set (fst TGv) \<subseteq> Prefix_Tree.set (fst (handleIO (T', G') (x, y)))
[PROOF STEP]
have pass_TGv: "L M1 \<inter> set (fst TGv) = L M2 \<inter> set (fst TGv)"
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TGv) \<subseteq> Prefix_Tree.set (fst (handleIO (T', G') (x, y)))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst TGv) = L M2 \<inter> Prefix_Tree.set (fst TGv)
[PROOF STEP]
using \<open>L M1 \<inter> set (fst (handleIO (T',G') (x,y))) = L M2 \<inter> set (fst (handleIO (T',G') (x,y)))\<close> \<open>set (fst TGv) \<subseteq> set (fst (handleIO (T',G') (x,y)))\<close>
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TGv) \<subseteq> Prefix_Tree.set (fst (handleIO (T', G') (x, y)))
L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y)))
Prefix_Tree.set (fst TGv) \<subseteq> Prefix_Tree.set (fst (handleIO (T', G') (x, y)))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst TGv) = L M2 \<inter> Prefix_Tree.set (fst TGv)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst TGv) = L M2 \<inter> Prefix_Tree.set (fst TGv)

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have *:"L M1 \<inter> set (fst (distribute_extension M1 T' G' cg_lookup cg_insert u [(x,y)] completeInputTraces append_heuristic)) = L M2 \<inter> set (fst (distribute_extension M1 T' G' cg_lookup cg_insert u [(x,y)] completeInputTraces append_heuristic))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic))
[PROOF STEP]
using \<open>L M1 \<inter> set (fst (handleIO (T',G') (x,y))) = L M2 \<inter> set (fst (handleIO (T',G') (x,y)))\<close> \<open>set (fst TGv) \<subseteq> set (fst (handleIO (T',G') (x,y)))\<close> \<open>set (fst TGu) \<subseteq> set (fst TGv)\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y)))
Prefix_Tree.set (fst TGv) \<subseteq> Prefix_Tree.set (fst (handleIO (T', G') (x, y)))
Prefix_Tree.set (fst TGu) \<subseteq> Prefix_Tree.set (fst TGv)

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic))
[PROOF STEP]
unfolding TGu
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y)))
Prefix_Tree.set (fst TGv) \<subseteq> Prefix_Tree.set (fst (handleIO (T', G') (x, y)))
Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) \<subseteq> Prefix_Tree.set (fst TGv)

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic))

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
obtain u' where "converge M1 u u'"
                      "u' @ [(x, y)] \<in> set (fst TGv)"
                      "converge M2 u u'"
                      "convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGu)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>u'. \<lbrakk>converge M1 u u'; u' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv); converge M2 u u'; convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGu)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using distribute_extension_adds_sequence[OF assms(1,3) \<open>u \<in> L M1\<close> \<open>u \<in> L M2\<close> \<open>convergence_graph_lookup_invar M1 M2 cg_lookup G'\<close> assms(15) * assms(18)]
[PROOF STATE]
proof (prove)
using this:
\<exists>u'. converge M1 u u' \<and> u' @ [(x, y)] \<in> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) \<and> converge M2 u u'
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic))

goal (1 subgoal):
 1. (\<And>u'. \<lbrakk>converge M1 u u'; u' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv); converge M2 u u'; convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGu)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<open>set (fst TGu) \<subseteq> set (fst TGv)\<close>
[PROOF STATE]
proof (prove)
using this:
\<exists>u'. converge M1 u u' \<and> u' @ [(x, y)] \<in> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) \<and> converge M2 u u'
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic))
Prefix_Tree.set (fst TGu) \<subseteq> Prefix_Tree.set (fst TGv)

goal (1 subgoal):
 1. (\<And>u'. \<lbrakk>converge M1 u u'; u' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv); converge M2 u u'; convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGu)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding TGu
[PROOF STATE]
proof (prove)
using this:
\<exists>u'. converge M1 u u' \<and> u' @ [(x, y)] \<in> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) \<and> converge M2 u u'
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic))
Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic)) \<subseteq> Prefix_Tree.set (fst TGv)

goal (1 subgoal):
 1. (\<And>u'. \<lbrakk>converge M1 u u'; u' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv); converge M2 u u'; convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 T' G' cg_lookup cg_insert u [(x, y)] completeInputTraces append_heuristic))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
converge M1 u u'
u' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv)
converge M2 u u'
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGu)

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "u' \<in> set (fst TGv)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. u' \<in> Prefix_Tree.set (fst TGv)
[PROOF STEP]
using \<open>u' @ [(x, y)] \<in> set (fst TGv)\<close> set_prefix
[PROOF STATE]
proof (prove)
using this:
u' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv)
?xs @ ?ys \<in> Prefix_Tree.set ?T \<Longrightarrow> ?xs \<in> Prefix_Tree.set ?T

goal (1 subgoal):
 1. u' \<in> Prefix_Tree.set (fst TGv)
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
u' \<in> Prefix_Tree.set (fst TGv)

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "u' \<in> L M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. u' \<in> L M1
[PROOF STEP]
using \<open>converge M1 u u'\<close>
[PROOF STATE]
proof (prove)
using this:
converge M1 u u'

goal (1 subgoal):
 1. u' \<in> L M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
u' \<in> L M1

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have *:"\<not>(u=v) \<Longrightarrow> L M1 \<inter> set (fst (distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x,y)] completeInputTraces append_heuristic)) = L M2 \<inter> set (fst (distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x,y)] completeInputTraces append_heuristic))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. u \<noteq> v \<Longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic))
[PROOF STEP]
using \<open>L M1 \<inter> set (fst (handleIO (T',G') (x,y))) = L M2 \<inter> set (fst (handleIO (T',G') (x,y)))\<close> \<open>set (fst TGv) \<subseteq> set (fst (handleIO (T',G') (x,y)))\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y)))
Prefix_Tree.set (fst TGv) \<subseteq> Prefix_Tree.set (fst (handleIO (T', G') (x, y)))

goal (1 subgoal):
 1. u \<noteq> v \<Longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic))
[PROOF STEP]
using TGv pass_TGv
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y)))
Prefix_Tree.set (fst TGv) \<subseteq> Prefix_Tree.set (fst (handleIO (T', G') (x, y)))
TGv = (if u = v then TGu else distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)
L M1 \<inter> Prefix_Tree.set (fst TGv) = L M2 \<inter> Prefix_Tree.set (fst TGv)

goal (1 subgoal):
 1. u \<noteq> v \<Longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic))
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
u \<noteq> v \<Longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic))

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
obtain v' where "converge M1 v v'"
                      "v' @ [(x, y)] \<in> set (fst TGv)"
                      "converge M2 v v'"
                      "convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGv)"
                      "u=v \<Longrightarrow> u' = v'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>v'. \<lbrakk>converge M1 v v'; v' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv); converge M2 v v'; convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGv); u = v \<Longrightarrow> u' = v'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
proof (cases "u=v")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>\<And>v'. \<lbrakk>converge M1 v v'; v' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv); converge M2 v v'; convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGv); u = v \<Longrightarrow> u' = v'\<rbrakk> \<Longrightarrow> thesis; u = v\<rbrakk> \<Longrightarrow> thesis
 2. \<lbrakk>\<And>v'. \<lbrakk>converge M1 v v'; v' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv); converge M2 v v'; convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGv); u = v \<Longrightarrow> u' = v'\<rbrakk> \<Longrightarrow> thesis; u \<noteq> v\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
u = v

goal (2 subgoals):
 1. \<lbrakk>\<And>v'. \<lbrakk>converge M1 v v'; v' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv); converge M2 v v'; convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGv); u = v \<Longrightarrow> u' = v'\<rbrakk> \<Longrightarrow> thesis; u = v\<rbrakk> \<Longrightarrow> thesis
 2. \<lbrakk>\<And>v'. \<lbrakk>converge M1 v v'; v' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv); converge M2 v v'; convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGv); u = v \<Longrightarrow> u' = v'\<rbrakk> \<Longrightarrow> thesis; u \<noteq> v\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u = v
[PROOF STEP]
have "TGv = TGu"
[PROOF STATE]
proof (prove)
using this:
u = v

goal (1 subgoal):
 1. TGv = TGu
[PROOF STEP]
unfolding TGv
[PROOF STATE]
proof (prove)
using this:
u = v

goal (1 subgoal):
 1. (if u = v then TGu else distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic) = TGu
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
TGv = TGu

goal (2 subgoals):
 1. \<lbrakk>\<And>v'. \<lbrakk>converge M1 v v'; v' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv); converge M2 v v'; convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGv); u = v \<Longrightarrow> u' = v'\<rbrakk> \<Longrightarrow> thesis; u = v\<rbrakk> \<Longrightarrow> thesis
 2. \<lbrakk>\<And>v'. \<lbrakk>converge M1 v v'; v' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv); converge M2 v v'; convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGv); u = v \<Longrightarrow> u' = v'\<rbrakk> \<Longrightarrow> thesis; u \<noteq> v\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. thesis
[PROOF STEP]
using that
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>converge M1 v ?v'; ?v' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv); converge M2 v ?v'; convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGv); u = v \<Longrightarrow> u' = ?v'\<rbrakk> \<Longrightarrow> thesis

goal (1 subgoal):
 1. thesis
[PROOF STEP]
using \<open>converge M1 u u'\<close> \<open>u' @ [(x, y)] \<in> set (fst TGv)\<close> \<open>converge M2 u u'\<close> \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGu)\<close>
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>converge M1 v ?v'; ?v' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv); converge M2 v ?v'; convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGv); u = v \<Longrightarrow> u' = ?v'\<rbrakk> \<Longrightarrow> thesis
converge M1 u u'
u' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv)
converge M2 u u'
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGu)

goal (1 subgoal):
 1. thesis
[PROOF STEP]
unfolding True \<open>TGv = TGu\<close>
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>converge M1 v ?v'; ?v' @ [(x, y)] \<in> Prefix_Tree.set (fst TGu); converge M2 v ?v'; convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGu); v = v \<Longrightarrow> u' = ?v'\<rbrakk> \<Longrightarrow> thesis
converge M1 v u'
u' @ [(x, y)] \<in> Prefix_Tree.set (fst TGu)
converge M2 v u'
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGu)

goal (1 subgoal):
 1. thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
thesis

goal (1 subgoal):
 1. \<lbrakk>\<And>v'. \<lbrakk>converge M1 v v'; v' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv); converge M2 v v'; convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGv); u = v \<Longrightarrow> u' = v'\<rbrakk> \<Longrightarrow> thesis; u \<noteq> v\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>\<And>v'. \<lbrakk>converge M1 v v'; v' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv); converge M2 v v'; convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGv); u = v \<Longrightarrow> u' = v'\<rbrakk> \<Longrightarrow> thesis; u \<noteq> v\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
u \<noteq> v

goal (1 subgoal):
 1. \<lbrakk>\<And>v'. \<lbrakk>converge M1 v v'; v' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv); converge M2 v v'; convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGv); u = v \<Longrightarrow> u' = v'\<rbrakk> \<Longrightarrow> thesis; u \<noteq> v\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<noteq> v
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
u \<noteq> v

goal (1 subgoal):
 1. thesis
[PROOF STEP]
using that
[PROOF STATE]
proof (prove)
using this:
u \<noteq> v
\<lbrakk>converge M1 v ?v'; ?v' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv); converge M2 v ?v'; convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGv); u = v \<Longrightarrow> u' = ?v'\<rbrakk> \<Longrightarrow> thesis

goal (1 subgoal):
 1. thesis
[PROOF STEP]
using distribute_extension_adds_sequence[OF assms(1,3) \<open>v \<in> L M1\<close> \<open>v \<in> L M2\<close> \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGu)\<close> assms(15) *[OF False] assms(18)]
[PROOF STATE]
proof (prove)
using this:
u \<noteq> v
\<lbrakk>converge M1 v ?v'; ?v' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv); converge M2 v ?v'; convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGv); u = v \<Longrightarrow> u' = ?v'\<rbrakk> \<Longrightarrow> thesis
\<exists>u'. converge M1 v u' \<and> u' @ [(x, y)] \<in> Prefix_Tree.set (fst (distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)) \<and> converge M2 v u'
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic))

goal (1 subgoal):
 1. thesis
[PROOF STEP]
unfolding TGv
[PROOF STATE]
proof (prove)
using this:
u \<noteq> v
\<lbrakk>converge M1 v ?v'; ?v' @ [(x, y)] \<in> Prefix_Tree.set (fst (if u = v then TGu else distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)); converge M2 v ?v'; convergence_graph_lookup_invar M1 M2 cg_lookup (snd (if u = v then TGu else distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)); u = v \<Longrightarrow> u' = ?v'\<rbrakk> \<Longrightarrow> thesis
\<exists>u'. converge M1 v u' \<and> u' @ [(x, y)] \<in> Prefix_Tree.set (fst (distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic)) \<and> converge M2 v u'
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 (fst TGu) (snd TGu) cg_lookup cg_insert v [(x, y)] completeInputTraces append_heuristic))

goal (1 subgoal):
 1. thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
thesis

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
converge M1 v v'
v' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv)
converge M2 v v'
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGv)
u = v \<Longrightarrow> u' = v'

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "v' \<in> set (fst TGv)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. v' \<in> Prefix_Tree.set (fst TGv)
[PROOF STEP]
using \<open>v' @ [(x, y)] \<in> set (fst TGv)\<close> set_prefix
[PROOF STATE]
proof (prove)
using this:
v' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv)
?xs @ ?ys \<in> Prefix_Tree.set ?T \<Longrightarrow> ?xs \<in> Prefix_Tree.set ?T

goal (1 subgoal):
 1. v' \<in> Prefix_Tree.set (fst TGv)
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
v' \<in> Prefix_Tree.set (fst TGv)

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "v' \<in> L M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. v' \<in> L M1
[PROOF STEP]
using \<open>converge M1 v v'\<close>
[PROOF STATE]
proof (prove)
using this:
converge M1 v v'

goal (1 subgoal):
 1. v' \<in> L M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
v' \<in> L M1

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have *: "{\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])} = {u,v,u@[(x,y)],v@[(x,y)]}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])} = {u, v, u @ [(x, y)], v @ [(x, y)]}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
{\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])} = {u, v, u @ [(x, y)], v @ [(x, y)]}

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "u \<in> L M1 = (u \<in> L M2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (u \<in> L M1) = (u \<in> L M2)
[PROOF STEP]
using Suc.prems(5) \<open>u \<in> L M1\<close>
[PROOF STATE]
proof (prove)
using this:
u \<in> L M2
u \<in> L M1

goal (1 subgoal):
 1. (u \<in> L M1) = (u \<in> L M2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(u \<in> L M1) = (u \<in> L M2)

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(u \<in> L M1) = (u \<in> L M2)

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "v \<in> L M1 = (v \<in> L M2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (v \<in> L M1) = (v \<in> L M2)
[PROOF STEP]
using Suc.prems(6) \<open>v \<in> L M1\<close>
[PROOF STATE]
proof (prove)
using this:
v \<in> L M2
v \<in> L M1

goal (1 subgoal):
 1. (v \<in> L M1) = (v \<in> L M2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(v \<in> L M1) = (v \<in> L M2)

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(v \<in> L M1) = (v \<in> L M2)

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "u @ [(x, y)] \<in> L M1 = (u @ [(x, y)] \<in> L M2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (u @ [(x, y)] \<in> L M1) = (u @ [(x, y)] \<in> L M2)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (u @ [(x, y)] \<in> L M1) = (u @ [(x, y)] \<in> L M2)
[PROOF STEP]
have "u @ [(x, y)] \<in> L M1 = (u' @ [(x, y)] \<in> L M1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (u @ [(x, y)] \<in> L M1) = (u' @ [(x, y)] \<in> L M1)
[PROOF STEP]
using \<open>converge M1 u u'\<close> assms(1) converge_append_language_iff
[PROOF STATE]
proof (prove)
using this:
converge M1 u u'
observable M1
\<lbrakk>observable ?M; converge ?M ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> (?\<alpha> @ ?\<gamma> \<in> L ?M) = (?\<beta> @ ?\<gamma> \<in> L ?M)

goal (1 subgoal):
 1. (u @ [(x, y)] \<in> L M1) = (u' @ [(x, y)] \<in> L M1)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(u @ [(x, y)] \<in> L M1) = (u' @ [(x, y)] \<in> L M1)

goal (1 subgoal):
 1. (u @ [(x, y)] \<in> L M1) = (u @ [(x, y)] \<in> L M2)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(u @ [(x, y)] \<in> L M1) = (u' @ [(x, y)] \<in> L M1)

goal (1 subgoal):
 1. (u @ [(x, y)] \<in> L M1) = (u @ [(x, y)] \<in> L M2)
[PROOF STEP]
have "\<dots> = (u' @ [(x, y)] \<in> L M2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (u' @ [(x, y)] \<in> L M1) = (u' @ [(x, y)] \<in> L M2)
[PROOF STEP]
using pass_TGv \<open>u' @ [(x, y)] \<in> set (fst TGv)\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst TGv) = L M2 \<inter> Prefix_Tree.set (fst TGv)
u' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv)

goal (1 subgoal):
 1. (u' @ [(x, y)] \<in> L M1) = (u' @ [(x, y)] \<in> L M2)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(u' @ [(x, y)] \<in> L M1) = (u' @ [(x, y)] \<in> L M2)

goal (1 subgoal):
 1. (u @ [(x, y)] \<in> L M1) = (u @ [(x, y)] \<in> L M2)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(u' @ [(x, y)] \<in> L M1) = (u' @ [(x, y)] \<in> L M2)

goal (1 subgoal):
 1. (u @ [(x, y)] \<in> L M1) = (u @ [(x, y)] \<in> L M2)
[PROOF STEP]
have "\<dots> = (u @ [(x, y)] \<in> L M2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (u' @ [(x, y)] \<in> L M2) = (u @ [(x, y)] \<in> L M2)
[PROOF STEP]
using \<open>converge M2 u u'\<close> assms(2) converge_append_language_iff
[PROOF STATE]
proof (prove)
using this:
converge M2 u u'
observable M2
\<lbrakk>observable ?M; converge ?M ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> (?\<alpha> @ ?\<gamma> \<in> L ?M) = (?\<beta> @ ?\<gamma> \<in> L ?M)

goal (1 subgoal):
 1. (u' @ [(x, y)] \<in> L M2) = (u @ [(x, y)] \<in> L M2)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(u' @ [(x, y)] \<in> L M2) = (u @ [(x, y)] \<in> L M2)

goal (1 subgoal):
 1. (u @ [(x, y)] \<in> L M1) = (u @ [(x, y)] \<in> L M2)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(u @ [(x, y)] \<in> L M1) = (u @ [(x, y)] \<in> L M2)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(u @ [(x, y)] \<in> L M1) = (u @ [(x, y)] \<in> L M2)

goal (1 subgoal):
 1. (u @ [(x, y)] \<in> L M1) = (u @ [(x, y)] \<in> L M2)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(u @ [(x, y)] \<in> L M1) = (u @ [(x, y)] \<in> L M2)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(u @ [(x, y)] \<in> L M1) = (u @ [(x, y)] \<in> L M2)

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(u @ [(x, y)] \<in> L M1) = (u @ [(x, y)] \<in> L M2)

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "v @ [(x, y)] \<in> L M1 = (v @ [(x, y)] \<in> L M2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (v @ [(x, y)] \<in> L M1) = (v @ [(x, y)] \<in> L M2)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (v @ [(x, y)] \<in> L M1) = (v @ [(x, y)] \<in> L M2)
[PROOF STEP]
have "v @ [(x, y)] \<in> L M1 = (v' @ [(x, y)] \<in> L M1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (v @ [(x, y)] \<in> L M1) = (v' @ [(x, y)] \<in> L M1)
[PROOF STEP]
using \<open>converge M1 v v'\<close> assms(1) converge_append_language_iff
[PROOF STATE]
proof (prove)
using this:
converge M1 v v'
observable M1
\<lbrakk>observable ?M; converge ?M ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> (?\<alpha> @ ?\<gamma> \<in> L ?M) = (?\<beta> @ ?\<gamma> \<in> L ?M)

goal (1 subgoal):
 1. (v @ [(x, y)] \<in> L M1) = (v' @ [(x, y)] \<in> L M1)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(v @ [(x, y)] \<in> L M1) = (v' @ [(x, y)] \<in> L M1)

goal (1 subgoal):
 1. (v @ [(x, y)] \<in> L M1) = (v @ [(x, y)] \<in> L M2)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(v @ [(x, y)] \<in> L M1) = (v' @ [(x, y)] \<in> L M1)

goal (1 subgoal):
 1. (v @ [(x, y)] \<in> L M1) = (v @ [(x, y)] \<in> L M2)
[PROOF STEP]
have "\<dots> = (v' @ [(x, y)] \<in> L M2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (v' @ [(x, y)] \<in> L M1) = (v' @ [(x, y)] \<in> L M2)
[PROOF STEP]
using pass_TGv \<open>v' @ [(x, y)] \<in> set (fst TGv)\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst TGv) = L M2 \<inter> Prefix_Tree.set (fst TGv)
v' @ [(x, y)] \<in> Prefix_Tree.set (fst TGv)

goal (1 subgoal):
 1. (v' @ [(x, y)] \<in> L M1) = (v' @ [(x, y)] \<in> L M2)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(v' @ [(x, y)] \<in> L M1) = (v' @ [(x, y)] \<in> L M2)

goal (1 subgoal):
 1. (v @ [(x, y)] \<in> L M1) = (v @ [(x, y)] \<in> L M2)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(v' @ [(x, y)] \<in> L M1) = (v' @ [(x, y)] \<in> L M2)

goal (1 subgoal):
 1. (v @ [(x, y)] \<in> L M1) = (v @ [(x, y)] \<in> L M2)
[PROOF STEP]
have "\<dots> = (v @ [(x, y)] \<in> L M2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (v' @ [(x, y)] \<in> L M2) = (v @ [(x, y)] \<in> L M2)
[PROOF STEP]
using \<open>converge M2 v v'\<close> assms(2) converge_append_language_iff
[PROOF STATE]
proof (prove)
using this:
converge M2 v v'
observable M2
\<lbrakk>observable ?M; converge ?M ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> (?\<alpha> @ ?\<gamma> \<in> L ?M) = (?\<beta> @ ?\<gamma> \<in> L ?M)

goal (1 subgoal):
 1. (v' @ [(x, y)] \<in> L M2) = (v @ [(x, y)] \<in> L M2)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(v' @ [(x, y)] \<in> L M2) = (v @ [(x, y)] \<in> L M2)

goal (1 subgoal):
 1. (v @ [(x, y)] \<in> L M1) = (v @ [(x, y)] \<in> L M2)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(v @ [(x, y)] \<in> L M1) = (v @ [(x, y)] \<in> L M2)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(v @ [(x, y)] \<in> L M1) = (v @ [(x, y)] \<in> L M2)

goal (1 subgoal):
 1. (v @ [(x, y)] \<in> L M1) = (v @ [(x, y)] \<in> L M2)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(v @ [(x, y)] \<in> L M1) = (v @ [(x, y)] \<in> L M2)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(v @ [(x, y)] \<in> L M1) = (v @ [(x, y)] \<in> L M2)

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(v @ [(x, y)] \<in> L M1) = (v @ [(x, y)] \<in> L M2)

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "L M1 \<inter> list.set X = (L M2 \<inter> list.set X)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> list.set X = L M2 \<inter> list.set X
[PROOF STEP]
using Suc.prems(3)
[PROOF STATE]
proof (prove)
using this:
?w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 ?w w' \<and> converge M2 ?w w'

goal (1 subgoal):
 1. L M1 \<inter> list.set X = L M2 \<inter> list.set X
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
L M1 \<inter> list.set X = L M2 \<inter> list.set X

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(u \<in> L M1) = (u \<in> L M2)
(v \<in> L M1) = (v \<in> L M2)
(u @ [(x, y)] \<in> L M1) = (u @ [(x, y)] \<in> L M2)
(v @ [(x, y)] \<in> L M1) = (v @ [(x, y)] \<in> L M2)
L M1 \<inter> list.set X = L M2 \<inter> list.set X
[PROOF STEP]
have p2: "L M1 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])}) = L M2 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])})"
[PROOF STATE]
proof (prove)
using this:
(u \<in> L M1) = (u \<in> L M2)
(v \<in> L M1) = (v \<in> L M2)
(u @ [(x, y)] \<in> L M1) = (u @ [(x, y)] \<in> L M2)
(v @ [(x, y)] \<in> L M1) = (v @ [(x, y)] \<in> L M2)
L M1 \<inter> list.set X = L M2 \<inter> list.set X

goal (1 subgoal):
 1. L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
unfolding *
[PROOF STATE]
proof (prove)
using this:
(u \<in> L M1) = (u \<in> L M2)
(v \<in> L M1) = (v \<in> L M2)
(u @ [(x, y)] \<in> L M1) = (u @ [(x, y)] \<in> L M2)
(v @ [(x, y)] \<in> L M1) = (v @ [(x, y)] \<in> L M2)
L M1 \<inter> list.set X = L M2 \<inter> list.set X

goal (1 subgoal):
 1. L M1 \<inter> (list.set X \<union> {u, v, u @ [(x, y)], v @ [(x, y)]}) = L M2 \<inter> (list.set X \<union> {u, v, u @ [(x, y)], v @ [(x, y)]})
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})

goal (1 subgoal):
 1. \<And>x y T' G'. \<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'; convergence_graph_lookup_invar M1 M2 cg_lookup G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
show "convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T',G') (x,y)))
                                          \<and> L M1 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])}) = L M2 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])})
                                          \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])})
                                          \<and> (\<forall> \<gamma> x' y' . length ((x,y)#\<gamma>@[(x',y')]) \<le> Suc depth \<longrightarrow>
                                                      ((x,y)#\<gamma>) \<in> LS M1 (after_initial M1 u) \<longrightarrow>
                                                      x' \<in> inputs M1 \<longrightarrow> y' \<in> outputs M1 \<longrightarrow>
                                                      L M1 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes ((x,y)#\<gamma>@[(x',y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes ((x,y)#\<gamma>@[(x',y')]))})
                                                      \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes ((x,y)#\<gamma>@[(x',y')]))}))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
proof (cases "is_in_language M1 (initial M1) (u@[(x,y)])")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
 2. \<not> is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> is_in_language M1 (FSM.initial M1) (u @ [(x, y)])

goal (2 subgoals):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
 2. \<not> is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "u@[(x,y)] \<notin> L M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. u @ [(x, y)] \<notin> L M1
[PROOF STEP]
using False
[PROOF STATE]
proof (prove)
using this:
\<not> is_in_language M1 (FSM.initial M1) (u @ [(x, y)])

goal (1 subgoal):
 1. u @ [(x, y)] \<notin> L M1
[PROOF STEP]
by (meson assms(1) fsm_initial is_in_language_iff)
[PROOF STATE]
proof (state)
this:
u @ [(x, y)] \<notin> L M1

goal (2 subgoals):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
 2. \<not> is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
u @ [(x, y)] \<notin> L M1

goal (2 subgoals):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
 2. \<not> is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "v@[(x,y)] \<notin> L M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. v @ [(x, y)] \<notin> L M1
[PROOF STEP]
using calculation Suc.prems(4) assms(1) converge_append_language_iff
[PROOF STATE]
proof (prove)
using this:
u @ [(x, y)] \<notin> L M1
converge M1 u v
observable M1
\<lbrakk>observable ?M; converge ?M ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> (?\<alpha> @ ?\<gamma> \<in> L ?M) = (?\<beta> @ ?\<gamma> \<in> L ?M)

goal (1 subgoal):
 1. v @ [(x, y)] \<notin> L M1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
v @ [(x, y)] \<notin> L M1

goal (2 subgoals):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
 2. \<not> is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
v @ [(x, y)] \<notin> L M1

goal (2 subgoals):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
 2. \<not> is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "preserves_divergence M1 M2 (list.set X \<union> {u,v})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set X \<union> {u, v})
[PROOF STEP]
by (metis (no_types) Un_insert_right \<open>preserves_divergence M1 M2 (Set.insert u (Set.insert v (list.set X)))\<close> sup_bot_right)
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (list.set X \<union> {u, v})

goal (2 subgoals):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
 2. \<not> is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
u @ [(x, y)] \<notin> L M1
v @ [(x, y)] \<notin> L M1
preserves_divergence M1 M2 (list.set X \<union> {u, v})
[PROOF STEP]
have p3: "preserves_divergence M1 M2 (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])})"
[PROOF STATE]
proof (prove)
using this:
u @ [(x, y)] \<notin> L M1
v @ [(x, y)] \<notin> L M1
preserves_divergence M1 M2 (list.set X \<union> {u, v})

goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
unfolding * preserves_divergence.simps
[PROOF STATE]
proof (prove)
using this:
u @ [(x, y)] \<notin> L M1
v @ [(x, y)] \<notin> L M1
\<forall>\<alpha>\<in>L M1 \<inter> (list.set X \<union> {u, v}). \<forall>\<beta>\<in>L M1 \<inter> (list.set X \<union> {u, v}). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>

goal (1 subgoal):
 1. \<forall>\<alpha>\<in>L M1 \<inter> (list.set X \<union> {u, v, u @ [(x, y)], v @ [(x, y)]}). \<forall>\<beta>\<in>L M1 \<inter> (list.set X \<union> {u, v, u @ [(x, y)], v @ [(x, y)]}). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})

goal (2 subgoals):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
 2. \<not> is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have handleIO: "(handleIO (T',G') (x,y)) = TGv"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. handleIO (T', G') (x, y) = TGv
[PROOF STEP]
using handleIO False
[PROOF STATE]
proof (prove)
using this:
handleIO (T', G') (x, y) = (if is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) then distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u = v) else TGv)
\<not> is_in_language M1 (FSM.initial M1) (u @ [(x, y)])

goal (1 subgoal):
 1. handleIO (T', G') (x, y) = TGv
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
handleIO (T', G') (x, y) = TGv

goal (2 subgoals):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
 2. \<not> is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "\<And> x xs . x # xs = [x] @ xs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x xs. x # xs = [x] @ xs
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?x # ?xs = [?x] @ ?xs

goal (2 subgoals):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
 2. \<not> is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
?x # ?xs = [?x] @ ?xs
[PROOF STEP]
have "\<And> \<gamma> . (x, y) # \<gamma> \<notin> LS M1 (after_initial M1 u)"
[PROOF STATE]
proof (prove)
using this:
?x # ?xs = [?x] @ ?xs

goal (1 subgoal):
 1. \<And>\<gamma>. (x, y) # \<gamma> \<notin> LS M1 (after_initial M1 u)
[PROOF STEP]
by (metis \<open>u @ [(x, y)] \<notin> L M1\<close> \<open>u \<in> L M1\<close> after_language_iff assms(1) language_prefix)
[PROOF STATE]
proof (state)
this:
(x, y) # ?\<gamma>1 \<notin> LS M1 (after_initial M1 u)

goal (2 subgoals):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
 2. \<not> is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T',G') (x,y)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y)))
[PROOF STEP]
unfolding handleIO
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGv)
[PROOF STEP]
by (simp add: \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGv)\<close>)
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y)))

goal (2 subgoals):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
 2. \<not> is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y)))

goal (2 subgoals):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
 2. \<not> is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
note p2 p3 \<open>\<And> \<gamma> . (x, y) # \<gamma> \<notin> LS M1 (after_initial M1 u)\<close>
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
(x, y) # ?\<gamma> \<notin> LS M1 (after_initial M1 u)

goal (2 subgoals):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
 2. \<not> is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y)))
L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
(x, y) # ?\<gamma> \<notin> LS M1 (after_initial M1 u)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y)))
L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
(x, y) # ?\<gamma> \<notin> LS M1 (after_initial M1 u)

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))

goal (1 subgoal):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
is_in_language M1 (FSM.initial M1) (u @ [(x, y)])

goal (1 subgoal):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
is_in_language M1 (FSM.initial M1) (u @ [(x, y)])
[PROOF STEP]
have handleIO: "(handleIO (T',G') (x,y)) = distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u@[(x,y)] = v@[(x,y)])"
[PROOF STATE]
proof (prove)
using this:
is_in_language M1 (FSM.initial M1) (u @ [(x, y)])

goal (1 subgoal):
 1. handleIO (T', G') (x, y) = distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u @ [(x, y)] = v @ [(x, y)])
[PROOF STEP]
using handleIO
[PROOF STATE]
proof (prove)
using this:
is_in_language M1 (FSM.initial M1) (u @ [(x, y)])
handleIO (T', G') (x, y) = (if is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) then distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u = v) else TGv)

goal (1 subgoal):
 1. handleIO (T', G') (x, y) = distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u @ [(x, y)] = v @ [(x, y)])
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
handleIO (T', G') (x, y) = distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u @ [(x, y)] = v @ [(x, y)])

goal (1 subgoal):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "converge M1 (u@[(x,y)]) (v@[(x,y)])"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. converge M1 (u @ [(x, y)]) (v @ [(x, y)])
[PROOF STEP]
by (meson Suc.prems(4) True \<open>v \<in> L M1\<close> assms(1) converge_append fsm_initial is_in_language_iff)
[PROOF STATE]
proof (state)
this:
converge M1 (u @ [(x, y)]) (v @ [(x, y)])

goal (1 subgoal):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
converge M1 (u @ [(x, y)]) (v @ [(x, y)])
[PROOF STEP]
have "(u@[(x,y)]) \<in> L M1" and "(v@[(x,y)]) \<in> L M1"
[PROOF STATE]
proof (prove)
using this:
converge M1 (u @ [(x, y)]) (v @ [(x, y)])

goal (1 subgoal):
 1. u @ [(x, y)] \<in> L M1 &&& v @ [(x, y)] \<in> L M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
u @ [(x, y)] \<in> L M1
v @ [(x, y)] \<in> L M1

goal (1 subgoal):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "(u@[(x,y)]) \<in> L M2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. u @ [(x, y)] \<in> L M2
[PROOF STEP]
by (meson True \<open>(u @ [(x, y)] \<in> L M1) = (u @ [(x, y)] \<in> L M2)\<close> assms(1) fsm_initial is_in_language_iff)
[PROOF STATE]
proof (state)
this:
u @ [(x, y)] \<in> L M2

goal (1 subgoal):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "(v@[(x,y)]) \<in> L M2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. v @ [(x, y)] \<in> L M2
[PROOF STEP]
using Suc.prems(4) \<open>(u @ [(x, y)] \<in> L M1) = (u @ [(x, y)] \<in> L M2)\<close> \<open>(v @ [(x, y)] \<in> L M1) = (v @ [(x, y)] \<in> L M2)\<close> \<open>u @ [(x, y)] \<in> L M2\<close> assms(1) converge_append_language_iff
[PROOF STATE]
proof (prove)
using this:
converge M1 u v
(u @ [(x, y)] \<in> L M1) = (u @ [(x, y)] \<in> L M2)
(v @ [(x, y)] \<in> L M1) = (v @ [(x, y)] \<in> L M2)
u @ [(x, y)] \<in> L M2
observable M1
\<lbrakk>observable ?M; converge ?M ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> (?\<alpha> @ ?\<gamma> \<in> L ?M) = (?\<beta> @ ?\<gamma> \<in> L ?M)

goal (1 subgoal):
 1. v @ [(x, y)] \<in> L M2
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
v @ [(x, y)] \<in> L M2

goal (1 subgoal):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "preserves_divergence M1 M2 (list.set X \<union> {u,v})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set X \<union> {u, v})
[PROOF STEP]
by (metis (no_types) Un_insert_right \<open>preserves_divergence M1 M2 (Set.insert u (Set.insert v (list.set X)))\<close> sup_bot_right)
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (list.set X \<union> {u, v})

goal (1 subgoal):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have IS3: "\<And>w. w \<in> list.set X' \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>w. w \<in> list.set X' \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'
[PROOF STEP]
unfolding X'
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>w. w \<in> list.set (if notReferenced then v # u # X else u # X) \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'
[PROOF STEP]
by (metis (full_types) Suc.prems(3) \<open>converge M1 u u'\<close> \<open>converge M1 v v'\<close> \<open>converge M2 u u'\<close> \<open>converge M2 v v'\<close> set_ConsD)
[PROOF STATE]
proof (state)
this:
?w \<in> list.set X' \<Longrightarrow> \<exists>w'. converge M1 ?w w' \<and> converge M2 ?w w'

goal (1 subgoal):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "(u@[(x,y)] = v@[(x,y)]) = (u=v)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (u @ [(x, y)] = v @ [(x, y)]) = (u = v)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(u @ [(x, y)] = v @ [(x, y)]) = (u = v)

goal (1 subgoal):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have IS4: "L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u@[(x,y)] = v@[(x,y)]))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u@[(x,y)] = v@[(x,y)])))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u @ [(x, y)] = v @ [(x, y)]))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u @ [(x, y)] = v @ [(x, y)])))
[PROOF STEP]
using \<open>L M1 \<inter> set (fst (handleIO (T',G') (x,y))) = L M2 \<inter> set (fst (handleIO (T',G') (x,y)))\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (T', G') (x, y)))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u @ [(x, y)] = v @ [(x, y)]))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u @ [(x, y)] = v @ [(x, y)])))
[PROOF STEP]
unfolding handleIO \<open>(u@[(x,y)] = v@[(x,y)]) = (u=v)\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u = v)))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u @ [(x, y)] = v @ [(x, y)]))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u @ [(x, y)] = v @ [(x, y)])))

goal (1 subgoal):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have IH1: "\<And> \<gamma> xa ya. length (\<gamma> @ [(xa, ya)]) \<le> depth \<Longrightarrow>
                     \<gamma> \<in> LS M1 (after_initial M1 (u @ [(x, y)])) \<Longrightarrow>
                     xa \<in> FSM.inputs M1 \<Longrightarrow>
                     ya \<in> FSM.outputs M1 \<Longrightarrow>
                     L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(xa, ya)]))}) = L M2 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(xa, ya)]))}) \<and>
                     preserves_divergence M1 M2 (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(xa, ya)]))})"
        and  IH2: "preserves_divergence M1 M2 (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]})"
        and  IH3: "convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>\<gamma> xa ya. \<lbrakk>length (\<gamma> @ [(xa, ya)]) \<le> depth; \<gamma> \<in> LS M1 (after_initial M1 (u @ [(x, y)])); xa \<in> FSM.inputs M1; ya \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(xa, ya)]))}) = L M2 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(xa, ya)]))}) \<and> preserves_divergence M1 M2 (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(xa, ya)]))})) &&& preserves_divergence M1 M2 (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y)))
[PROOF STEP]
using Suc.IH[OF IS1 IS2 IS3 \<open>converge M1 (u@[(x,y)]) (v@[(x,y)])\<close> \<open>u@[(x,y)] \<in> L M2\<close> \<open>v@[(x,y)] \<in> L M2\<close> \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGv)\<close> IS4]
[PROOF STATE]
proof (prove)
using this:
(\<And>w. w \<in> list.set X' \<Longrightarrow> w \<in> list.set X') \<Longrightarrow> (\<forall>\<gamma> xa ya. length (\<gamma> @ [(xa, ya)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (u @ [(x, y)])) \<longrightarrow> xa \<in> FSM.inputs M1 \<longrightarrow> ya \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(xa, ya)]))}) = L M2 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(xa, ya)]))}) \<and> preserves_divergence M1 M2 (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(xa, ya)]))})) \<and> preserves_divergence M1 M2 (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V (fst TGv) (snd TGv) cg_lookup cg_insert get_distinguishing_trace (u @ [(x, y)]) (v @ [(x, y)]) X' k depth completeInputTraces append_heuristic (u @ [(x, y)] = v @ [(x, y)])))

goal (1 subgoal):
 1. (\<And>\<gamma> xa ya. \<lbrakk>length (\<gamma> @ [(xa, ya)]) \<le> depth; \<gamma> \<in> LS M1 (after_initial M1 (u @ [(x, y)])); xa \<in> FSM.inputs M1; ya \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(xa, ya)]))}) = L M2 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(xa, ya)]))}) \<and> preserves_divergence M1 M2 (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(xa, ya)]))})) &&& preserves_divergence M1 M2 (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y)))
[PROOF STEP]
unfolding handleIO[symmetric]
[PROOF STATE]
proof (prove)
using this:
(\<And>w. w \<in> list.set X' \<Longrightarrow> w \<in> list.set X') \<Longrightarrow> (\<forall>\<gamma> xa ya. length (\<gamma> @ [(xa, ya)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (u @ [(x, y)])) \<longrightarrow> xa \<in> FSM.inputs M1 \<longrightarrow> ya \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(xa, ya)]))}) = L M2 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(xa, ya)]))}) \<and> preserves_divergence M1 M2 (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(xa, ya)]))})) \<and> preserves_divergence M1 M2 (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y)))

goal (1 subgoal):
 1. (\<And>\<gamma> xa ya. \<lbrakk>length (\<gamma> @ [(xa, ya)]) \<le> depth; \<gamma> \<in> LS M1 (after_initial M1 (u @ [(x, y)])); xa \<in> FSM.inputs M1; ya \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(xa, ya)]))}) = L M2 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(xa, ya)]))}) \<and> preserves_divergence M1 M2 (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(xa, ya)]))})) &&& preserves_divergence M1 M2 (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y)))
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
\<lbrakk>length (?\<gamma> @ [(?xa, ?ya)]) \<le> depth; ?\<gamma> \<in> LS M1 (after_initial M1 (u @ [(x, y)])); ?xa \<in> FSM.inputs M1; ?ya \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma> @ [(?xa, ?ya)]))}) = L M2 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma> @ [(?xa, ?ya)]))}) \<and> preserves_divergence M1 M2 (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma> @ [(?xa, ?ya)]))})
preserves_divergence M1 M2 (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]})
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y)))

goal (1 subgoal):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have p3: "preserves_divergence M1 M2 (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
proof (cases notReferenced)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. notReferenced \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
 2. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
notReferenced

goal (2 subgoals):
 1. notReferenced \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
 2. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
notReferenced
[PROOF STEP]
have "list.set X' = list.set X \<union> {u,v}"
[PROOF STATE]
proof (prove)
using this:
notReferenced

goal (1 subgoal):
 1. list.set X' = list.set X \<union> {u, v}
[PROOF STEP]
unfolding X'
[PROOF STATE]
proof (prove)
using this:
notReferenced

goal (1 subgoal):
 1. list.set (if notReferenced then v # u # X else u # X) = list.set X \<union> {u, v}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
list.set X' = list.set X \<union> {u, v}

goal (2 subgoals):
 1. notReferenced \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
 2. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
using IH2
[PROOF STATE]
proof (prove)
using this:
preserves_divergence M1 M2 (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]})

goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
unfolding * preserves_divergence.simps \<open>list.set X' = list.set X \<union> {u,v}\<close>
[PROOF STATE]
proof (prove)
using this:
\<forall>\<alpha>\<in>L M1 \<inter> (list.set X \<union> {u, v} \<union> {u @ [(x, y)], v @ [(x, y)]}). \<forall>\<beta>\<in>L M1 \<inter> (list.set X \<union> {u, v} \<union> {u @ [(x, y)], v @ [(x, y)]}). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>

goal (1 subgoal):
 1. \<forall>\<alpha>\<in>L M1 \<inter> (list.set X \<union> {u, v, u @ [(x, y)], v @ [(x, y)]}). \<forall>\<beta>\<in>L M1 \<inter> (list.set X \<union> {u, v, u @ [(x, y)], v @ [(x, y)]}). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})

goal (1 subgoal):
 1. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> notReferenced

goal (1 subgoal):
 1. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> notReferenced
[PROOF STEP]
consider "u = v" | "(u \<noteq> v) \<and> \<not>(\<forall> q \<in> reachable_states M1 . V q \<notin> vClass)"
[PROOF STATE]
proof (prove)
using this:
\<not> notReferenced

goal (1 subgoal):
 1. \<lbrakk>u = v \<Longrightarrow> thesis; u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
unfolding notReferenced
[PROOF STATE]
proof (prove)
using this:
\<not> (u \<noteq> v \<and> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass))

goal (1 subgoal):
 1. \<lbrakk>u = v \<Longrightarrow> thesis; u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>u = v \<Longrightarrow> ?thesis; u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>u = v \<Longrightarrow> ?thesis; u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>u = v \<Longrightarrow> ?thesis; u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
proof cases
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. u = v \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
 2. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:
u = v

goal (2 subgoals):
 1. u = v \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
 2. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u = v
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
u = v

goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
by (metis (no_types, lifting) "*" False IH2 Un_insert_left Un_insert_right X' insertI1 insert_absorb list.simps(15))
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass)

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass)
[PROOF STEP]
have **:"(list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])}) = (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<union> {v}"
[PROOF STATE]
proof (prove)
using this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass)

goal (1 subgoal):
 1. list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])} = list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]} \<union> {v}
[PROOF STEP]
unfolding * X'
[PROOF STATE]
proof (prove)
using this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass)

goal (1 subgoal):
 1. list.set X \<union> {u, v, u @ [(x, y)], v @ [(x, y)]} = list.set (if notReferenced then v # u # X else u # X) \<union> {u @ [(x, y)], v @ [(x, y)]} \<union> {v}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])} = list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]} \<union> {v}

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
obtain q where "q \<in> reachable_states M1" and "V q \<in> vClass"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>q. \<lbrakk>q \<in> reachable_states M1; V q \<in> vClass\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using 2 notReferenced
[PROOF STATE]
proof (prove)
using this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass)
notReferenced = (u \<noteq> v \<and> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass))

goal (1 subgoal):
 1. (\<And>q. \<lbrakk>q \<in> reachable_states M1; V q \<in> vClass\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
q \<in> reachable_states M1
V q \<in> vClass

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
q \<in> reachable_states M1
V q \<in> vClass
[PROOF STEP]
have "V q \<in> list.set (cg_lookup (snd TG') v)"
[PROOF STATE]
proof (prove)
using this:
q \<in> reachable_states M1
V q \<in> vClass

goal (1 subgoal):
 1. V q \<in> list.set (cg_lookup (snd TG') v)
[PROOF STEP]
unfolding vClass
[PROOF STATE]
proof (prove)
using this:
q \<in> reachable_states M1
V q \<in> Set.insert v (list.set (cg_lookup (snd TG') v))

goal (1 subgoal):
 1. V q \<in> list.set (cg_lookup (snd TG') v)
[PROOF STEP]
using \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')\<close> \<open>v \<in> L M1\<close> \<open>v \<in> L M2\<close>
[PROOF STATE]
proof (prove)
using this:
q \<in> reachable_states M1
V q \<in> Set.insert v (list.set (cg_lookup (snd TG') v))
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')
v \<in> L M1
v \<in> L M2

goal (1 subgoal):
 1. V q \<in> list.set (cg_lookup (snd TG') v)
[PROOF STEP]
unfolding convergence_graph_lookup_invar_def
[PROOF STATE]
proof (prove)
using this:
q \<in> reachable_states M1
V q \<in> Set.insert v (list.set (cg_lookup (snd TG') v))
\<forall>\<alpha>. \<alpha> \<in> L M1 \<longrightarrow> \<alpha> \<in> L M2 \<longrightarrow> \<alpha> \<in> list.set (cg_lookup (snd TG') \<alpha>) \<and> (\<forall>\<beta>. \<beta> \<in> list.set (cg_lookup (snd TG') \<alpha>) \<longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)
v \<in> L M1
v \<in> L M2

goal (1 subgoal):
 1. V q \<in> list.set (cg_lookup (snd TG') v)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V q \<in> list.set (cg_lookup (snd TG') v)

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V q \<in> list.set (cg_lookup (snd TG') v)
[PROOF STEP]
have "converge M1 (V q) v" and "converge M2 (V q) v"
[PROOF STATE]
proof (prove)
using this:
V q \<in> list.set (cg_lookup (snd TG') v)

goal (1 subgoal):
 1. converge M1 (V q) v &&& converge M2 (V q) v
[PROOF STEP]
using convergence_graph_lookup_invar_simp[OF \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')\<close> \<open>v \<in> L M1\<close> \<open>v \<in> L M2\<close>, of "V q"]
[PROOF STATE]
proof (prove)
using this:
V q \<in> list.set (cg_lookup (snd TG') v)
V q \<in> list.set (cg_lookup (snd TG') v) \<Longrightarrow> converge M1 v (V q)
V q \<in> list.set (cg_lookup (snd TG') v) \<Longrightarrow> converge M2 v (V q)

goal (1 subgoal):
 1. converge M1 (V q) v &&& converge M2 (V q) v
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M1 (V q) v
converge M2 (V q) v

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
have "\<And> \<beta> . \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])}) \<Longrightarrow> \<not>converge M1 v \<beta> \<Longrightarrow> \<not>converge M2 v \<beta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<beta>. \<lbrakk>\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<not> converge M1 v \<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<beta>. \<lbrakk>\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<not> converge M1 v \<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
fix \<beta>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<beta>. \<lbrakk>\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<not> converge M1 v \<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
assume "\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])})" and "\<not>converge M1 v \<beta>"
[PROOF STATE]
proof (state)
this:
\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
\<not> converge M1 v \<beta>

goal (1 subgoal):
 1. \<And>\<beta>. \<lbrakk>\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<not> converge M1 v \<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
\<not> converge M1 v \<beta>
[PROOF STEP]
consider "\<beta> = v" | "\<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]})"
[PROOF STATE]
proof (prove)
using this:
\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
\<not> converge M1 v \<beta>

goal (1 subgoal):
 1. \<lbrakk>\<beta> = v \<Longrightarrow> thesis; \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
unfolding **
[PROOF STATE]
proof (prove)
using this:
\<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]} \<union> {v})
\<not> converge M1 v \<beta>

goal (1 subgoal):
 1. \<lbrakk>\<beta> = v \<Longrightarrow> thesis; \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<beta> = v \<Longrightarrow> ?thesis; \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. \<And>\<beta>. \<lbrakk>\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<not> converge M1 v \<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>\<beta> = v \<Longrightarrow> ?thesis; \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
[PROOF STEP]
show "\<not>converge M2 v \<beta>"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<beta> = v \<Longrightarrow> ?thesis; \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. \<not> converge M2 v \<beta>
[PROOF STEP]
proof cases
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<beta> = v \<Longrightarrow> \<not> converge M2 v \<beta>
 2. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:
\<beta> = v

goal (2 subgoals):
 1. \<beta> = v \<Longrightarrow> \<not> converge M2 v \<beta>
 2. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<beta> = v
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<beta> = v

goal (1 subgoal):
 1. \<not> converge M2 v \<beta>
[PROOF STEP]
using \<open>\<not>converge M1 v \<beta>\<close> \<open>v \<in> L M1\<close>
[PROOF STATE]
proof (prove)
using this:
\<beta> = v
\<not> converge M1 v \<beta>
v \<in> L M1

goal (1 subgoal):
 1. \<not> converge M2 v \<beta>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<not> converge M2 v \<beta>

goal (1 subgoal):
 1. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:
\<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]})

goal (1 subgoal):
 1. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]})

goal (1 subgoal):
 1. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
have "\<not>converge M1 (V q) \<beta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> converge M1 (V q) \<beta>
[PROOF STEP]
using \<open>converge M1 (V q) v\<close> \<open>\<not>converge M1 v \<beta>\<close>
[PROOF STATE]
proof (prove)
using this:
converge M1 (V q) v
\<not> converge M1 v \<beta>

goal (1 subgoal):
 1. \<not> converge M1 (V q) \<beta>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<not> converge M1 (V q) \<beta>

goal (1 subgoal):
 1. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<not> converge M1 (V q) \<beta>

goal (1 subgoal):
 1. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
have "V q \<in> list.set X'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V q \<in> list.set X'
[PROOF STEP]
using Suc.prems(1) \<open>q \<in> reachable_states M1\<close>
[PROOF STATE]
proof (prove)
using this:
V ` reachable_states M1 \<subseteq> list.set X
q \<in> reachable_states M1

goal (1 subgoal):
 1. V q \<in> list.set X'
[PROOF STEP]
unfolding X'
[PROOF STATE]
proof (prove)
using this:
V ` reachable_states M1 \<subseteq> list.set X
q \<in> reachable_states M1

goal (1 subgoal):
 1. V q \<in> list.set (if notReferenced then v # u # X else u # X)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
V q \<in> list.set X'

goal (1 subgoal):
 1. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
V q \<in> list.set X'

goal (1 subgoal):
 1. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
have "V q \<in> L M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V q \<in> L M1
[PROOF STEP]
using \<open>converge M1 (V q) v\<close> converge.simps
[PROOF STATE]
proof (prove)
using this:
converge M1 (V q) v
converge ?M ?\<pi> ?\<tau> = (?\<pi> \<in> L ?M \<and> ?\<tau> \<in> L ?M \<and> LS ?M (after_initial ?M ?\<pi>) = LS ?M (after_initial ?M ?\<tau>))

goal (1 subgoal):
 1. V q \<in> L M1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V q \<in> L M1

goal (1 subgoal):
 1. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]})
\<not> converge M1 (V q) \<beta>
V q \<in> list.set X'
V q \<in> L M1
[PROOF STEP]
have "\<not>converge M2 (V q) \<beta>"
[PROOF STATE]
proof (prove)
using this:
\<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]})
\<not> converge M1 (V q) \<beta>
V q \<in> list.set X'
V q \<in> L M1

goal (1 subgoal):
 1. \<not> converge M2 (V q) \<beta>
[PROOF STEP]
using IH2
[PROOF STATE]
proof (prove)
using this:
\<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]})
\<not> converge M1 (V q) \<beta>
V q \<in> list.set X'
V q \<in> L M1
preserves_divergence M1 M2 (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]})

goal (1 subgoal):
 1. \<not> converge M2 (V q) \<beta>
[PROOF STEP]
unfolding preserves_divergence.simps
[PROOF STATE]
proof (prove)
using this:
\<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]})
\<not> converge M1 (V q) \<beta>
V q \<in> list.set X'
V q \<in> L M1
\<forall>\<alpha>\<in>L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}). \<forall>\<beta>\<in>L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>

goal (1 subgoal):
 1. \<not> converge M2 (V q) \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<not> converge M2 (V q) \<beta>

goal (1 subgoal):
 1. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> converge M2 (V q) \<beta>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<not> converge M2 (V q) \<beta>

goal (1 subgoal):
 1. \<not> converge M2 v \<beta>
[PROOF STEP]
using \<open>converge M2 (V q) v\<close>
[PROOF STATE]
proof (prove)
using this:
\<not> converge M2 (V q) \<beta>
converge M2 (V q) v

goal (1 subgoal):
 1. \<not> converge M2 v \<beta>
[PROOF STEP]
unfolding converge.simps
[PROOF STATE]
proof (prove)
using this:
\<not> (V q \<in> L M2 \<and> \<beta> \<in> L M2 \<and> LS M2 (after_initial M2 (V q)) = LS M2 (after_initial M2 \<beta>))
V q \<in> L M2 \<and> v \<in> L M2 \<and> LS M2 (after_initial M2 (V q)) = LS M2 (after_initial M2 v)

goal (1 subgoal):
 1. \<not> (v \<in> L M2 \<and> \<beta> \<in> L M2 \<and> LS M2 (after_initial M2 v) = LS M2 (after_initial M2 \<beta>))
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
\<not> converge M2 v \<beta>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<not> converge M2 v \<beta>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>?\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<not> converge M1 v ?\<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 v ?\<beta>

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
have "\<And> \<alpha> \<beta> . \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])}) \<Longrightarrow> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])}) \<Longrightarrow> \<not>converge M1 \<alpha> \<beta> \<Longrightarrow> \<not>converge M2 \<alpha> \<beta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<not> converge M1 \<alpha> \<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<not> converge M1 \<alpha> \<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
fix \<alpha> \<beta>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<not> converge M1 \<alpha> \<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
assume "\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])})"
                             "\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])})"
                             "\<not>converge M1 \<alpha> \<beta>"
[PROOF STATE]
proof (state)
this:
\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
\<not> converge M1 \<alpha> \<beta>

goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<not> converge M1 \<alpha> \<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
\<not> converge M1 \<alpha> \<beta>
[PROOF STEP]
consider "\<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])})" |
                            "\<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])})" |
                            "\<alpha> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]})"
[PROOF STATE]
proof (prove)
using this:
\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
\<not> converge M1 \<alpha> \<beta>

goal (1 subgoal):
 1. \<lbrakk>\<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<Longrightarrow> thesis; \<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<Longrightarrow> thesis; \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
unfolding **
[PROOF STATE]
proof (prove)
using this:
\<alpha> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]} \<union> {v})
\<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]} \<union> {v})
\<not> converge M1 \<alpha> \<beta>

goal (1 subgoal):
 1. \<lbrakk>\<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]} \<union> {v}) \<Longrightarrow> thesis; \<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]} \<union> {v}) \<Longrightarrow> thesis; \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<Longrightarrow> ?thesis; \<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<Longrightarrow> ?thesis; \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<not> converge M1 \<alpha> \<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>\<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<Longrightarrow> ?thesis; \<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<Longrightarrow> ?thesis; \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
[PROOF STEP]
show "\<not>converge M2 \<alpha> \<beta>"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<Longrightarrow> ?thesis; \<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<Longrightarrow> ?thesis; \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
proof cases
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
 2. \<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
 3. \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:
\<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})

goal (3 subgoals):
 1. \<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
 2. \<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
 3. \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})

goal (1 subgoal):
 1. \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
using \<open>\<And> \<beta> . \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])}) \<Longrightarrow> \<not>converge M1 v \<beta> \<Longrightarrow> \<not>converge M2 v \<beta>\<close>
[PROOF STATE]
proof (prove)
using this:
\<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
\<lbrakk>?\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<not> converge M1 v ?\<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 v ?\<beta>

goal (1 subgoal):
 1. \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
using \<open>\<not> converge M1 \<alpha> \<beta>\<close>
[PROOF STATE]
proof (prove)
using this:
\<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
\<lbrakk>?\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<not> converge M1 v ?\<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 v ?\<beta>
\<not> converge M1 \<alpha> \<beta>

goal (1 subgoal):
 1. \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<not> converge M2 \<alpha> \<beta>

goal (2 subgoals):
 1. \<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
 2. \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
 2. \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:
\<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})

goal (2 subgoals):
 1. \<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
 2. \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})

goal (1 subgoal):
 1. \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
using \<open>\<And> \<beta> . \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])}) \<Longrightarrow> \<not>converge M1 v \<beta> \<Longrightarrow> \<not>converge M2 v \<beta>\<close>[of \<alpha>]
[PROOF STATE]
proof (prove)
using this:
\<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
\<lbrakk>\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<not> converge M1 v \<alpha>\<rbrakk> \<Longrightarrow> \<not> converge M2 v \<alpha>

goal (1 subgoal):
 1. \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
using \<open>\<not> converge M1 \<alpha> \<beta>\<close>
[PROOF STATE]
proof (prove)
using this:
\<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
\<lbrakk>\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<not> converge M1 v \<alpha>\<rbrakk> \<Longrightarrow> \<not> converge M2 v \<alpha>
\<not> converge M1 \<alpha> \<beta>

goal (1 subgoal):
 1. \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
unfolding converge_sym[of _ \<alpha>]
[PROOF STATE]
proof (prove)
using this:
\<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
\<lbrakk>\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<not> converge M1 v \<alpha>\<rbrakk> \<Longrightarrow> \<not> converge M2 v \<alpha>
\<not> converge M1 \<beta> \<alpha>

goal (1 subgoal):
 1. \<not> converge M2 \<beta> \<alpha>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<not> converge M2 \<alpha> \<beta>

goal (1 subgoal):
 1. \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
case 3
[PROOF STATE]
proof (state)
this:
\<alpha> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]})

goal (1 subgoal):
 1. \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<alpha> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]})
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<alpha> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]})

goal (1 subgoal):
 1. \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
using IH2 \<open>\<not> converge M1 \<alpha> \<beta>\<close>
[PROOF STATE]
proof (prove)
using this:
\<alpha> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]})
preserves_divergence M1 M2 (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]})
\<not> converge M1 \<alpha> \<beta>

goal (1 subgoal):
 1. \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
unfolding preserves_divergence.simps
[PROOF STATE]
proof (prove)
using this:
\<alpha> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]})
\<forall>\<alpha>\<in>L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}). \<forall>\<beta>\<in>L M1 \<inter> (list.set X' \<union> {u @ [(x, y)], v @ [(x, y)]}). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>
\<not> converge M1 \<alpha> \<beta>

goal (1 subgoal):
 1. \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<not> converge M2 \<alpha> \<beta>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<not> converge M2 \<alpha> \<beta>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>?\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); ?\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<not> converge M1 ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>?\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); ?\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<not> converge M1 ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 ?\<alpha> ?\<beta>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); ?\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<not> converge M1 ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
unfolding preserves_divergence.simps
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); ?\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}); \<not> converge M1 ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. \<forall>\<alpha>\<in>L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}). \<forall>\<beta>\<in>L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})

goal (1 subgoal):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have p4: "(\<And> \<gamma> x' y'.
                      length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<Longrightarrow>
                      (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<Longrightarrow>
                      x' \<in> FSM.inputs M1 \<Longrightarrow>
                      y' \<in> FSM.outputs M1 \<Longrightarrow>
                      L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) =
                      L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and>
                      preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<gamma> x' y'. \<lbrakk>length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth; (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u); x' \<in> FSM.inputs M1; y' \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<gamma> x' y'. \<lbrakk>length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth; (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u); x' \<in> FSM.inputs M1; y' \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
fix \<gamma> x' y'
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<gamma> x' y'. \<lbrakk>length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth; (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u); x' \<in> FSM.inputs M1; y' \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
assume "length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth"
                 "(x, y) # \<gamma> \<in> LS M1 (after_initial M1 u)"
                 "x' \<in> FSM.inputs M1"
                 "y' \<in> FSM.outputs M1"
[PROOF STATE]
proof (state)
this:
length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth
(x, y) # \<gamma> \<in> LS M1 (after_initial M1 u)
x' \<in> FSM.inputs M1
y' \<in> FSM.outputs M1

goal (1 subgoal):
 1. \<And>\<gamma> x' y'. \<lbrakk>length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth; (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u); x' \<in> FSM.inputs M1; y' \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
have s1: "length (\<gamma> @ [(x', y')]) \<le> depth"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length (\<gamma> @ [(x', y')]) \<le> depth
[PROOF STEP]
using \<open>length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth\<close>
[PROOF STATE]
proof (prove)
using this:
length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth

goal (1 subgoal):
 1. length (\<gamma> @ [(x', y')]) \<le> depth
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
length (\<gamma> @ [(x', y')]) \<le> depth

goal (1 subgoal):
 1. \<And>\<gamma> x' y'. \<lbrakk>length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth; (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u); x' \<in> FSM.inputs M1; y' \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
have s2: "\<gamma> \<in> LS M1 (after_initial M1 (u @ [(x, y)]))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<gamma> \<in> LS M1 (after_initial M1 (u @ [(x, y)]))
[PROOF STEP]
using \<open>(x, y) # \<gamma> \<in> LS M1 (after_initial M1 u)\<close>
[PROOF STATE]
proof (prove)
using this:
(x, y) # \<gamma> \<in> LS M1 (after_initial M1 u)

goal (1 subgoal):
 1. \<gamma> \<in> LS M1 (after_initial M1 (u @ [(x, y)]))
[PROOF STEP]
by (metis \<open>u @ [(x, y)] \<in> L M1\<close> after_language_append_iff append_Cons assms(1) empty_append_eq_id)
[PROOF STATE]
proof (state)
this:
\<gamma> \<in> LS M1 (after_initial M1 (u @ [(x, y)]))

goal (1 subgoal):
 1. \<And>\<gamma> x' y'. \<lbrakk>length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth; (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u); x' \<in> FSM.inputs M1; y' \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
have pass': "L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})"
          and  preserve': "preserves_divergence M1 M2 (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) &&& preserves_divergence M1 M2 (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})
[PROOF STEP]
using IH1[OF s1 s2 \<open>x' \<in> FSM.inputs M1\<close> \<open>y' \<in> FSM.outputs M1\<close>]
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})

goal (1 subgoal):
 1. L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) &&& preserves_divergence M1 M2 (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})
preserves_divergence M1 M2 (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})

goal (1 subgoal):
 1. \<And>\<gamma> x' y'. \<lbrakk>length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth; (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u); x' \<in> FSM.inputs M1; y' \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
have ***:"{\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
                = {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u,v}"
            (is "?A = ?B")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))} = {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))} \<subseteq> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
 2. {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v} \<subseteq> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
show "?A \<subseteq> ?B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))} \<subseteq> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>xa. xa \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))} \<Longrightarrow> xa \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
[PROOF STEP]
fix w
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>xa. xa \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))} \<Longrightarrow> xa \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
[PROOF STEP]
assume "w \<in> ?A"
[PROOF STATE]
proof (state)
this:
w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}

goal (1 subgoal):
 1. \<And>xa. xa \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))} \<Longrightarrow> xa \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
obtain \<omega> \<omega>' where "w = \<omega> @ \<omega>'" and "\<omega> \<in> {u, v}" and "\<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))"
[PROOF STATE]
proof (prove)
using this:
w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}

goal (1 subgoal):
 1. (\<And>\<omega> \<omega>'. \<lbrakk>w = \<omega> @ \<omega>'; \<omega> \<in> {u, v}; \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
w = \<omega> @ \<omega>'
\<omega> \<in> {u, v}
\<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))

goal (1 subgoal):
 1. \<And>xa. xa \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))} \<Longrightarrow> xa \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
[PROOF STEP]
show "w \<in> ?B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
[PROOF STEP]
proof (cases \<omega>')
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<omega>' = [] \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
 2. \<And>a list. \<omega>' = a # list \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
\<omega>' = []

goal (2 subgoals):
 1. \<omega>' = [] \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
 2. \<And>a list. \<omega>' = a # list \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<omega>' = []
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<omega>' = []

goal (1 subgoal):
 1. w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
[PROOF STEP]
unfolding \<open>w = \<omega> @ \<omega>'\<close> prefixes_set
[PROOF STATE]
proof (prove)
using this:
\<omega>' = []

goal (1 subgoal):
 1. \<omega> @ \<omega>' \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> {xs'. \<exists>xs''. xs' @ xs'' = \<gamma> @ [(x', y')]}} \<union> {u, v}
[PROOF STEP]
using \<open>\<omega> \<in> {u, v}\<close>
[PROOF STATE]
proof (prove)
using this:
\<omega>' = []
\<omega> \<in> {u, v}

goal (1 subgoal):
 1. \<omega> @ \<omega>' \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> {xs'. \<exists>xs''. xs' @ xs'' = \<gamma> @ [(x', y')]}} \<union> {u, v}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}

goal (1 subgoal):
 1. \<And>a list. \<omega>' = a # list \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a list. \<omega>' = a # list \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
[PROOF STEP]
case (Cons a list)
[PROOF STATE]
proof (state)
this:
\<omega>' = a # list

goal (1 subgoal):
 1. \<And>a list. \<omega>' = a # list \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<omega>' = a # list
[PROOF STEP]
have "a = (x,y)" and "list \<in> list.set (prefixes (\<gamma> @ [(x', y')]))"
[PROOF STATE]
proof (prove)
using this:
\<omega>' = a # list

goal (1 subgoal):
 1. a = (x, y) &&& list \<in> list.set (prefixes (\<gamma> @ [(x', y')]))
[PROOF STEP]
using \<open>\<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))\<close>
[PROOF STATE]
proof (prove)
using this:
\<omega>' = a # list
\<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))

goal (1 subgoal):
 1. a = (x, y) &&& list \<in> list.set (prefixes (\<gamma> @ [(x', y')]))
[PROOF STEP]
by (meson prefixes_Cons)+
[PROOF STATE]
proof (state)
this:
a = (x, y)
list \<in> list.set (prefixes (\<gamma> @ [(x', y')]))

goal (1 subgoal):
 1. \<And>a list. \<omega>' = a # list \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
a = (x, y)
list \<in> list.set (prefixes (\<gamma> @ [(x', y')]))

goal (1 subgoal):
 1. \<And>a list. \<omega>' = a # list \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
[PROOF STEP]
have "\<omega>@[(x,y)] \<in> {u @ [(x, y)], v @ [(x, y)]}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<omega> @ [(x, y)] \<in> {u @ [(x, y)], v @ [(x, y)]}
[PROOF STEP]
using \<open>\<omega> \<in> {u, v}\<close>
[PROOF STATE]
proof (prove)
using this:
\<omega> \<in> {u, v}

goal (1 subgoal):
 1. \<omega> @ [(x, y)] \<in> {u @ [(x, y)], v @ [(x, y)]}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<omega> @ [(x, y)] \<in> {u @ [(x, y)], v @ [(x, y)]}

goal (1 subgoal):
 1. \<And>a list. \<omega>' = a # list \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
a = (x, y)
list \<in> list.set (prefixes (\<gamma> @ [(x', y')]))
\<omega> @ [(x, y)] \<in> {u @ [(x, y)], v @ [(x, y)]}
[PROOF STEP]
have "((\<omega>@[(x,y)])@list) \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}"
[PROOF STATE]
proof (prove)
using this:
a = (x, y)
list \<in> list.set (prefixes (\<gamma> @ [(x', y')]))
\<omega> @ [(x, y)] \<in> {u @ [(x, y)], v @ [(x, y)]}

goal (1 subgoal):
 1. (\<omega> @ [(x, y)]) @ list \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<omega> @ [(x, y)]) @ list \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}

goal (1 subgoal):
 1. \<And>a list. \<omega>' = a # list \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(\<omega> @ [(x, y)]) @ list \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<omega> @ [(x, y)]) @ list \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}

goal (1 subgoal):
 1. w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
[PROOF STEP]
unfolding \<open>w = \<omega> @ \<omega>'\<close> Cons \<open>a = (x,y)\<close>
[PROOF STATE]
proof (prove)
using this:
(\<omega> @ [(x, y)]) @ list \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}

goal (1 subgoal):
 1. \<omega> @ (x, y) # list \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
{\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))} \<subseteq> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}

goal (1 subgoal):
 1. {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v} \<subseteq> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
show "?B \<subseteq> ?A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v} \<subseteq> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>xa. xa \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v} \<Longrightarrow> xa \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
fix w
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>xa. xa \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v} \<Longrightarrow> xa \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
assume "w \<in> ?B"
[PROOF STATE]
proof (state)
this:
w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}

goal (1 subgoal):
 1. \<And>xa. xa \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v} \<Longrightarrow> xa \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
[PROOF STEP]
consider "w \<in> {u,v}" | "w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}"
[PROOF STATE]
proof (prove)
using this:
w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}

goal (1 subgoal):
 1. \<lbrakk>w \<in> {u, v} \<Longrightarrow> thesis; w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>w \<in> {u, v} \<Longrightarrow> ?thesis; w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. \<And>xa. xa \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v} \<Longrightarrow> xa \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>w \<in> {u, v} \<Longrightarrow> ?thesis; w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
[PROOF STEP]
show "w \<in> ?A"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>w \<in> {u, v} \<Longrightarrow> ?thesis; w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
proof cases
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. w \<in> {u, v} \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
 2. w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:
w \<in> {u, v}

goal (2 subgoals):
 1. w \<in> {u, v} \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
 2. w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
w \<in> {u, v}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
w \<in> {u, v}

goal (1 subgoal):
 1. w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
using prefixes_set_Nil[of " ((x, y) # \<gamma> @ [(x', y')])"]
[PROOF STATE]
proof (prove)
using this:
w \<in> {u, v}
[] \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))

goal (1 subgoal):
 1. w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
using append.right_neutral
[PROOF STATE]
proof (prove)
using this:
w \<in> {u, v}
[] \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))
?a @ [] = ?a

goal (1 subgoal):
 1. w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}

goal (1 subgoal):
 1. w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:
w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}

goal (1 subgoal):
 1. w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}
[PROOF STEP]
obtain \<omega> \<omega>' where "w = \<omega> @ \<omega>'" and "\<omega> \<in> {u @ [(x, y)], v @ [(x, y)]}" and "\<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))"
[PROOF STATE]
proof (prove)
using this:
w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}

goal (1 subgoal):
 1. (\<And>\<omega> \<omega>'. \<lbrakk>w = \<omega> @ \<omega>'; \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]}; \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
w = \<omega> @ \<omega>'
\<omega> \<in> {u @ [(x, y)], v @ [(x, y)]}
\<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))

goal (1 subgoal):
 1. w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
obtain \<omega>'' where "\<omega> = \<omega>''@[(x,y)]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>\<omega>''. \<omega> = \<omega>'' @ [(x, y)] \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<open>\<omega> \<in> {u @ [(x, y)], v @ [(x, y)]}\<close>
[PROOF STATE]
proof (prove)
using this:
\<omega> \<in> {u @ [(x, y)], v @ [(x, y)]}

goal (1 subgoal):
 1. (\<And>\<omega>''. \<omega> = \<omega>'' @ [(x, y)] \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<omega> = \<omega>'' @ [(x, y)]

goal (1 subgoal):
 1. w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<omega> = \<omega>'' @ [(x, y)]
[PROOF STEP]
have "\<omega>'' \<in> {u,v}"
[PROOF STATE]
proof (prove)
using this:
\<omega> = \<omega>'' @ [(x, y)]

goal (1 subgoal):
 1. \<omega>'' \<in> {u, v}
[PROOF STEP]
using \<open>\<omega> \<in> {u @ [(x, y)], v @ [(x, y)]}\<close>
[PROOF STATE]
proof (prove)
using this:
\<omega> = \<omega>'' @ [(x, y)]
\<omega> \<in> {u @ [(x, y)], v @ [(x, y)]}

goal (1 subgoal):
 1. \<omega>'' \<in> {u, v}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<omega>'' \<in> {u, v}

goal (1 subgoal):
 1. w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<omega>'' \<in> {u, v}

goal (1 subgoal):
 1. w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
have "[(x,y)]@\<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. [(x, y)] @ \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))
[PROOF STEP]
using prefixes_prepend[OF \<open>\<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))\<close>]
[PROOF STATE]
proof (prove)
using this:
?ys @ \<omega>' \<in> list.set (prefixes (?ys @ \<gamma> @ [(x', y')]))

goal (1 subgoal):
 1. [(x, y)] @ \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))
[PROOF STEP]
by (metis append_Cons empty_append_eq_id)
[PROOF STATE]
proof (state)
this:
[(x, y)] @ \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))

goal (1 subgoal):
 1. w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<Longrightarrow> w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<omega>'' \<in> {u, v}
[(x, y)] @ \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))
[PROOF STEP]
show "w \<in> ?A"
[PROOF STATE]
proof (prove)
using this:
\<omega>'' \<in> {u, v}
[(x, y)] @ \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))

goal (1 subgoal):
 1. w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
unfolding \<open>w = \<omega> @ \<omega>'\<close> \<open>\<omega> = \<omega>''@[(x,y)]\<close>
[PROOF STATE]
proof (prove)
using this:
\<omega>'' \<in> {u, v}
[(x, y)] @ \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))

goal (1 subgoal):
 1. (\<omega>'' @ [(x, y)]) @ \<omega>' \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
using append_assoc
[PROOF STATE]
proof (prove)
using this:
\<omega>'' \<in> {u, v}
[(x, y)] @ \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))
(?xs @ ?ys) @ ?zs = ?xs @ ?ys @ ?zs

goal (1 subgoal):
 1. (\<omega>'' @ [(x, y)]) @ \<omega>' \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
w \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
{\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v} \<subseteq> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
{\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))} = {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}

goal (1 subgoal):
 1. \<And>\<gamma> x' y'. \<lbrakk>length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth; (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u); x' \<in> FSM.inputs M1; y' \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
have "list.set X \<subseteq> list.set X'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list.set X \<subseteq> list.set X'
[PROOF STEP]
unfolding X'
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list.set X \<subseteq> list.set (if notReferenced then v # u # X else u # X)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
list.set X \<subseteq> list.set X'

goal (1 subgoal):
 1. \<And>\<gamma> x' y'. \<lbrakk>length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth; (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u); x' \<in> FSM.inputs M1; y' \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
list.set X \<subseteq> list.set X'
[PROOF STEP]
have pass'': "L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})"
[PROOF STATE]
proof (prove)
using this:
list.set X \<subseteq> list.set X'

goal (1 subgoal):
 1. L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
using pass' \<open>u \<in> L M1\<close> \<open>v \<in> L M1\<close> \<open>u \<in> L M2\<close> \<open>v \<in> L M2\<close>
[PROOF STATE]
proof (prove)
using this:
list.set X \<subseteq> list.set X'
L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})
u \<in> L M1
v \<in> L M1
u \<in> L M2
v \<in> L M2

goal (1 subgoal):
 1. L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
unfolding ***
[PROOF STATE]
proof (prove)
using this:
list.set X \<subseteq> list.set X'
L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})
u \<in> L M1
v \<in> L M1
u \<in> L M2
v \<in> L M2

goal (1 subgoal):
 1. L M1 \<inter> (list.set X \<union> ({\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v})) = L M2 \<inter> (list.set X \<union> ({\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})

goal (1 subgoal):
 1. \<And>\<gamma> x' y'. \<lbrakk>length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth; (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u); x' \<in> FSM.inputs M1; y' \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
have preserve'': "preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
proof (cases notReferenced)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. notReferenced \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
 2. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
notReferenced

goal (2 subgoals):
 1. notReferenced \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
 2. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
notReferenced
[PROOF STEP]
have "list.set X' = list.set X \<union> {u,v}"
[PROOF STATE]
proof (prove)
using this:
notReferenced

goal (1 subgoal):
 1. list.set X' = list.set X \<union> {u, v}
[PROOF STEP]
unfolding X'
[PROOF STATE]
proof (prove)
using this:
notReferenced

goal (1 subgoal):
 1. list.set (if notReferenced then v # u # X else u # X) = list.set X \<union> {u, v}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
list.set X' = list.set X \<union> {u, v}

goal (2 subgoals):
 1. notReferenced \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
 2. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
using preserve'
[PROOF STATE]
proof (prove)
using this:
preserves_divergence M1 M2 (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})

goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
unfolding *** preserves_divergence.simps \<open>list.set X' = list.set X \<union> {u,v}\<close>
[PROOF STATE]
proof (prove)
using this:
\<forall>\<alpha>\<in>L M1 \<inter> (list.set X \<union> {u, v} \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}). \<forall>\<beta>\<in>L M1 \<inter> (list.set X \<union> {u, v} \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>

goal (1 subgoal):
 1. \<forall>\<alpha>\<in>L M1 \<inter> (list.set X \<union> ({\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v})). \<forall>\<beta>\<in>L M1 \<inter> (list.set X \<union> ({\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v})). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})

goal (1 subgoal):
 1. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> notReferenced

goal (1 subgoal):
 1. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> notReferenced
[PROOF STEP]
consider "u = v" | "(u \<noteq> v) \<and> \<not>(\<forall> q \<in> reachable_states M1 . V q \<notin> vClass)"
[PROOF STATE]
proof (prove)
using this:
\<not> notReferenced

goal (1 subgoal):
 1. \<lbrakk>u = v \<Longrightarrow> thesis; u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
unfolding notReferenced
[PROOF STATE]
proof (prove)
using this:
\<not> (u \<noteq> v \<and> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass))

goal (1 subgoal):
 1. \<lbrakk>u = v \<Longrightarrow> thesis; u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>u = v \<Longrightarrow> ?thesis; u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. \<not> notReferenced \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>u = v \<Longrightarrow> ?thesis; u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>u = v \<Longrightarrow> ?thesis; u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
proof cases
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. u = v \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
 2. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:
u = v

goal (2 subgoals):
 1. u = v \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
 2. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u = v
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
u = v

goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
using "***" X' preserve'
[PROOF STATE]
proof (prove)
using this:
u = v
{\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))} = {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}
X' = (if notReferenced then v # u # X else u # X)
preserves_divergence M1 M2 (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})

goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass)

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass)
[PROOF STEP]
have **:"(list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<union> {v}"
[PROOF STATE]
proof (prove)
using this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass)

goal (1 subgoal):
 1. list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))} = list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {v}
[PROOF STEP]
unfolding *** X'
[PROOF STATE]
proof (prove)
using this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass)

goal (1 subgoal):
 1. list.set X \<union> ({\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {u, v}) = list.set (if notReferenced then v # u # X else u # X) \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {v}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))} = list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {v}

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
obtain q where "q \<in> reachable_states M1" and "V q \<in> vClass"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>q. \<lbrakk>q \<in> reachable_states M1; V q \<in> vClass\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using 2 notReferenced
[PROOF STATE]
proof (prove)
using this:
u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass)
notReferenced = (u \<noteq> v \<and> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass))

goal (1 subgoal):
 1. (\<And>q. \<lbrakk>q \<in> reachable_states M1; V q \<in> vClass\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
q \<in> reachable_states M1
V q \<in> vClass

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
q \<in> reachable_states M1
V q \<in> vClass
[PROOF STEP]
have "V q \<in> list.set (cg_lookup (snd TG') v)"
[PROOF STATE]
proof (prove)
using this:
q \<in> reachable_states M1
V q \<in> vClass

goal (1 subgoal):
 1. V q \<in> list.set (cg_lookup (snd TG') v)
[PROOF STEP]
unfolding vClass
[PROOF STATE]
proof (prove)
using this:
q \<in> reachable_states M1
V q \<in> Set.insert v (list.set (cg_lookup (snd TG') v))

goal (1 subgoal):
 1. V q \<in> list.set (cg_lookup (snd TG') v)
[PROOF STEP]
using \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')\<close> \<open>v \<in> L M1\<close> \<open>v \<in> L M2\<close>
[PROOF STATE]
proof (prove)
using this:
q \<in> reachable_states M1
V q \<in> Set.insert v (list.set (cg_lookup (snd TG') v))
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')
v \<in> L M1
v \<in> L M2

goal (1 subgoal):
 1. V q \<in> list.set (cg_lookup (snd TG') v)
[PROOF STEP]
unfolding convergence_graph_lookup_invar_def
[PROOF STATE]
proof (prove)
using this:
q \<in> reachable_states M1
V q \<in> Set.insert v (list.set (cg_lookup (snd TG') v))
\<forall>\<alpha>. \<alpha> \<in> L M1 \<longrightarrow> \<alpha> \<in> L M2 \<longrightarrow> \<alpha> \<in> list.set (cg_lookup (snd TG') \<alpha>) \<and> (\<forall>\<beta>. \<beta> \<in> list.set (cg_lookup (snd TG') \<alpha>) \<longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)
v \<in> L M1
v \<in> L M2

goal (1 subgoal):
 1. V q \<in> list.set (cg_lookup (snd TG') v)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V q \<in> list.set (cg_lookup (snd TG') v)

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V q \<in> list.set (cg_lookup (snd TG') v)
[PROOF STEP]
have "converge M1 (V q) v" and "converge M2 (V q) v"
[PROOF STATE]
proof (prove)
using this:
V q \<in> list.set (cg_lookup (snd TG') v)

goal (1 subgoal):
 1. converge M1 (V q) v &&& converge M2 (V q) v
[PROOF STEP]
using convergence_graph_lookup_invar_simp[OF \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG')\<close> \<open>v \<in> L M1\<close> \<open>v \<in> L M2\<close>, of "V q"]
[PROOF STATE]
proof (prove)
using this:
V q \<in> list.set (cg_lookup (snd TG') v)
V q \<in> list.set (cg_lookup (snd TG') v) \<Longrightarrow> converge M1 v (V q)
V q \<in> list.set (cg_lookup (snd TG') v) \<Longrightarrow> converge M2 v (V q)

goal (1 subgoal):
 1. converge M1 (V q) v &&& converge M2 (V q) v
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M1 (V q) v
converge M2 (V q) v

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
have "\<And> \<beta> . \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not>converge M1 v \<beta> \<Longrightarrow> \<not>converge M2 v \<beta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<beta>. \<lbrakk>\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<not> converge M1 v \<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<beta>. \<lbrakk>\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<not> converge M1 v \<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
fix \<beta>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<beta>. \<lbrakk>\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<not> converge M1 v \<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
assume "\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})" and "\<not>converge M1 v \<beta>"
[PROOF STATE]
proof (state)
this:
\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
\<not> converge M1 v \<beta>

goal (1 subgoal):
 1. \<And>\<beta>. \<lbrakk>\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<not> converge M1 v \<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
\<not> converge M1 v \<beta>
[PROOF STEP]
consider "\<beta> = v" | "\<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})"
[PROOF STATE]
proof (prove)
using this:
\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
\<not> converge M1 v \<beta>

goal (1 subgoal):
 1. \<lbrakk>\<beta> = v \<Longrightarrow> thesis; \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
unfolding **
[PROOF STATE]
proof (prove)
using this:
\<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {v})
\<not> converge M1 v \<beta>

goal (1 subgoal):
 1. \<lbrakk>\<beta> = v \<Longrightarrow> thesis; \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<beta> = v \<Longrightarrow> ?thesis; \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. \<And>\<beta>. \<lbrakk>\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<not> converge M1 v \<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>\<beta> = v \<Longrightarrow> ?thesis; \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
[PROOF STEP]
show "\<not>converge M2 v \<beta>"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<beta> = v \<Longrightarrow> ?thesis; \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. \<not> converge M2 v \<beta>
[PROOF STEP]
proof cases
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<beta> = v \<Longrightarrow> \<not> converge M2 v \<beta>
 2. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:
\<beta> = v

goal (2 subgoals):
 1. \<beta> = v \<Longrightarrow> \<not> converge M2 v \<beta>
 2. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<beta> = v
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<beta> = v

goal (1 subgoal):
 1. \<not> converge M2 v \<beta>
[PROOF STEP]
using \<open>\<not>converge M1 v \<beta>\<close> \<open>v \<in> L M1\<close>
[PROOF STATE]
proof (prove)
using this:
\<beta> = v
\<not> converge M1 v \<beta>
v \<in> L M1

goal (1 subgoal):
 1. \<not> converge M2 v \<beta>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<not> converge M2 v \<beta>

goal (1 subgoal):
 1. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:
\<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})

goal (1 subgoal):
 1. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})

goal (1 subgoal):
 1. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
have "\<not>converge M1 (V q) \<beta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> converge M1 (V q) \<beta>
[PROOF STEP]
using \<open>converge M1 (V q) v\<close> \<open>\<not>converge M1 v \<beta>\<close>
[PROOF STATE]
proof (prove)
using this:
converge M1 (V q) v
\<not> converge M1 v \<beta>

goal (1 subgoal):
 1. \<not> converge M1 (V q) \<beta>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<not> converge M1 (V q) \<beta>

goal (1 subgoal):
 1. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<not> converge M1 (V q) \<beta>

goal (1 subgoal):
 1. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
have "V q \<in> list.set X'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V q \<in> list.set X'
[PROOF STEP]
using Suc.prems(1) \<open>q \<in> reachable_states M1\<close>
[PROOF STATE]
proof (prove)
using this:
V ` reachable_states M1 \<subseteq> list.set X
q \<in> reachable_states M1

goal (1 subgoal):
 1. V q \<in> list.set X'
[PROOF STEP]
unfolding X'
[PROOF STATE]
proof (prove)
using this:
V ` reachable_states M1 \<subseteq> list.set X
q \<in> reachable_states M1

goal (1 subgoal):
 1. V q \<in> list.set (if notReferenced then v # u # X else u # X)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
V q \<in> list.set X'

goal (1 subgoal):
 1. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
V q \<in> list.set X'

goal (1 subgoal):
 1. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
have "V q \<in> L M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V q \<in> L M1
[PROOF STEP]
using \<open>converge M1 (V q) v\<close> converge.simps
[PROOF STATE]
proof (prove)
using this:
converge M1 (V q) v
converge ?M ?\<pi> ?\<tau> = (?\<pi> \<in> L ?M \<and> ?\<tau> \<in> L ?M \<and> LS ?M (after_initial ?M ?\<pi>) = LS ?M (after_initial ?M ?\<tau>))

goal (1 subgoal):
 1. V q \<in> L M1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V q \<in> L M1

goal (1 subgoal):
 1. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})
\<not> converge M1 (V q) \<beta>
V q \<in> list.set X'
V q \<in> L M1
[PROOF STEP]
have "\<not>converge M2 (V q) \<beta>"
[PROOF STATE]
proof (prove)
using this:
\<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})
\<not> converge M1 (V q) \<beta>
V q \<in> list.set X'
V q \<in> L M1

goal (1 subgoal):
 1. \<not> converge M2 (V q) \<beta>
[PROOF STEP]
using preserve'
[PROOF STATE]
proof (prove)
using this:
\<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})
\<not> converge M1 (V q) \<beta>
V q \<in> list.set X'
V q \<in> L M1
preserves_divergence M1 M2 (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})

goal (1 subgoal):
 1. \<not> converge M2 (V q) \<beta>
[PROOF STEP]
unfolding preserves_divergence.simps
[PROOF STATE]
proof (prove)
using this:
\<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})
\<not> converge M1 (V q) \<beta>
V q \<in> list.set X'
V q \<in> L M1
\<forall>\<alpha>\<in>L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}). \<forall>\<beta>\<in>L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>

goal (1 subgoal):
 1. \<not> converge M2 (V q) \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<not> converge M2 (V q) \<beta>

goal (1 subgoal):
 1. \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 v \<beta>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> converge M2 (V q) \<beta>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<not> converge M2 (V q) \<beta>

goal (1 subgoal):
 1. \<not> converge M2 v \<beta>
[PROOF STEP]
using \<open>converge M2 (V q) v\<close>
[PROOF STATE]
proof (prove)
using this:
\<not> converge M2 (V q) \<beta>
converge M2 (V q) v

goal (1 subgoal):
 1. \<not> converge M2 v \<beta>
[PROOF STEP]
unfolding converge.simps
[PROOF STATE]
proof (prove)
using this:
\<not> (V q \<in> L M2 \<and> \<beta> \<in> L M2 \<and> LS M2 (after_initial M2 (V q)) = LS M2 (after_initial M2 \<beta>))
V q \<in> L M2 \<and> v \<in> L M2 \<and> LS M2 (after_initial M2 (V q)) = LS M2 (after_initial M2 v)

goal (1 subgoal):
 1. \<not> (v \<in> L M2 \<and> \<beta> \<in> L M2 \<and> LS M2 (after_initial M2 v) = LS M2 (after_initial M2 \<beta>))
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
\<not> converge M2 v \<beta>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<not> converge M2 v \<beta>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>?\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<not> converge M1 v ?\<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 v ?\<beta>

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
have "\<And> \<alpha> \<beta> . \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<Longrightarrow> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not>converge M1 \<alpha> \<beta> \<Longrightarrow> \<not>converge M2 \<alpha> \<beta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<not> converge M1 \<alpha> \<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<not> converge M1 \<alpha> \<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
fix \<alpha> \<beta>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<not> converge M1 \<alpha> \<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
assume "\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})"
                               "\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})"
                               "\<not>converge M1 \<alpha> \<beta>"
[PROOF STATE]
proof (state)
this:
\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
\<not> converge M1 \<alpha> \<beta>

goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<not> converge M1 \<alpha> \<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
\<not> converge M1 \<alpha> \<beta>
[PROOF STEP]
consider "\<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})" |
                              "\<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})" |
                              "\<alpha> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})"
[PROOF STATE]
proof (prove)
using this:
\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
\<not> converge M1 \<alpha> \<beta>

goal (1 subgoal):
 1. \<lbrakk>\<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<Longrightarrow> thesis; \<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<Longrightarrow> thesis; \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
unfolding **
[PROOF STATE]
proof (prove)
using this:
\<alpha> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {v})
\<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {v})
\<not> converge M1 \<alpha> \<beta>

goal (1 subgoal):
 1. \<lbrakk>\<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {v}) \<Longrightarrow> thesis; \<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))} \<union> {v}) \<Longrightarrow> thesis; \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<Longrightarrow> ?thesis; \<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<Longrightarrow> ?thesis; \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<not> converge M1 \<alpha> \<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>\<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<Longrightarrow> ?thesis; \<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<Longrightarrow> ?thesis; \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
[PROOF STEP]
show "\<not>converge M2 \<alpha> \<beta>"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<Longrightarrow> ?thesis; \<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<Longrightarrow> ?thesis; \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
proof cases
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
 2. \<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
 3. \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:
\<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})

goal (3 subgoals):
 1. \<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
 2. \<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
 3. \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})

goal (1 subgoal):
 1. \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
using \<open>\<And> \<beta> . \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not>converge M1 v \<beta> \<Longrightarrow> \<not>converge M2 v \<beta>\<close>
[PROOF STATE]
proof (prove)
using this:
\<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
\<lbrakk>?\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<not> converge M1 v ?\<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 v ?\<beta>

goal (1 subgoal):
 1. \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
using \<open>\<not> converge M1 \<alpha> \<beta>\<close>
[PROOF STATE]
proof (prove)
using this:
\<alpha> = v \<and> \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
\<lbrakk>?\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<not> converge M1 v ?\<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 v ?\<beta>
\<not> converge M1 \<alpha> \<beta>

goal (1 subgoal):
 1. \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<not> converge M2 \<alpha> \<beta>

goal (2 subgoals):
 1. \<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
 2. \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
 2. \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:
\<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})

goal (2 subgoals):
 1. \<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
 2. \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})

goal (1 subgoal):
 1. \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
using \<open>\<And> \<beta> . \<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not>converge M1 v \<beta> \<Longrightarrow> \<not>converge M2 v \<beta>\<close>[of \<alpha>]
[PROOF STATE]
proof (prove)
using this:
\<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
\<lbrakk>\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<not> converge M1 v \<alpha>\<rbrakk> \<Longrightarrow> \<not> converge M2 v \<alpha>

goal (1 subgoal):
 1. \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
using \<open>\<not> converge M1 \<alpha> \<beta>\<close>
[PROOF STATE]
proof (prove)
using this:
\<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
\<lbrakk>\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<not> converge M1 v \<alpha>\<rbrakk> \<Longrightarrow> \<not> converge M2 v \<alpha>
\<not> converge M1 \<alpha> \<beta>

goal (1 subgoal):
 1. \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
unfolding converge_sym[of _ \<alpha>]
[PROOF STATE]
proof (prove)
using this:
\<beta> = v \<and> \<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
\<lbrakk>\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<not> converge M1 v \<alpha>\<rbrakk> \<Longrightarrow> \<not> converge M2 v \<alpha>
\<not> converge M1 \<beta> \<alpha>

goal (1 subgoal):
 1. \<not> converge M2 \<beta> \<alpha>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<not> converge M2 \<alpha> \<beta>

goal (1 subgoal):
 1. \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
case 3
[PROOF STATE]
proof (state)
this:
\<alpha> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})

goal (1 subgoal):
 1. \<alpha> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<Longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<alpha> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<alpha> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})

goal (1 subgoal):
 1. \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
using preserve' \<open>\<not> converge M1 \<alpha> \<beta>\<close>
[PROOF STATE]
proof (prove)
using this:
\<alpha> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})
preserves_divergence M1 M2 (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})
\<not> converge M1 \<alpha> \<beta>

goal (1 subgoal):
 1. \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
unfolding preserves_divergence.simps
[PROOF STATE]
proof (prove)
using this:
\<alpha> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}) \<and> \<beta> \<in> L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))})
\<forall>\<alpha>\<in>L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}). \<forall>\<beta>\<in>L M1 \<inter> (list.set X' \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u @ [(x, y)], v @ [(x, y)]} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x', y')]))}). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>
\<not> converge M1 \<alpha> \<beta>

goal (1 subgoal):
 1. \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<not> converge M2 \<alpha> \<beta>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<not> converge M2 \<alpha> \<beta>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>?\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); ?\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<not> converge M1 ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. u \<noteq> v \<and> \<not> (\<forall>q\<in>reachable_states M1. V q \<notin> vClass) \<Longrightarrow> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>?\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); ?\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<not> converge M1 ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 ?\<alpha> ?\<beta>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); ?\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<not> converge M1 ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
unfolding preserves_divergence.simps
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?\<alpha> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); ?\<beta> \<in> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}); \<not> converge M1 ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> \<not> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. \<forall>\<alpha>\<in>L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}). \<forall>\<beta>\<in>L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})

goal (1 subgoal):
 1. \<And>\<gamma> x' y'. \<lbrakk>length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth; (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u); x' \<in> FSM.inputs M1; y' \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
show "L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) =
                      L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and>
                      preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
using pass'' preserve''
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})

goal (1 subgoal):
 1. L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>length ((x, y) # ?\<gamma> @ [(?x', ?y')]) \<le> Suc depth; (x, y) # ?\<gamma> \<in> LS M1 (after_initial M1 u); ?x' \<in> FSM.inputs M1; ?y' \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # ?\<gamma> @ [(?x', ?y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # ?\<gamma> @ [(?x', ?y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # ?\<gamma> @ [(?x', ?y')]))})

goal (1 subgoal):
 1. is_in_language M1 (FSM.initial M1) (u @ [(x, y)]) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
using IH3 p2 p3 p4
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y)))
L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
\<lbrakk>length ((x, y) # ?\<gamma> @ [(?x', ?y')]) \<le> Suc depth; (x, y) # ?\<gamma> \<in> LS M1 (after_initial M1 u); ?x' \<in> FSM.inputs M1; ?y' \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # ?\<gamma> @ [(?x', ?y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # ?\<gamma> @ [(?x', ?y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # ?\<gamma> @ [(?x', ?y')]))})

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (T', G') (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>Prefix_Tree.set T \<subseteq> Prefix_Tree.set ?T'; convergence_graph_lookup_invar M1 M2 cg_lookup ?G'; L M1 \<inter> Prefix_Tree.set (fst (handleIO (?T', ?G') (?x, ?y))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (?T', ?G') (?x, ?y))); ?x \<in> FSM.inputs M1; ?y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (?T', ?G') (?x, ?y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(?x, ?y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(?x, ?y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(?x, ?y)])}) \<and> (\<forall>\<gamma> x' y'. length ((?x, ?y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (?x, ?y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((?x, ?y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((?x, ?y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((?x, ?y) # \<gamma> @ [(x', y')]))}))

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have foldl_handleIO_subset: "\<And> XY T G . set T \<subseteq> set (fst (foldl handleIO (T,G) XY))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>XY T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) XY))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>XY T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) XY))
[PROOF STEP]
fix XY T G
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>XY T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) XY))
[PROOF STEP]
show "set T \<subseteq> set (fst (foldl handleIO (T,G) XY))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) XY))
[PROOF STEP]
proof (induction XY rule: rev_induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) []))
 2. \<And>x xs. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) xs)) \<Longrightarrow> Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) (xs @ [x])))
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:

goal (2 subgoals):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) []))
 2. \<And>x xs. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) xs)) \<Longrightarrow> Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) (xs @ [x])))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) []))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) []))

goal (1 subgoal):
 1. \<And>x xs. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) xs)) \<Longrightarrow> Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) (xs @ [x])))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x xs. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) xs)) \<Longrightarrow> Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) (xs @ [x])))
[PROOF STEP]
case (snoc x xs)
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) xs))

goal (1 subgoal):
 1. \<And>x xs. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) xs)) \<Longrightarrow> Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) (xs @ [x])))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) xs))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) xs))

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) (xs @ [x])))
[PROOF STEP]
using handleIO_subset[of "fst (foldl handleIO (T, G) xs)" "snd (foldl handleIO (T, G) xs)" "fst x" "snd x"]
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) xs))
Prefix_Tree.set (fst (foldl handleIO (T, G) xs)) \<subseteq> Prefix_Tree.set (fst (handleIO (fst (foldl handleIO (T, G) xs), snd (foldl handleIO (T, G) xs)) (fst x, snd x)))

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) (xs @ [x])))
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) (xs @ [x])))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (T, G) XY))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (?T, ?G) ?XY))

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "list.set XY = inputs M1 \<times> outputs M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list.set XY = FSM.inputs M1 \<times> FSM.outputs M1
[PROOF STEP]
unfolding XY
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list.set (List.product (inputs_as_list M1) (outputs_as_list M1)) = FSM.inputs M1 \<times> FSM.outputs M1
[PROOF STEP]
by (metis inputs_as_list_set outputs_as_list_set set_product)
[PROOF STATE]
proof (state)
this:
list.set XY = FSM.inputs M1 \<times> FSM.outputs M1

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
list.set XY = FSM.inputs M1 \<times> FSM.outputs M1
[PROOF STEP]
have "list.set XY \<subseteq> inputs M1 \<times> outputs M1"
[PROOF STATE]
proof (prove)
using this:
list.set XY = FSM.inputs M1 \<times> FSM.outputs M1

goal (1 subgoal):
 1. list.set XY \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
list.set XY \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
list.set XY \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "L M1 \<inter> set (fst (foldl handleIO (fst TG'', snd TG'') XY)) = L M2 \<inter> set (fst (foldl handleIO (fst TG'', snd TG'') XY))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY))
[PROOF STEP]
using pass_result
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO TG'' XY)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO TG'' XY))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY))

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
list.set XY \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1
L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY))
[PROOF STEP]
have foldl_handleIO_props: "convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') XY))
                                           \<and> (\<forall> x y . (x,y) \<in> list.set XY \<longrightarrow>
                                                    L M1 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])}) = L M2 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])})
                                                    \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])})
                                                    \<and> (\<forall> \<gamma> x' y' . length ((x,y)#\<gamma>@[(x',y')]) \<le> Suc depth \<longrightarrow>
                                                           ((x,y)#\<gamma>) \<in> LS M1 (after_initial M1 u) \<longrightarrow>
                                                          x' \<in> inputs M1 \<longrightarrow> y' \<in> outputs M1 \<longrightarrow>
                                                          L M1 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes ((x,y)#\<gamma>@[(x',y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes ((x,y)#\<gamma>@[(x',y')]))})
                                                          \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes ((x,y)#\<gamma>@[(x',y')]))})))"
[PROOF STATE]
proof (prove)
using this:
list.set XY \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1
L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') XY)) \<and> (\<forall>x y. (x, y) \<in> list.set XY \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})))
[PROOF STEP]
proof (induction XY rule: rev_induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>list.set [] \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') []))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') [])) \<and> (\<forall>x y. (x, y) \<in> list.set [] \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})))
 2. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') xs)) \<and> (\<forall>x y. (x, y) \<in> list.set xs \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))); list.set (xs @ [x]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) \<and> (\<forall>xa y. (xa, y) \<in> list.set (xs @ [x]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((xa, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (xa, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))})))
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
list.set [] \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1
L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') []))

goal (2 subgoals):
 1. \<lbrakk>list.set [] \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') []))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') [])) \<and> (\<forall>x y. (x, y) \<in> list.set [] \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})))
 2. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') xs)) \<and> (\<forall>x y. (x, y) \<in> list.set xs \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))); list.set (xs @ [x]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) \<and> (\<forall>xa y. (xa, y) \<in> list.set (xs @ [x]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((xa, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (xa, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))})))
[PROOF STEP]
have *:"(foldl handleIO (fst TG'', snd TG'') []) = (fst TG'', snd TG'')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. foldl handleIO (fst TG'', snd TG'') [] = (fst TG'', snd TG'')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
foldl handleIO (fst TG'', snd TG'') [] = (fst TG'', snd TG'')

goal (2 subgoals):
 1. \<lbrakk>list.set [] \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') []))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') [])) \<and> (\<forall>x y. (x, y) \<in> list.set [] \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})))
 2. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') xs)) \<and> (\<forall>x y. (x, y) \<in> list.set xs \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))); list.set (xs @ [x]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) \<and> (\<forall>xa y. (xa, y) \<in> list.set (xs @ [x]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((xa, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (xa, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))})))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') [])) \<and> (\<forall>x y. (x, y) \<in> list.set [] \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})))
[PROOF STEP]
using \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')\<close>
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') [])) \<and> (\<forall>x y. (x, y) \<in> list.set [] \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})))
[PROOF STEP]
unfolding * snd_conv
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'')

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd TG'') \<and> (\<forall>x y. (x, y) \<in> list.set [] \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') [])) \<and> (\<forall>x y. (x, y) \<in> list.set [] \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') xs)) \<and> (\<forall>x y. (x, y) \<in> list.set xs \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))); list.set (xs @ [x]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) \<and> (\<forall>xa y. (xa, y) \<in> list.set (xs @ [x]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((xa, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (xa, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))})))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') xs)) \<and> (\<forall>x y. (x, y) \<in> list.set xs \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))); list.set (xs @ [x]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) \<and> (\<forall>xa y. (xa, y) \<in> list.set (xs @ [x]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((xa, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (xa, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))})))
[PROOF STEP]
case (snoc a XY)
[PROOF STATE]
proof (state)
this:
\<lbrakk>list.set XY \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') XY)) \<and> (\<forall>x y. (x, y) \<in> list.set XY \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})))
list.set (XY @ [a]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1
L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (XY @ [a]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (XY @ [a])))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') xs)) \<and> (\<forall>x y. (x, y) \<in> list.set xs \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))); list.set (xs @ [x]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) \<and> (\<forall>xa y. (xa, y) \<in> list.set (xs @ [x]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((xa, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (xa, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))})))
[PROOF STEP]
obtain x' y' where "a = (x',y')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>x' y'. a = (x', y') \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using prod.exhaust
[PROOF STATE]
proof (prove)
using this:
(\<And>x1 x2. ?y = (x1, x2) \<Longrightarrow> ?P) \<Longrightarrow> ?P

goal (1 subgoal):
 1. (\<And>x' y'. a = (x', y') \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
a = (x', y')

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') xs)) \<and> (\<forall>x y. (x, y) \<in> list.set xs \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))); list.set (xs @ [x]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) \<and> (\<forall>xa y. (xa, y) \<in> list.set (xs @ [x]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((xa, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (xa, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))})))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
a = (x', y')
[PROOF STEP]
have "x' \<in> inputs M1" and "y' \<in> outputs M1"
[PROOF STATE]
proof (prove)
using this:
a = (x', y')

goal (1 subgoal):
 1. x' \<in> FSM.inputs M1 &&& y' \<in> FSM.outputs M1
[PROOF STEP]
using snoc.prems(1)
[PROOF STATE]
proof (prove)
using this:
a = (x', y')
list.set (XY @ [a]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1

goal (1 subgoal):
 1. x' \<in> FSM.inputs M1 &&& y' \<in> FSM.outputs M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
x' \<in> FSM.inputs M1
y' \<in> FSM.outputs M1

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') xs)) \<and> (\<forall>x y. (x, y) \<in> list.set xs \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))); list.set (xs @ [x]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) \<and> (\<forall>xa y. (xa, y) \<in> list.set (xs @ [x]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((xa, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (xa, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))})))
[PROOF STEP]
have "set T \<subseteq> set (fst TG'')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TG'')
[PROOF STEP]
using \<open>Prefix_Tree.set (fst TG') \<subseteq> Prefix_Tree.set (fst TG'')\<close> \<open>Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TG')\<close>
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TG') \<subseteq> Prefix_Tree.set (fst TG'')
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TG')

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TG'')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TG'')

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') xs)) \<and> (\<forall>x y. (x, y) \<in> list.set xs \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))); list.set (xs @ [x]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) \<and> (\<forall>xa y. (xa, y) \<in> list.set (xs @ [x]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((xa, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (xa, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))})))
[PROOF STEP]
have "(foldl handleIO (fst TG'', snd TG'') (XY@[a])) = handleIO (foldl handleIO (fst TG'', snd TG'') XY) (x',y')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. foldl handleIO (fst TG'', snd TG'') (XY @ [a]) = handleIO (foldl handleIO (fst TG'', snd TG'') XY) (x', y')
[PROOF STEP]
unfolding \<open>a = (x',y')\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. foldl handleIO (fst TG'', snd TG'') (XY @ [(x', y')]) = handleIO (foldl handleIO (fst TG'', snd TG'') XY) (x', y')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
foldl handleIO (fst TG'', snd TG'') (XY @ [a]) = handleIO (foldl handleIO (fst TG'', snd TG'') XY) (x', y')

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') xs)) \<and> (\<forall>x y. (x, y) \<in> list.set xs \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))); list.set (xs @ [x]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) \<and> (\<forall>xa y. (xa, y) \<in> list.set (xs @ [x]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((xa, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (xa, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))})))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
foldl handleIO (fst TG'', snd TG'') (XY @ [a]) = handleIO (foldl handleIO (fst TG'', snd TG'') XY) (x', y')
[PROOF STEP]
have "set (fst (foldl handleIO (fst TG'', snd TG'') XY)) \<subseteq> set (fst (foldl handleIO (fst TG'', snd TG'') (XY@[a])))"
[PROOF STATE]
proof (prove)
using this:
foldl handleIO (fst TG'', snd TG'') (XY @ [a]) = handleIO (foldl handleIO (fst TG'', snd TG'') XY) (x', y')

goal (1 subgoal):
 1. Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY)) \<subseteq> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (XY @ [a])))
[PROOF STEP]
using handleIO_subset
[PROOF STATE]
proof (prove)
using this:
foldl handleIO (fst TG'', snd TG'') (XY @ [a]) = handleIO (foldl handleIO (fst TG'', snd TG'') XY) (x', y')
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (handleIO (?T, ?G) (?x, ?y)))

goal (1 subgoal):
 1. Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY)) \<subseteq> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (XY @ [a])))
[PROOF STEP]
by (metis prod.collapse)
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY)) \<subseteq> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (XY @ [a])))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') xs)) \<and> (\<forall>x y. (x, y) \<in> list.set xs \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))); list.set (xs @ [x]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) \<and> (\<forall>xa y. (xa, y) \<in> list.set (xs @ [x]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((xa, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (xa, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))})))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY)) \<subseteq> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (XY @ [a])))
[PROOF STEP]
have pass_XY: "L M1 \<inter> set (fst (foldl handleIO (fst TG'', snd TG'') XY)) = L M2 \<inter> set (fst (foldl handleIO (fst TG'', snd TG'') XY))"
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY)) \<subseteq> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (XY @ [a])))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY))
[PROOF STEP]
using snoc.prems(2)
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY)) \<subseteq> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (XY @ [a])))
L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (XY @ [a]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (XY @ [a])))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') xs)) \<and> (\<forall>x y. (x, y) \<in> list.set xs \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))); list.set (xs @ [x]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) \<and> (\<forall>xa y. (xa, y) \<in> list.set (xs @ [x]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((xa, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (xa, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))})))
[PROOF STEP]
have "set T \<subseteq> set (fst (foldl handleIO (fst TG'', snd TG'') XY))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY))
[PROOF STEP]
using foldl_handleIO_subset \<open>set T \<subseteq> set (fst TG'')\<close>
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (?T, ?G) ?XY))
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TG'')

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') XY))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') xs)) \<and> (\<forall>x y. (x, y) \<in> list.set xs \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))); list.set (xs @ [x]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) \<and> (\<forall>xa y. (xa, y) \<in> list.set (xs @ [x]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((xa, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (xa, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))})))
[PROOF STEP]
have "list.set XY \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list.set XY \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1
[PROOF STEP]
using snoc.prems(1)
[PROOF STATE]
proof (prove)
using this:
list.set (XY @ [a]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1

goal (1 subgoal):
 1. list.set XY \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
list.set XY \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') xs)) \<and> (\<forall>x y. (x, y) \<in> list.set xs \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))); list.set (xs @ [x]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) \<and> (\<forall>xa y. (xa, y) \<in> list.set (xs @ [x]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((xa, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (xa, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))})))
[PROOF STEP]
have "convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') XY))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') XY))
[PROOF STEP]
using snoc.IH[OF \<open>list.set XY \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1\<close> pass_XY]
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') XY)) \<and> (\<forall>x y. (x, y) \<in> list.set XY \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') XY))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') XY))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') xs)) \<and> (\<forall>x y. (x, y) \<in> list.set xs \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))); list.set (xs @ [x]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) \<and> (\<forall>xa y. (xa, y) \<in> list.set (xs @ [x]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((xa, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (xa, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))})))
[PROOF STEP]
have pass_aXY: "L M1 \<inter> Prefix_Tree.set (fst (handleIO (fst (foldl handleIO (fst TG'', snd TG'') XY), snd (foldl handleIO (fst TG'', snd TG'') XY)) (x',y') )) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (fst (foldl handleIO (fst TG'', snd TG'') XY), snd (foldl handleIO (fst TG'', snd TG'') XY)) (x',y') ))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (handleIO (fst (foldl handleIO (fst TG'', snd TG'') XY), snd (foldl handleIO (fst TG'', snd TG'') XY)) (x', y'))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (fst (foldl handleIO (fst TG'', snd TG'') XY), snd (foldl handleIO (fst TG'', snd TG'') XY)) (x', y')))
[PROOF STEP]
using snoc.prems(2)
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (XY @ [a]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (XY @ [a])))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (handleIO (fst (foldl handleIO (fst TG'', snd TG'') XY), snd (foldl handleIO (fst TG'', snd TG'') XY)) (x', y'))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (fst (foldl handleIO (fst TG'', snd TG'') XY), snd (foldl handleIO (fst TG'', snd TG'') XY)) (x', y')))
[PROOF STEP]
unfolding \<open>(foldl handleIO (fst TG'', snd TG'') (XY@[a])) = handleIO (foldl handleIO (fst TG'', snd TG'') XY) (x',y')\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (handleIO (foldl handleIO (fst TG'', snd TG'') XY) (x', y'))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (foldl handleIO (fst TG'', snd TG'') XY) (x', y')))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (handleIO (fst (foldl handleIO (fst TG'', snd TG'') XY), snd (foldl handleIO (fst TG'', snd TG'') XY)) (x', y'))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (fst (foldl handleIO (fst TG'', snd TG'') XY), snd (foldl handleIO (fst TG'', snd TG'') XY)) (x', y')))
[PROOF STEP]
unfolding prod.collapse
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (handleIO (foldl handleIO TG'' XY) (x', y'))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (foldl handleIO TG'' XY) (x', y')))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (handleIO (foldl handleIO TG'' XY) (x', y'))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (foldl handleIO TG'' XY) (x', y')))
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (handleIO (fst (foldl handleIO (fst TG'', snd TG'') XY), snd (foldl handleIO (fst TG'', snd TG'') XY)) (x', y'))) = L M2 \<inter> Prefix_Tree.set (fst (handleIO (fst (foldl handleIO (fst TG'', snd TG'') XY), snd (foldl handleIO (fst TG'', snd TG'') XY)) (x', y')))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') xs)) \<and> (\<forall>x y. (x, y) \<in> list.set xs \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))); list.set (xs @ [x]) \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1; L M1 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleIO (fst TG'', snd TG'') (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (xs @ [x]))) \<and> (\<forall>xa y. (xa, y) \<in> list.set (xs @ [x]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(xa, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((xa, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (xa, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((xa, y) # \<gamma> @ [(x', y')]))})))
[PROOF STEP]
show ?case (is "?P1 \<and> ?P2")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (XY @ [a]))) \<and> (\<forall>x y. (x, y) \<in> list.set (XY @ [a]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})))
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (XY @ [a])))
 2. \<forall>x y. (x, y) \<in> list.set (XY @ [a]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
show "convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (XY@[a])))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (XY @ [a])))
[PROOF STEP]
using handleIO_props[OF \<open>set T \<subseteq> set (fst (foldl handleIO (fst TG'', snd TG'') XY))\<close> \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') XY))\<close> pass_aXY \<open>x' \<in> inputs M1\<close> \<open>y' \<in> outputs M1\<close>]
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (fst (foldl handleIO (fst TG'', snd TG'') XY), snd (foldl handleIO (fst TG'', snd TG'') XY)) (x', y'))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x', y')])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x', y')])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x', y')])}) \<and> (\<forall>\<gamma> x'a y'a. length ((x', y') # \<gamma> @ [(x'a, y'a)]) \<le> Suc depth \<longrightarrow> (x', y') # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x'a \<in> FSM.inputs M1 \<longrightarrow> y'a \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma> @ [(x'a, y'a)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma> @ [(x'a, y'a)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma> @ [(x'a, y'a)]))}))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (XY @ [a])))
[PROOF STEP]
unfolding \<open>(foldl handleIO (fst TG'', snd TG'') (XY@[a])) = handleIO (foldl handleIO (fst TG'', snd TG'') XY) (x',y')\<close>
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (fst (foldl handleIO (fst TG'', snd TG'') XY), snd (foldl handleIO (fst TG'', snd TG'') XY)) (x', y'))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x', y')])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x', y')])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x', y')])}) \<and> (\<forall>\<gamma> x'a y'a. length ((x', y') # \<gamma> @ [(x'a, y'a)]) \<le> Suc depth \<longrightarrow> (x', y') # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x'a \<in> FSM.inputs M1 \<longrightarrow> y'a \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma> @ [(x'a, y'a)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma> @ [(x'a, y'a)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma> @ [(x'a, y'a)]))}))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (foldl handleIO (fst TG'', snd TG'') XY) (x', y')))
[PROOF STEP]
unfolding prod.collapse
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (foldl handleIO TG'' XY) (x', y'))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x', y')])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x', y')])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x', y')])}) \<and> (\<forall>\<gamma> x'a y'a. length ((x', y') # \<gamma> @ [(x'a, y'a)]) \<le> Suc depth \<longrightarrow> (x', y') # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x'a \<in> FSM.inputs M1 \<longrightarrow> y'a \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma> @ [(x'a, y'a)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma> @ [(x'a, y'a)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma> @ [(x'a, y'a)]))}))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (foldl handleIO TG'' XY) (x', y')))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (XY @ [a])))

goal (1 subgoal):
 1. \<forall>x y. (x, y) \<in> list.set (XY @ [a]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
have "\<And> x y. (x, y) \<in> list.set (XY@[a]) \<Longrightarrow>
          L M1 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])}) = L M2 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])}) \<and>
          preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and>
          (\<forall>\<gamma> x' y'.
              length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow>
              (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow>
              x' \<in> FSM.inputs M1 \<longrightarrow>
              y' \<in> FSM.outputs M1 \<longrightarrow>
              L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) =
              L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and>
              preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x y. (x, y) \<in> list.set (XY @ [a]) \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x y. (x, y) \<in> list.set (XY @ [a]) \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
fix x y
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x y. (x, y) \<in> list.set (XY @ [a]) \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
assume "(x, y) \<in> list.set (XY@[a])"
[PROOF STATE]
proof (state)
this:
(x, y) \<in> list.set (XY @ [a])

goal (1 subgoal):
 1. \<And>x y. (x, y) \<in> list.set (XY @ [a]) \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
show "L M1 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])}) = L M2 \<inter> (list.set X \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {u,v} \<and> \<omega>' \<in> list.set (prefixes [(x,y)])}) \<and>
                preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and>
                  (\<forall>\<gamma> x' y'.
                      length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow>
                      (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow>
                      x' \<in> FSM.inputs M1 \<longrightarrow>
                      y' \<in> FSM.outputs M1 \<longrightarrow>
                      L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) =
                      L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and>
                      preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
proof (cases "a = (x,y)")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. a = (x, y) \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
 2. a \<noteq> (x, y) \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
a = (x, y)

goal (2 subgoals):
 1. a = (x, y) \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
 2. a \<noteq> (x, y) \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
a = (x, y)
[PROOF STEP]
have *:"(x',y') = (x,y)"
[PROOF STATE]
proof (prove)
using this:
a = (x, y)

goal (1 subgoal):
 1. (x', y') = (x, y)
[PROOF STEP]
using \<open>a = (x',y')\<close>
[PROOF STATE]
proof (prove)
using this:
a = (x, y)
a = (x', y')

goal (1 subgoal):
 1. (x', y') = (x, y)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(x', y') = (x, y)

goal (2 subgoals):
 1. a = (x, y) \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
 2. a \<noteq> (x, y) \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
using handleIO_props[OF \<open>set T \<subseteq> set (fst (foldl handleIO (fst TG'', snd TG'') XY))\<close> \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') XY))\<close> pass_aXY \<open>x' \<in> inputs M1\<close> \<open>y' \<in> outputs M1\<close>]
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (fst (foldl handleIO (fst TG'', snd TG'') XY), snd (foldl handleIO (fst TG'', snd TG'') XY)) (x', y'))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x', y')])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x', y')])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x', y')])}) \<and> (\<forall>\<gamma> x'a y'a. length ((x', y') # \<gamma> @ [(x'a, y'a)]) \<le> Suc depth \<longrightarrow> (x', y') # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x'a \<in> FSM.inputs M1 \<longrightarrow> y'a \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma> @ [(x'a, y'a)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma> @ [(x'a, y'a)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma> @ [(x'a, y'a)]))}))

goal (1 subgoal):
 1. L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
unfolding \<open>(foldl handleIO (fst TG'', snd TG'') (XY@[a])) = handleIO (foldl handleIO (fst TG'', snd TG'') XY) (x',y')\<close>
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (fst (foldl handleIO (fst TG'', snd TG'') XY), snd (foldl handleIO (fst TG'', snd TG'') XY)) (x', y'))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x', y')])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x', y')])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x', y')])}) \<and> (\<forall>\<gamma> x'a y'a. length ((x', y') # \<gamma> @ [(x'a, y'a)]) \<le> Suc depth \<longrightarrow> (x', y') # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x'a \<in> FSM.inputs M1 \<longrightarrow> y'a \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma> @ [(x'a, y'a)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma> @ [(x'a, y'a)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma> @ [(x'a, y'a)]))}))

goal (1 subgoal):
 1. L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
unfolding prod.collapse *
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (handleIO (foldl handleIO TG'' XY) (x, y))) \<and> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))

goal (1 subgoal):
 1. L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))

goal (1 subgoal):
 1. a \<noteq> (x, y) \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. a \<noteq> (x, y) \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
a \<noteq> (x, y)

goal (1 subgoal):
 1. a \<noteq> (x, y) \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
a \<noteq> (x, y)
[PROOF STEP]
have "(x,y) \<in> list.set XY"
[PROOF STATE]
proof (prove)
using this:
a \<noteq> (x, y)

goal (1 subgoal):
 1. (x, y) \<in> list.set XY
[PROOF STEP]
using \<open>(x, y) \<in> list.set (XY@[a])\<close>
[PROOF STATE]
proof (prove)
using this:
a \<noteq> (x, y)
(x, y) \<in> list.set (XY @ [a])

goal (1 subgoal):
 1. (x, y) \<in> list.set XY
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(x, y) \<in> list.set XY

goal (1 subgoal):
 1. a \<noteq> (x, y) \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(x, y) \<in> list.set XY
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(x, y) \<in> list.set XY

goal (1 subgoal):
 1. L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
using snoc.IH[OF \<open>list.set XY \<subseteq> FSM.inputs M1 \<times> FSM.outputs M1\<close> pass_XY]
[PROOF STATE]
proof (prove)
using this:
(x, y) \<in> list.set XY
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') XY)) \<and> (\<forall>x y. (x, y) \<in> list.set XY \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})))

goal (1 subgoal):
 1. L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(?x, ?y) \<in> list.set (XY @ [a]) \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(?x, ?y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(?x, ?y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(?x, ?y)])}) \<and> (\<forall>\<gamma> x' y'. length ((?x, ?y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (?x, ?y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((?x, ?y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((?x, ?y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((?x, ?y) # \<gamma> @ [(x', y')]))}))

goal (1 subgoal):
 1. \<forall>x y. (x, y) \<in> list.set (XY @ [a]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(?x, ?y) \<in> list.set (XY @ [a]) \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(?x, ?y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(?x, ?y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(?x, ?y)])}) \<and> (\<forall>\<gamma> x' y'. length ((?x, ?y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (?x, ?y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((?x, ?y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((?x, ?y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((?x, ?y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
show "?P2"
[PROOF STATE]
proof (prove)
using this:
(?x, ?y) \<in> list.set (XY @ [a]) \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(?x, ?y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(?x, ?y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(?x, ?y)])}) \<and> (\<forall>\<gamma> x' y'. length ((?x, ?y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (?x, ?y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((?x, ?y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((?x, ?y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((?x, ?y) # \<gamma> @ [(x', y')]))}))

goal (1 subgoal):
 1. \<forall>x y. (x, y) \<in> list.set (XY @ [a]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<forall>x y. (x, y) \<in> list.set (XY @ [a]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') (XY @ [a]))) \<and> (\<forall>x y. (x, y) \<in> list.set (XY @ [a]) \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') XY)) \<and> (\<forall>x y. (x, y) \<in> list.set XY \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})))

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "\<And> x y . (x,y) \<in> list.set XY = (x \<in> inputs M1 \<and> y \<in> outputs M1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x y. ((x, y) \<in> list.set XY) = (x \<in> FSM.inputs M1 \<and> y \<in> FSM.outputs M1)
[PROOF STEP]
unfolding \<open>list.set XY = inputs M1 \<times> outputs M1\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x y. ((x, y) \<in> FSM.inputs M1 \<times> FSM.outputs M1) = (x \<in> FSM.inputs M1 \<and> y \<in> FSM.outputs M1)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((?x, ?y) \<in> list.set XY) = (?x \<in> FSM.inputs M1 \<and> ?y \<in> FSM.outputs M1)

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have result_props_1: "\<And> x y \<gamma> x' y'. x \<in> inputs M1 \<Longrightarrow> y \<in> outputs M1 \<Longrightarrow>
             length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<Longrightarrow>
             (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<Longrightarrow>
             x' \<in> FSM.inputs M1 \<Longrightarrow>
             y' \<in> FSM.outputs M1 \<Longrightarrow>
             L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) =
             L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and>
             preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x y \<gamma> x' y'. \<lbrakk>x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth; (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u); x' \<in> FSM.inputs M1; y' \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
using foldl_handleIO_props
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') XY)) \<and> (\<forall>x y. (x, y) \<in> list.set XY \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})))

goal (1 subgoal):
 1. \<And>x y \<gamma> x' y'. \<lbrakk>x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth; (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u); x' \<in> FSM.inputs M1; y' \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
unfolding \<open>\<And> x y . (x,y) \<in> list.set XY = (x \<in> inputs M1 \<and> y \<in> outputs M1)\<close>
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') XY)) \<and> (\<forall>x y. x \<in> FSM.inputs M1 \<and> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})))

goal (1 subgoal):
 1. \<And>x y \<gamma> x' y'. \<lbrakk>x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth; (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u); x' \<in> FSM.inputs M1; y' \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>?x \<in> FSM.inputs M1; ?y \<in> FSM.outputs M1; length ((?x, ?y) # ?\<gamma> @ [(?x', ?y')]) \<le> Suc depth; (?x, ?y) # ?\<gamma> \<in> LS M1 (after_initial M1 u); ?x' \<in> FSM.inputs M1; ?y' \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((?x, ?y) # ?\<gamma> @ [(?x', ?y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((?x, ?y) # ?\<gamma> @ [(?x', ?y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((?x, ?y) # ?\<gamma> @ [(?x', ?y')]))})

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "?P1a X u v (Suc depth)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
have "\<And> \<gamma> x y.
               length (\<gamma> @ [(x, y)]) \<le> Suc depth \<Longrightarrow>
               \<gamma> \<in> LS M1 (after_initial M1 u) \<Longrightarrow>
               x \<in> FSM.inputs M1 \<Longrightarrow>
               y \<in> FSM.outputs M1 \<Longrightarrow>
               L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) =
               L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and>
               preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> Suc depth; \<gamma> \<in> LS M1 (after_initial M1 u); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> Suc depth; \<gamma> \<in> LS M1 (after_initial M1 u); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
fix \<gamma> x y
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> Suc depth; \<gamma> \<in> LS M1 (after_initial M1 u); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
assume "length (\<gamma> @ [(x, y)]) \<le> Suc depth"
               "\<gamma> \<in> LS M1 (after_initial M1 u)"
               "x \<in> FSM.inputs M1"
               "y \<in> FSM.outputs M1"
[PROOF STATE]
proof (state)
this:
length (\<gamma> @ [(x, y)]) \<le> Suc depth
\<gamma> \<in> LS M1 (after_initial M1 u)
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1

goal (1 subgoal):
 1. \<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> Suc depth; \<gamma> \<in> LS M1 (after_initial M1 u); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
show "L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) =
               L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and>
               preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
proof (cases \<gamma>)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<gamma> = [] \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. \<And>a list. \<gamma> = a # list \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
\<gamma> = []

goal (2 subgoals):
 1. \<gamma> = [] \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. \<And>a list. \<gamma> = a # list \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<gamma> = []
[PROOF STEP]
have *:"\<gamma> @ [(x,y)] = [(x,y)]"
[PROOF STATE]
proof (prove)
using this:
\<gamma> = []

goal (1 subgoal):
 1. \<gamma> @ [(x, y)] = [(x, y)]
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<gamma> @ [(x, y)] = [(x, y)]

goal (2 subgoals):
 1. \<gamma> = [] \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. \<And>a list. \<gamma> = a # list \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
have "(x,y) \<in> list.set XY"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (x, y) \<in> list.set XY
[PROOF STEP]
unfolding \<open>list.set XY = inputs M1 \<times> outputs M1\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (x, y) \<in> FSM.inputs M1 \<times> FSM.outputs M1
[PROOF STEP]
using \<open>x \<in> FSM.inputs M1\<close> \<open>y \<in> FSM.outputs M1\<close>
[PROOF STATE]
proof (prove)
using this:
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1

goal (1 subgoal):
 1. (x, y) \<in> FSM.inputs M1 \<times> FSM.outputs M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(x, y) \<in> list.set XY

goal (2 subgoals):
 1. \<gamma> = [] \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. \<And>a list. \<gamma> = a # list \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
unfolding *
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
using foldl_handleIO_props  \<open>(x,y) \<in> list.set XY\<close>
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') XY)) \<and> (\<forall>x y. (x, y) \<in> list.set XY \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})))
(x, y) \<in> list.set XY

goal (1 subgoal):
 1. L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])})
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})

goal (1 subgoal):
 1. \<And>a list. \<gamma> = a # list \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a list. \<gamma> = a # list \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
case (Cons a \<gamma>')
[PROOF STATE]
proof (state)
this:
\<gamma> = a # \<gamma>'

goal (1 subgoal):
 1. \<And>a list. \<gamma> = a # list \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
obtain x' y' where "a = (x',y')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>x' y'. a = (x', y') \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using prod.exhaust
[PROOF STATE]
proof (prove)
using this:
(\<And>x1 x2. ?y = (x1, x2) \<Longrightarrow> ?P) \<Longrightarrow> ?P

goal (1 subgoal):
 1. (\<And>x' y'. a = (x', y') \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
a = (x', y')

goal (1 subgoal):
 1. \<And>a list. \<gamma> = a # list \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
a = (x', y')
[PROOF STEP]
have *: "\<gamma> = (x',y')#\<gamma>'"
[PROOF STATE]
proof (prove)
using this:
a = (x', y')

goal (1 subgoal):
 1. \<gamma> = (x', y') # \<gamma>'
[PROOF STEP]
unfolding Cons
[PROOF STATE]
proof (prove)
using this:
a = (x', y')

goal (1 subgoal):
 1. a # \<gamma>' = (x', y') # \<gamma>'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<gamma> = (x', y') # \<gamma>'

goal (1 subgoal):
 1. \<And>a list. \<gamma> = a # list \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<gamma> = (x', y') # \<gamma>'
[PROOF STEP]
have **: "\<gamma> @ [(x, y)] = (x',y')#\<gamma>'@ [(x, y)]"
[PROOF STATE]
proof (prove)
using this:
\<gamma> = (x', y') # \<gamma>'

goal (1 subgoal):
 1. \<gamma> @ [(x, y)] = (x', y') # \<gamma>' @ [(x, y)]
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<gamma> @ [(x, y)] = (x', y') # \<gamma>' @ [(x, y)]

goal (1 subgoal):
 1. \<And>a list. \<gamma> = a # list \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
have \<open>x' \<in> inputs M1\<close> \<open>y' \<in> outputs M1\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x' \<in> FSM.inputs M1 &&& y' \<in> FSM.outputs M1
[PROOF STEP]
using language_io[OF \<open>\<gamma> \<in> LS M1 (after_initial M1 u)\<close>, of x' y']
[PROOF STATE]
proof (prove)
using this:
(x', y') \<in> list.set \<gamma> \<Longrightarrow> x' \<in> FSM.inputs M1
(x', y') \<in> list.set \<gamma> \<Longrightarrow> y' \<in> FSM.outputs M1

goal (1 subgoal):
 1. x' \<in> FSM.inputs M1 &&& y' \<in> FSM.outputs M1
[PROOF STEP]
unfolding *
[PROOF STATE]
proof (prove)
using this:
(x', y') \<in> list.set ((x', y') # \<gamma>') \<Longrightarrow> x' \<in> FSM.inputs M1
(x', y') \<in> list.set ((x', y') # \<gamma>') \<Longrightarrow> y' \<in> FSM.outputs M1

goal (1 subgoal):
 1. x' \<in> FSM.inputs M1 &&& y' \<in> FSM.outputs M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
x' \<in> FSM.inputs M1
y' \<in> FSM.outputs M1

goal (1 subgoal):
 1. \<And>a list. \<gamma> = a # list \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
have "length ((x', y') # (\<gamma>' @ [(x, y)])) \<le> Suc depth"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length ((x', y') # \<gamma>' @ [(x, y)]) \<le> Suc depth
[PROOF STEP]
using \<open>length (\<gamma> @ [(x, y)]) \<le> Suc depth\<close>
[PROOF STATE]
proof (prove)
using this:
length (\<gamma> @ [(x, y)]) \<le> Suc depth

goal (1 subgoal):
 1. length ((x', y') # \<gamma>' @ [(x, y)]) \<le> Suc depth
[PROOF STEP]
unfolding *
[PROOF STATE]
proof (prove)
using this:
length (((x', y') # \<gamma>') @ [(x, y)]) \<le> Suc depth

goal (1 subgoal):
 1. length ((x', y') # \<gamma>' @ [(x, y)]) \<le> Suc depth
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
length ((x', y') # \<gamma>' @ [(x, y)]) \<le> Suc depth

goal (1 subgoal):
 1. \<And>a list. \<gamma> = a # list \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
have "(x', y') # \<gamma>' \<in> LS M1 (after_initial M1 u)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (x', y') # \<gamma>' \<in> LS M1 (after_initial M1 u)
[PROOF STEP]
using \<open>\<gamma> \<in> LS M1 (after_initial M1 u)\<close>
[PROOF STATE]
proof (prove)
using this:
\<gamma> \<in> LS M1 (after_initial M1 u)

goal (1 subgoal):
 1. (x', y') # \<gamma>' \<in> LS M1 (after_initial M1 u)
[PROOF STEP]
unfolding *
[PROOF STATE]
proof (prove)
using this:
(x', y') # \<gamma>' \<in> LS M1 (after_initial M1 u)

goal (1 subgoal):
 1. (x', y') # \<gamma>' \<in> LS M1 (after_initial M1 u)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(x', y') # \<gamma>' \<in> LS M1 (after_initial M1 u)

goal (1 subgoal):
 1. \<And>a list. \<gamma> = a # list \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
using result_props_1[OF \<open>x' \<in> inputs M1\<close> \<open>y' \<in> outputs M1\<close> \<open>length ((x', y') # (\<gamma>' @ [(x, y)])) \<le> Suc depth\<close> \<open>(x', y') # \<gamma>' \<in> LS M1 (after_initial M1 u)\<close> \<open>x \<in> FSM.inputs M1\<close> \<open>y \<in> outputs M1\<close>]
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma>' @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma>' @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma>' @ [(x, y)]))})

goal (1 subgoal):
 1. L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
unfolding **
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma>' @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma>' @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma>' @ [(x, y)]))})

goal (1 subgoal):
 1. L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma>' @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma>' @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x', y') # \<gamma>' @ [(x, y)]))})
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>length (?\<gamma> @ [(?x, ?y)]) \<le> Suc depth; ?\<gamma> \<in> LS M1 (after_initial M1 u); ?x \<in> FSM.inputs M1; ?y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma> @ [(?x, ?y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma> @ [(?x, ?y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma> @ [(?x, ?y)]))})

goal (1 subgoal):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>length (?\<gamma> @ [(?x, ?y)]) \<le> Suc depth; ?\<gamma> \<in> LS M1 (after_initial M1 u); ?x \<in> FSM.inputs M1; ?y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma> @ [(?x, ?y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma> @ [(?x, ?y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma> @ [(?x, ?y)]))})
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>length (?\<gamma> @ [(?x, ?y)]) \<le> Suc depth; ?\<gamma> \<in> LS M1 (after_initial M1 u); ?x \<in> FSM.inputs M1; ?y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma> @ [(?x, ?y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma> @ [(?x, ?y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma> @ [(?x, ?y)]))})

goal (1 subgoal):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "?P1b X u v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set X \<union> {u, v})
[PROOF STEP]
using \<open>preserves_divergence M1 M2 (Set.insert u (Set.insert v (list.set X)))\<close>
[PROOF STATE]
proof (prove)
using this:
preserves_divergence M1 M2 (Set.insert u (Set.insert v (list.set X)))

goal (1 subgoal):
 1. preserves_divergence M1 M2 (list.set X \<union> {u, v})
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (list.set X \<union> {u, v})

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (list.set X \<union> {u, v})

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
have "?P2 T G u v X (Suc depth)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
using foldl_handleIO_props
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO (fst TG'', snd TG'') XY)) \<and> (\<forall>x y. (x, y) \<in> list.set XY \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
unfolding result prod.collapse
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO TG'' XY)) \<and> (\<forall>x y. (x, y) \<in> list.set XY \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes [(x, y)])}) \<and> (\<forall>\<gamma> x' y'. length ((x, y) # \<gamma> @ [(x', y')]) \<le> Suc depth \<longrightarrow> (x, y) # \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x' \<in> FSM.inputs M1 \<longrightarrow> y' \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes ((x, y) # \<gamma> @ [(x', y')]))})))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleIO TG'' XY))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))

goal (1 subgoal):
 1. \<And>depth T G u v X. \<lbrakk>\<And>T G u v X. \<lbrakk>V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v))); V ` reachable_states M1 \<subseteq> list.set X; preserves_divergence M1 M2 (list.set X); \<And>w. w \<in> list.set X \<Longrightarrow> \<exists>w'. converge M1 w w' \<and> converge M2 w w'; converge M1 u v; u \<in> L M2; v \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G; L M1 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v))) = L M2 \<inter> Prefix_Tree.set (fst (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))\<rbrakk> \<Longrightarrow> (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
preserves_divergence M1 M2 (list.set X \<union> {u, v})
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
preserves_divergence M1 M2 (list.set X \<union> {u, v})
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))

goal (1 subgoal):
 1. (\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> Suc depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k (Suc depth) completeInputTraces append_heuristic (u = v)))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (list.set X \<union> {u, v})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
show "?P1a X u v depth" and "?P1b X u v" and "?P2 T G u v X depth"
[PROOF STATE]
proof (prove)
using this:
(\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})) \<and> preserves_divergence M1 M2 (list.set X \<union> {u, v}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))

goal (1 subgoal):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) &&& preserves_divergence M1 M2 (list.set X \<union> {u, v}) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))
[PROOF STEP]
by presburger+
[PROOF STATE]
proof (state)
this:
\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> depth \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 u) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (list.set X \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {u, v} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
preserves_divergence M1 M2 (list.set X \<union> {u, v})
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distinguish_from_set M1 V T G cg_lookup cg_insert get_distinguishing_trace u v X k depth completeInputTraces append_heuristic (u = v)))

goal:
No subgoals!
[PROOF STEP]
qed