[STATEMENT]
lemma passes_test_suite_exhaustiveness :
  assumes "passes_test_suite M (Test_Suite prs tps rd_targets separators) M'"
  and     "implies_completeness (Test_Suite prs tps rd_targets separators) M m"
  and     "observable M"
  and     "observable M'"
  and     "inputs M' = inputs M"
  and     "inputs M \<noteq> {}"
  and     "completely_specified M"
  and     "completely_specified M'"
  and     "size M' \<le> m"
shows     "L M' \<subseteq> L M"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M' \<subseteq> L M
[PROOF STEP]
proof (rule ccontr)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
assume "\<not> L M' \<subseteq> L M"
[PROOF STATE]
proof (state)
this:
\<not> L M' \<subseteq> L M

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
(* sufficiency properties *)
[PROOF STATE]
proof (state)
this:
\<not> L M' \<subseteq> L M

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
obtain repetition_sets where repetition_sets_def: "implies_completeness_for_repetition_sets (Test_Suite prs tps rd_targets separators) M m repetition_sets"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>repetition_sets. implies_completeness_for_repetition_sets (Test_Suite prs tps rd_targets separators) M m repetition_sets \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using assms(2)
[PROOF STATE]
proof (prove)
using this:
implies_completeness (Test_Suite prs tps rd_targets separators) M m

goal (1 subgoal):
 1. (\<And>repetition_sets. implies_completeness_for_repetition_sets (Test_Suite prs tps rd_targets separators) M m repetition_sets \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding implies_completeness_def
[PROOF STATE]
proof (prove)
using this:
Ex (implies_completeness_for_repetition_sets (Test_Suite prs tps rd_targets separators) M m)

goal (1 subgoal):
 1. (\<And>repetition_sets. implies_completeness_for_repetition_sets (Test_Suite prs tps rd_targets separators) M m repetition_sets \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
implies_completeness_for_repetition_sets (Test_Suite prs tps rd_targets separators) M m repetition_sets

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have t1: "(initial M, initial_preamble M) \<in> prs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (FSM.initial M, initial_preamble M) \<in> prs
[PROOF STEP]
using implies_completeness_for_repetition_sets_simps(1)[OF repetition_sets_def]
[PROOF STATE]
proof (prove)
using this:
(FSM.initial M, initial_preamble M) \<in> prs

goal (1 subgoal):
 1. (FSM.initial M, initial_preamble M) \<in> prs
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
(FSM.initial M, initial_preamble M) \<in> prs

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have t2: "\<And> q P. (q, P) \<in> prs \<Longrightarrow> is_preamble P M q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q P. (q, P) \<in> prs \<Longrightarrow> is_preamble P M q
[PROOF STEP]
using implies_completeness_for_repetition_sets_simps(2)[OF repetition_sets_def]
[PROOF STATE]
proof (prove)
using this:
(?q, ?P) \<in> prs \<Longrightarrow> is_preamble ?P M ?q \<and> tps ?q \<noteq> {}

goal (1 subgoal):
 1. \<And>q P. (q, P) \<in> prs \<Longrightarrow> is_preamble P M q
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(?q, ?P) \<in> prs \<Longrightarrow> is_preamble ?P M ?q

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have t3: "\<And> q1 q2 A d1 d2. (A, d1, d2) \<in> separators (q1, q2) \<Longrightarrow> (A, d2, d1) \<in> separators (q2, q1) \<and> is_separator M q1 q2 A d1 d2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q1 q2 A d1 d2. (A, d1, d2) \<in> separators (q1, q2) \<Longrightarrow> (A, d2, d1) \<in> separators (q2, q1) \<and> is_separator M q1 q2 A d1 d2
[PROOF STEP]
using implies_completeness_for_repetition_sets_simps(3)[OF repetition_sets_def]
[PROOF STATE]
proof (prove)
using this:
(?A, ?d1.0, ?d2.0) \<in> separators (?q1.0, ?q2.0) \<Longrightarrow> (?A, ?d2.0, ?d1.0) \<in> separators (?q2.0, ?q1.0) \<and> is_separator M ?q1.0 ?q2.0 ?A ?d1.0 ?d2.0

goal (1 subgoal):
 1. \<And>q1 q2 A d1 d2. (A, d1, d2) \<in> separators (q1, q2) \<Longrightarrow> (A, d2, d1) \<in> separators (q2, q1) \<and> is_separator M q1 q2 A d1 d2
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
(?A, ?d1.0, ?d2.0) \<in> separators (?q1.0, ?q2.0) \<Longrightarrow> (?A, ?d2.0, ?d1.0) \<in> separators (?q2.0, ?q1.0) \<and> is_separator M ?q1.0 ?q2.0 ?A ?d1.0 ?d2.0

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have t5: "\<And>q. q \<in> FSM.states M \<Longrightarrow> (\<exists>d\<in>set repetition_sets. q \<in> fst d)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q. q \<in> FSM.states M \<Longrightarrow> \<exists>d\<in>set repetition_sets. q \<in> fst d
[PROOF STEP]
using implies_completeness_for_repetition_sets_simps(4)[OF repetition_sets_def]
[PROOF STATE]
proof (prove)
using this:
?q \<in> FSM.states M \<Longrightarrow> \<exists>d\<in>set repetition_sets. ?q \<in> fst d

goal (1 subgoal):
 1. \<And>q. q \<in> FSM.states M \<Longrightarrow> \<exists>d\<in>set repetition_sets. q \<in> fst d
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
?q \<in> FSM.states M \<Longrightarrow> \<exists>d\<in>set repetition_sets. ?q \<in> fst d

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have t6: "\<And> q. q \<in> fst ` prs \<Longrightarrow> tps q \<subseteq> {p1 . \<exists> p2 d . (p1@p2,d) \<in> m_traversal_paths_with_witness M q repetition_sets m} \<and> fst ` (m_traversal_paths_with_witness M q repetition_sets m) \<subseteq> tps q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q. q \<in> fst ` prs \<Longrightarrow> tps q \<subseteq> {p1. \<exists>p2 d. (p1 @ p2, d) \<in> m_traversal_paths_with_witness M q repetition_sets m} \<and> fst ` m_traversal_paths_with_witness M q repetition_sets m \<subseteq> tps q
[PROOF STEP]
using implies_completeness_for_repetition_sets_simps(7)[OF repetition_sets_def]
[PROOF STATE]
proof (prove)
using this:
?q \<in> fst ` prs \<Longrightarrow> tps ?q \<subseteq> {p1. \<exists>p2 d. (p1 @ p2, d) \<in> m_traversal_paths_with_witness M ?q repetition_sets m} \<and> fst ` m_traversal_paths_with_witness M ?q repetition_sets m \<subseteq> tps ?q

goal (1 subgoal):
 1. \<And>q. q \<in> fst ` prs \<Longrightarrow> tps q \<subseteq> {p1. \<exists>p2 d. (p1 @ p2, d) \<in> m_traversal_paths_with_witness M q repetition_sets m} \<and> fst ` m_traversal_paths_with_witness M q repetition_sets m \<subseteq> tps q
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
?q \<in> fst ` prs \<Longrightarrow> tps ?q \<subseteq> {p1. \<exists>p2 d. (p1 @ p2, d) \<in> m_traversal_paths_with_witness M ?q repetition_sets m} \<and> fst ` m_traversal_paths_with_witness M ?q repetition_sets m \<subseteq> tps ?q

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have t7: "\<And> d. d \<in> set repetition_sets \<Longrightarrow> fst d \<subseteq> FSM.states M"
  and  t8: "\<And> d. d \<in> set repetition_sets \<Longrightarrow> snd d \<subseteq> fst d"
  and  t8':  "\<And> d. d \<in> set repetition_sets \<Longrightarrow> snd d = fst d \<inter> fst ` prs"
  and  t9: "\<And> d q1 q2. d \<in> set repetition_sets \<Longrightarrow> q1 \<in> fst d \<Longrightarrow> q2 \<in> fst d \<Longrightarrow> q1 \<noteq> q2 \<Longrightarrow> separators (q1, q2) \<noteq> {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<And>d. d \<in> set repetition_sets \<Longrightarrow> fst d \<subseteq> FSM.states M) &&& (\<And>d. d \<in> set repetition_sets \<Longrightarrow> snd d \<subseteq> fst d)) &&& (\<And>d. d \<in> set repetition_sets \<Longrightarrow> snd d = fst d \<inter> fst ` prs) &&& (\<And>d q1 q2. \<lbrakk>d \<in> set repetition_sets; q1 \<in> fst d; q2 \<in> fst d; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> separators (q1, q2) \<noteq> {})
[PROOF STEP]
using implies_completeness_for_repetition_sets_simps(5,6)[OF repetition_sets_def]
[PROOF STATE]
proof (prove)
using this:
?d \<in> set repetition_sets \<Longrightarrow> fst ?d \<subseteq> FSM.states M \<and> snd ?d = fst ?d \<inter> fst ` prs
\<lbrakk>?d \<in> set repetition_sets; ?q1.0 \<in> fst ?d; ?q2.0 \<in> fst ?d; ?q1.0 \<noteq> ?q2.0\<rbrakk> \<Longrightarrow> separators (?q1.0, ?q2.0) \<noteq> {}

goal (1 subgoal):
 1. ((\<And>d. d \<in> set repetition_sets \<Longrightarrow> fst d \<subseteq> FSM.states M) &&& (\<And>d. d \<in> set repetition_sets \<Longrightarrow> snd d \<subseteq> fst d)) &&& (\<And>d. d \<in> set repetition_sets \<Longrightarrow> snd d = fst d \<inter> fst ` prs) &&& (\<And>d q1 q2. \<lbrakk>d \<in> set repetition_sets; q1 \<in> fst d; q2 \<in> fst d; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> separators (q1, q2) \<noteq> {})
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
?d \<in> set repetition_sets \<Longrightarrow> fst ?d \<subseteq> FSM.states M
?d \<in> set repetition_sets \<Longrightarrow> snd ?d \<subseteq> fst ?d
?d \<in> set repetition_sets \<Longrightarrow> snd ?d = fst ?d \<inter> fst ` prs
\<lbrakk>?d \<in> set repetition_sets; ?q1.0 \<in> fst ?d; ?q2.0 \<in> fst ?d; ?q1.0 \<noteq> ?q2.0\<rbrakk> \<Longrightarrow> separators (?q1.0, ?q2.0) \<noteq> {}

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have t10: "\<And> q p d p1 p2 p3.
              q \<in> fst ` prs \<Longrightarrow>
              (p, d) \<in> m_traversal_paths_with_witness M q repetition_sets m \<Longrightarrow>
              p = p1 @ p2 @ p3 \<Longrightarrow>
              p2 \<noteq> [] \<Longrightarrow>
              target q p1 \<in> fst d \<Longrightarrow>
              target q (p1 @ p2) \<in> fst d \<Longrightarrow>
              target q p1 \<noteq> target q (p1 @ p2) \<Longrightarrow>
              p1 \<in> tps q \<and> p1 @ p2 \<in> tps q \<and> target q p1 \<in> rd_targets (q, p1 @ p2) \<and> target q (p1 @ p2) \<in> rd_targets (q, p1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q p d p1 p2 p3. \<lbrakk>q \<in> fst ` prs; (p, d) \<in> m_traversal_paths_with_witness M q repetition_sets m; p = p1 @ p2 @ p3; p2 \<noteq> []; target q p1 \<in> fst d; target q (p1 @ p2) \<in> fst d; target q p1 \<noteq> target q (p1 @ p2)\<rbrakk> \<Longrightarrow> p1 \<in> tps q \<and> p1 @ p2 \<in> tps q \<and> target q p1 \<in> rd_targets (q, p1 @ p2) \<and> target q (p1 @ p2) \<in> rd_targets (q, p1)
[PROOF STEP]
using implies_completeness_for_repetition_sets_simps(8)[OF repetition_sets_def]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?q \<in> fst ` prs; (?p, ?d) \<in> m_traversal_paths_with_witness M ?q repetition_sets m; ?p = ?p1.0 @ ?p2.0 @ ?p3.0; ?p2.0 \<noteq> []; target ?q ?p1.0 \<in> fst ?d; target ?q (?p1.0 @ ?p2.0) \<in> fst ?d; target ?q ?p1.0 \<noteq> target ?q (?p1.0 @ ?p2.0)\<rbrakk> \<Longrightarrow> ?p1.0 \<in> tps ?q \<and> ?p1.0 @ ?p2.0 \<in> tps ?q \<and> target ?q ?p1.0 \<in> rd_targets (?q, ?p1.0 @ ?p2.0) \<and> target ?q (?p1.0 @ ?p2.0) \<in> rd_targets (?q, ?p1.0)

goal (1 subgoal):
 1. \<And>q p d p1 p2 p3. \<lbrakk>q \<in> fst ` prs; (p, d) \<in> m_traversal_paths_with_witness M q repetition_sets m; p = p1 @ p2 @ p3; p2 \<noteq> []; target q p1 \<in> fst d; target q (p1 @ p2) \<in> fst d; target q p1 \<noteq> target q (p1 @ p2)\<rbrakk> \<Longrightarrow> p1 \<in> tps q \<and> p1 @ p2 \<in> tps q \<and> target q p1 \<in> rd_targets (q, p1 @ p2) \<and> target q (p1 @ p2) \<in> rd_targets (q, p1)
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
\<lbrakk>?q \<in> fst ` prs; (?p, ?d) \<in> m_traversal_paths_with_witness M ?q repetition_sets m; ?p = ?p1.0 @ ?p2.0 @ ?p3.0; ?p2.0 \<noteq> []; target ?q ?p1.0 \<in> fst ?d; target ?q (?p1.0 @ ?p2.0) \<in> fst ?d; target ?q ?p1.0 \<noteq> target ?q (?p1.0 @ ?p2.0)\<rbrakk> \<Longrightarrow> ?p1.0 \<in> tps ?q \<and> ?p1.0 @ ?p2.0 \<in> tps ?q \<and> target ?q ?p1.0 \<in> rd_targets (?q, ?p1.0 @ ?p2.0) \<and> target ?q (?p1.0 @ ?p2.0) \<in> rd_targets (?q, ?p1.0)

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have t11: "\<And> q p d p1 p2 q'.
              q \<in> fst ` prs \<Longrightarrow>
              (p, d) \<in> m_traversal_paths_with_witness M q repetition_sets m \<Longrightarrow>
              p = p1 @ p2 \<Longrightarrow>
              q' \<in> fst ` prs \<Longrightarrow>
              target q p1 \<in> fst d \<Longrightarrow>
              q' \<in> fst d \<Longrightarrow>
              target q p1 \<noteq> q' \<Longrightarrow>
              p1 \<in> tps q \<and> [] \<in> tps q' \<and> target q p1 \<in> rd_targets (q', []) \<and> q' \<in> rd_targets (q, p1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q p d p1 p2 q'. \<lbrakk>q \<in> fst ` prs; (p, d) \<in> m_traversal_paths_with_witness M q repetition_sets m; p = p1 @ p2; q' \<in> fst ` prs; target q p1 \<in> fst d; q' \<in> fst d; target q p1 \<noteq> q'\<rbrakk> \<Longrightarrow> p1 \<in> tps q \<and> [] \<in> tps q' \<and> target q p1 \<in> rd_targets (q', []) \<and> q' \<in> rd_targets (q, p1)
[PROOF STEP]
using implies_completeness_for_repetition_sets_simps(9)[OF repetition_sets_def]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?q \<in> fst ` prs; (?p, ?d) \<in> m_traversal_paths_with_witness M ?q repetition_sets m; ?p = ?p1.0 @ ?p2.0; ?q' \<in> fst ` prs; target ?q ?p1.0 \<in> fst ?d; ?q' \<in> fst ?d; target ?q ?p1.0 \<noteq> ?q'\<rbrakk> \<Longrightarrow> ?p1.0 \<in> tps ?q \<and> [] \<in> tps ?q' \<and> target ?q ?p1.0 \<in> rd_targets (?q', []) \<and> ?q' \<in> rd_targets (?q, ?p1.0)

goal (1 subgoal):
 1. \<And>q p d p1 p2 q'. \<lbrakk>q \<in> fst ` prs; (p, d) \<in> m_traversal_paths_with_witness M q repetition_sets m; p = p1 @ p2; q' \<in> fst ` prs; target q p1 \<in> fst d; q' \<in> fst d; target q p1 \<noteq> q'\<rbrakk> \<Longrightarrow> p1 \<in> tps q \<and> [] \<in> tps q' \<and> target q p1 \<in> rd_targets (q', []) \<and> q' \<in> rd_targets (q, p1)
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
\<lbrakk>?q \<in> fst ` prs; (?p, ?d) \<in> m_traversal_paths_with_witness M ?q repetition_sets m; ?p = ?p1.0 @ ?p2.0; ?q' \<in> fst ` prs; target ?q ?p1.0 \<in> fst ?d; ?q' \<in> fst ?d; target ?q ?p1.0 \<noteq> ?q'\<rbrakk> \<Longrightarrow> ?p1.0 \<in> tps ?q \<and> [] \<in> tps ?q' \<and> target ?q ?p1.0 \<in> rd_targets (?q', []) \<and> ?q' \<in> rd_targets (?q, ?p1.0)

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have t12: "\<And> q p d q1 q2.
              q \<in> fst ` prs \<Longrightarrow>
              (p, d) \<in> m_traversal_paths_with_witness M q repetition_sets m \<Longrightarrow>
              q1 \<noteq> q2 \<Longrightarrow>
              q1 \<in> snd d \<Longrightarrow>
              q2 \<in> snd d \<Longrightarrow>
              [] \<in> tps q1 \<and> [] \<in> tps q2 \<and> q1 \<in> rd_targets (q2, []) \<and> q2 \<in> rd_targets (q1, [])"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q p d q1 q2. \<lbrakk>q \<in> fst ` prs; (p, d) \<in> m_traversal_paths_with_witness M q repetition_sets m; q1 \<noteq> q2; q1 \<in> snd d; q2 \<in> snd d\<rbrakk> \<Longrightarrow> [] \<in> tps q1 \<and> [] \<in> tps q2 \<and> q1 \<in> rd_targets (q2, []) \<and> q2 \<in> rd_targets (q1, [])
[PROOF STEP]
using implies_completeness_for_repetition_sets_simps(10)[OF repetition_sets_def]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?q \<in> fst ` prs; (?p, ?d) \<in> m_traversal_paths_with_witness M ?q repetition_sets m; ?q1.0 \<noteq> ?q2.0; ?q1.0 \<in> snd ?d; ?q2.0 \<in> snd ?d\<rbrakk> \<Longrightarrow> [] \<in> tps ?q1.0 \<and> [] \<in> tps ?q2.0 \<and> ?q1.0 \<in> rd_targets (?q2.0, []) \<and> ?q2.0 \<in> rd_targets (?q1.0, [])

goal (1 subgoal):
 1. \<And>q p d q1 q2. \<lbrakk>q \<in> fst ` prs; (p, d) \<in> m_traversal_paths_with_witness M q repetition_sets m; q1 \<noteq> q2; q1 \<in> snd d; q2 \<in> snd d\<rbrakk> \<Longrightarrow> [] \<in> tps q1 \<and> [] \<in> tps q2 \<and> q1 \<in> rd_targets (q2, []) \<and> q2 \<in> rd_targets (q1, [])
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
\<lbrakk>?q \<in> fst ` prs; (?p, ?d) \<in> m_traversal_paths_with_witness M ?q repetition_sets m; ?q1.0 \<noteq> ?q2.0; ?q1.0 \<in> snd ?d; ?q2.0 \<in> snd ?d\<rbrakk> \<Longrightarrow> [] \<in> tps ?q1.0 \<and> [] \<in> tps ?q2.0 \<and> ?q1.0 \<in> rd_targets (?q2.0, []) \<and> ?q2.0 \<in> rd_targets (?q1.0, [])

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
(* pass properties *)
[PROOF STATE]
proof (state)
this:
\<lbrakk>?q \<in> fst ` prs; (?p, ?d) \<in> m_traversal_paths_with_witness M ?q repetition_sets m; ?q1.0 \<noteq> ?q2.0; ?q1.0 \<in> snd ?d; ?q2.0 \<in> snd ?d\<rbrakk> \<Longrightarrow> [] \<in> tps ?q1.0 \<and> [] \<in> tps ?q2.0 \<and> ?q1.0 \<in> rd_targets (?q2.0, []) \<and> ?q2.0 \<in> rd_targets (?q1.0, [])

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have pass1: "\<And> q P io x y y' . (q,P) \<in> prs \<Longrightarrow> io@[(x,y)] \<in> L P \<Longrightarrow> io@[(x,y')] \<in> L M' \<Longrightarrow> io@[(x,y')] \<in> L P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q P io x y y'. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> L P
[PROOF STEP]
using \<open>passes_test_suite M (Test_Suite prs tps rd_targets separators) M'\<close>
[PROOF STATE]
proof (prove)
using this:
passes_test_suite M (Test_Suite prs tps rd_targets separators) M'

goal (1 subgoal):
 1. \<And>q P io x y y'. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> L P
[PROOF STEP]
unfolding passes_test_suite.simps
[PROOF STATE]
proof (prove)
using this:
(\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P) \<and> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<and> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> separators (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2))

goal (1 subgoal):
 1. \<And>q P io x y y'. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> L P
[PROOF STEP]
by meson
[PROOF STATE]
proof (state)
this:
\<lbrakk>(?q, ?P) \<in> prs; ?io @ [(?x, ?y)] \<in> L ?P; ?io @ [(?x, ?y')] \<in> L M'\<rbrakk> \<Longrightarrow> ?io @ [(?x, ?y')] \<in> L ?P

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have pass2: "\<And> q P pP ioT pT x y y' . (q,P) \<in> prs \<Longrightarrow> path P (initial P) pP \<Longrightarrow> target (initial P) pP = q \<Longrightarrow> pT \<in> tps q \<Longrightarrow> ioT@[(x,y)] \<in> set (prefixes (p_io pT)) \<Longrightarrow> (p_io pP)@ioT@[(x,y')] \<in> L M' \<Longrightarrow> (\<exists> pT' . pT' \<in> tps q \<and> ioT@[(x,y')] \<in> set (prefixes (p_io pT')))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q P pP ioT pT x y y'. \<lbrakk>(q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pT \<in> tps q; ioT @ [(x, y)] \<in> set (prefixes (p_io pT)); p_io pP @ ioT @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> \<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT'))
[PROOF STEP]
using \<open>passes_test_suite M (Test_Suite prs tps rd_targets separators) M'\<close>
[PROOF STATE]
proof (prove)
using this:
passes_test_suite M (Test_Suite prs tps rd_targets separators) M'

goal (1 subgoal):
 1. \<And>q P pP ioT pT x y y'. \<lbrakk>(q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pT \<in> tps q; ioT @ [(x, y)] \<in> set (prefixes (p_io pT)); p_io pP @ ioT @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> \<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT'))
[PROOF STEP]
unfolding passes_test_suite.simps
[PROOF STATE]
proof (prove)
using this:
(\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P) \<and> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<and> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> separators (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2))

goal (1 subgoal):
 1. \<And>q P pP ioT pT x y y'. \<lbrakk>(q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pT \<in> tps q; ioT @ [(x, y)] \<in> set (prefixes (p_io pT)); p_io pP @ ioT @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> \<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT'))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>(?q, ?P) \<in> prs; path ?P (FSM.initial ?P) ?pP; target (FSM.initial ?P) ?pP = ?q; ?pT \<in> tps ?q; ?ioT @ [(?x, ?y)] \<in> set (prefixes (p_io ?pT)); p_io ?pP @ ?ioT @ [(?x, ?y')] \<in> L M'\<rbrakk> \<Longrightarrow> \<exists>pT'. pT' \<in> tps ?q \<and> ?ioT @ [(?x, ?y')] \<in> set (prefixes (p_io pT'))

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have pass3: "\<And> q P pP pT q' A d1 d2 qT . (q,P) \<in> prs \<Longrightarrow> path P (initial P) pP \<Longrightarrow> target (initial P) pP = q \<Longrightarrow> pT \<in> tps q \<Longrightarrow> (p_io pP)@(p_io pT) \<in> L M' \<Longrightarrow> q' \<in> rd_targets (q,pT) \<Longrightarrow> (A,d1,d2) \<in> separators (target q pT, q') \<Longrightarrow> qT \<in> io_targets M' ((p_io pP)@(p_io pT)) (initial M') \<Longrightarrow> pass_separator_ATC M' A qT d2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q P pP pT q' A d1 d2 qT. \<lbrakk>(q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pT \<in> tps q; p_io pP @ p_io pT \<in> L M'; q' \<in> rd_targets (q, pT); (A, d1, d2) \<in> separators (target q pT, q'); qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M')\<rbrakk> \<Longrightarrow> pass_separator_ATC M' A qT d2
[PROOF STEP]
using \<open>passes_test_suite M (Test_Suite prs tps rd_targets separators) M'\<close>
[PROOF STATE]
proof (prove)
using this:
passes_test_suite M (Test_Suite prs tps rd_targets separators) M'

goal (1 subgoal):
 1. \<And>q P pP pT q' A d1 d2 qT. \<lbrakk>(q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pT \<in> tps q; p_io pP @ p_io pT \<in> L M'; q' \<in> rd_targets (q, pT); (A, d1, d2) \<in> separators (target q pT, q'); qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M')\<rbrakk> \<Longrightarrow> pass_separator_ATC M' A qT d2
[PROOF STEP]
unfolding passes_test_suite.simps
[PROOF STATE]
proof (prove)
using this:
(\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P) \<and> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<and> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> separators (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2))

goal (1 subgoal):
 1. \<And>q P pP pT q' A d1 d2 qT. \<lbrakk>(q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pT \<in> tps q; p_io pP @ p_io pT \<in> L M'; q' \<in> rd_targets (q, pT); (A, d1, d2) \<in> separators (target q pT, q'); qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M')\<rbrakk> \<Longrightarrow> pass_separator_ATC M' A qT d2
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>(?q, ?P) \<in> prs; path ?P (FSM.initial ?P) ?pP; target (FSM.initial ?P) ?pP = ?q; ?pT \<in> tps ?q; p_io ?pP @ p_io ?pT \<in> L M'; ?q' \<in> rd_targets (?q, ?pT); (?A, ?d1.0, ?d2.0) \<in> separators (target ?q ?pT, ?q'); ?qT \<in> io_targets M' (p_io ?pP @ p_io ?pT) (FSM.initial M')\<rbrakk> \<Longrightarrow> pass_separator_ATC M' ?A ?qT ?d2.0

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
(* seq to failure *)
[PROOF STATE]
proof (state)
this:
\<lbrakk>(?q, ?P) \<in> prs; path ?P (FSM.initial ?P) ?pP; target (FSM.initial ?P) ?pP = ?q; ?pT \<in> tps ?q; p_io ?pP @ p_io ?pT \<in> L M'; ?q' \<in> rd_targets (?q, ?pT); (?A, ?d1.0, ?d2.0) \<in> separators (target ?q ?pT, ?q'); ?qT \<in> io_targets M' (p_io ?pP @ p_io ?pT) (FSM.initial M')\<rbrakk> \<Longrightarrow> pass_separator_ATC M' ?A ?qT ?d2.0

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
obtain pP io where "minimal_sequence_to_failure_extending_preamble_path M M' prs pP io"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>pP io. minimal_sequence_to_failure_extending_preamble_path M M' prs pP io \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using minimal_sequence_to_failure_extending_preamble_ex[OF t1 \<open>\<not> L M' \<subseteq> L M\<close>]
[PROOF STATE]
proof (prove)
using this:
(\<And>p io. minimal_sequence_to_failure_extending_preamble_path M M' prs p io \<Longrightarrow> ?thesis) \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. (\<And>pP io. minimal_sequence_to_failure_extending_preamble_path M M' prs pP io \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
minimal_sequence_to_failure_extending_preamble_path M M' prs pP io

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
minimal_sequence_to_failure_extending_preamble_path M M' prs pP io
[PROOF STEP]
have "sequence_to_failure_extending_preamble_path M M' prs pP io"
            "\<And> io'. sequence_to_failure_extending_preamble_path M M' prs pP io' \<Longrightarrow> length io \<le> length io'"
[PROOF STATE]
proof (prove)
using this:
minimal_sequence_to_failure_extending_preamble_path M M' prs pP io

goal (1 subgoal):
 1. sequence_to_failure_extending_preamble_path M M' prs pP io &&& (\<And>io'. sequence_to_failure_extending_preamble_path M M' prs pP io' \<Longrightarrow> length io \<le> length io')
[PROOF STEP]
unfolding minimal_sequence_to_failure_extending_preamble_path_def
[PROOF STATE]
proof (prove)
using this:
sequence_to_failure_extending_preamble_path M M' prs pP io \<and> (\<forall>p' io'. sequence_to_failure_extending_preamble_path M M' prs p' io' \<longrightarrow> length io \<le> length io')

goal (1 subgoal):
 1. sequence_to_failure_extending_preamble_path M M' prs pP io &&& (\<And>io'. sequence_to_failure_extending_preamble_path M M' prs pP io' \<Longrightarrow> length io \<le> length io')
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
sequence_to_failure_extending_preamble_path M M' prs pP io
sequence_to_failure_extending_preamble_path M M' prs pP ?io' \<Longrightarrow> length io \<le> length ?io'

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
obtain q P where "q \<in> states M"
               and "(q,P) \<in> prs"
               and "path P (initial P) pP"
               and "target (initial P) pP = q"
               and "((p_io pP) @ butlast io) \<in> L M"
               and "((p_io pP) @ io) \<notin> L M"
               and "((p_io pP) @ io) \<in> L M'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>q P. \<lbrakk>q \<in> FSM.states M; (q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; p_io pP @ butlast io \<in> L M; p_io pP @ io \<notin> L M; p_io pP @ io \<in> L M'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<open>sequence_to_failure_extending_preamble_path M M' prs pP io\<close>
[PROOF STATE]
proof (prove)
using this:
sequence_to_failure_extending_preamble_path M M' prs pP io

goal (1 subgoal):
 1. (\<And>q P. \<lbrakk>q \<in> FSM.states M; (q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; p_io pP @ butlast io \<in> L M; p_io pP @ io \<notin> L M; p_io pP @ io \<in> L M'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding sequence_to_failure_extending_preamble_path_def
[PROOF STATE]
proof (prove)
using this:
\<exists>q P. q \<in> FSM.states M \<and> (q, P) \<in> prs \<and> path P (FSM.initial P) pP \<and> target (FSM.initial P) pP = q \<and> p_io pP @ butlast io \<in> L M \<and> p_io pP @ io \<notin> L M \<and> p_io pP @ io \<in> L M'

goal (1 subgoal):
 1. (\<And>q P. \<lbrakk>q \<in> FSM.states M; (q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; p_io pP @ butlast io \<in> L M; p_io pP @ io \<notin> L M; p_io pP @ io \<in> L M'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
q \<in> FSM.states M
(q, P) \<in> prs
path P (FSM.initial P) pP
target (FSM.initial P) pP = q
p_io pP @ butlast io \<in> L M
p_io pP @ io \<notin> L M
p_io pP @ io \<in> L M'

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
let ?xF = "fst (last io)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
let ?yF = "snd (last io)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
let ?xyF = "(?xF,?yF)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
let ?ioF = "butlast io"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have "io \<noteq> []"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. io \<noteq> []
[PROOF STEP]
using \<open>((p_io pP) @ io) \<notin> L M\<close> \<open>((p_io pP) @ butlast io) \<in> L M\<close>
[PROOF STATE]
proof (prove)
using this:
p_io pP @ io \<notin> L M
p_io pP @ butlast io \<in> L M

goal (1 subgoal):
 1. io \<noteq> []
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
io \<noteq> []

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
io \<noteq> []
[PROOF STEP]
have "io = ?ioF@[?xyF]"
[PROOF STATE]
proof (prove)
using this:
io \<noteq> []

goal (1 subgoal):
 1. io = butlast io @ [(fst (last io), snd (last io))]
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
io = butlast io @ [(fst (last io), snd (last io))]

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have "?xF \<in> inputs M'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fst (last io) \<in> FSM.inputs M'
[PROOF STEP]
using language_io(1)[OF \<open>((p_io pP) @ io) \<in> L M'\<close>, of ?xF ?yF] \<open>io \<noteq> []\<close>
[PROOF STATE]
proof (prove)
using this:
(fst (last io), snd (last io)) \<in> set (p_io pP @ io) \<Longrightarrow> fst (last io) \<in> FSM.inputs M'
io \<noteq> []

goal (1 subgoal):
 1. fst (last io) \<in> FSM.inputs M'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fst (last io) \<in> FSM.inputs M'

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
fst (last io) \<in> FSM.inputs M'
[PROOF STEP]
have "?xF \<in> inputs M"
[PROOF STATE]
proof (prove)
using this:
fst (last io) \<in> FSM.inputs M'

goal (1 subgoal):
 1. fst (last io) \<in> FSM.inputs M
[PROOF STEP]
using \<open>inputs M' = inputs M\<close>
[PROOF STATE]
proof (prove)
using this:
fst (last io) \<in> FSM.inputs M'
FSM.inputs M' = FSM.inputs M

goal (1 subgoal):
 1. fst (last io) \<in> FSM.inputs M
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
fst (last io) \<in> FSM.inputs M

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have "q \<in> fst ` prs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. q \<in> fst ` prs
[PROOF STEP]
using \<open>(q,P) \<in> prs\<close>
[PROOF STATE]
proof (prove)
using this:
(q, P) \<in> prs

goal (1 subgoal):
 1. q \<in> fst ` prs
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
q \<in> fst ` prs

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have "is_preamble P M q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_preamble P M q
[PROOF STEP]
using \<open>(q,P) \<in> prs\<close> t2
[PROOF STATE]
proof (prove)
using this:
(q, P) \<in> prs
(?q, ?P) \<in> prs \<Longrightarrow> is_preamble ?P M ?q

goal (1 subgoal):
 1. is_preamble P M q
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
is_preamble P M q

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
is_preamble P M q
[PROOF STEP]
have "q \<in> states M"
[PROOF STATE]
proof (prove)
using this:
is_preamble P M q

goal (1 subgoal):
 1. q \<in> FSM.states M
[PROOF STEP]
unfolding is_preamble_def
[PROOF STATE]
proof (prove)
using this:
FSM.acyclic P \<and> single_input P \<and> is_submachine P M \<and> q \<in> reachable_states P \<and> deadlock_state P q \<and> (\<forall>q'\<in>reachable_states P. (q = q' \<or> \<not> deadlock_state P q') \<and> (\<forall>x\<in>FSM.inputs M. (\<exists>t\<in>FSM.transitions P. t_source t = q' \<and> t_input t = x) \<longrightarrow> (\<forall>t'\<in>FSM.transitions M. t_source t' = q' \<and> t_input t' = x \<longrightarrow> t' \<in> FSM.transitions P)))

goal (1 subgoal):
 1. q \<in> FSM.states M
[PROOF STEP]
by (metis \<open>path P (FSM.initial P) pP\<close> \<open>target (FSM.initial P) pP = q\<close> path_target_is_state submachine_path)
[PROOF STATE]
proof (state)
this:
q \<in> FSM.states M

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have "initial P = initial M"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. FSM.initial P = FSM.initial M
[PROOF STEP]
using \<open>is_preamble P M q\<close>
[PROOF STATE]
proof (prove)
using this:
is_preamble P M q

goal (1 subgoal):
 1. FSM.initial P = FSM.initial M
[PROOF STEP]
unfolding is_preamble_def
[PROOF STATE]
proof (prove)
using this:
FSM.acyclic P \<and> single_input P \<and> is_submachine P M \<and> q \<in> reachable_states P \<and> deadlock_state P q \<and> (\<forall>q'\<in>reachable_states P. (q = q' \<or> \<not> deadlock_state P q') \<and> (\<forall>x\<in>FSM.inputs M. (\<exists>t\<in>FSM.transitions P. t_source t = q' \<and> t_input t = x) \<longrightarrow> (\<forall>t'\<in>FSM.transitions M. t_source t' = q' \<and> t_input t' = x \<longrightarrow> t' \<in> FSM.transitions P)))

goal (1 subgoal):
 1. FSM.initial P = FSM.initial M
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
FSM.initial P = FSM.initial M

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have "path M (initial M) pP"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. path M (FSM.initial M) pP
[PROOF STEP]
using \<open>is_preamble P M q\<close>
[PROOF STATE]
proof (prove)
using this:
is_preamble P M q

goal (1 subgoal):
 1. path M (FSM.initial M) pP
[PROOF STEP]
unfolding is_preamble_def
[PROOF STATE]
proof (prove)
using this:
FSM.acyclic P \<and> single_input P \<and> is_submachine P M \<and> q \<in> reachable_states P \<and> deadlock_state P q \<and> (\<forall>q'\<in>reachable_states P. (q = q' \<or> \<not> deadlock_state P q') \<and> (\<forall>x\<in>FSM.inputs M. (\<exists>t\<in>FSM.transitions P. t_source t = q' \<and> t_input t = x) \<longrightarrow> (\<forall>t'\<in>FSM.transitions M. t_source t' = q' \<and> t_input t' = x \<longrightarrow> t' \<in> FSM.transitions P)))

goal (1 subgoal):
 1. path M (FSM.initial M) pP
[PROOF STEP]
using submachine_path_initial
[PROOF STATE]
proof (prove)
using this:
FSM.acyclic P \<and> single_input P \<and> is_submachine P M \<and> q \<in> reachable_states P \<and> deadlock_state P q \<and> (\<forall>q'\<in>reachable_states P. (q = q' \<or> \<not> deadlock_state P q') \<and> (\<forall>x\<in>FSM.inputs M. (\<exists>t\<in>FSM.transitions P. t_source t = q' \<and> t_input t = x) \<longrightarrow> (\<forall>t'\<in>FSM.transitions M. t_source t' = q' \<and> t_input t' = x \<longrightarrow> t' \<in> FSM.transitions P)))
\<lbrakk>is_submachine ?A ?B; path ?A (FSM.initial ?A) ?p\<rbrakk> \<Longrightarrow> path ?B (FSM.initial ?B) ?p

goal (1 subgoal):
 1. path M (FSM.initial M) pP
[PROOF STEP]
using \<open>path P (FSM.initial P) pP\<close>
[PROOF STATE]
proof (prove)
using this:
FSM.acyclic P \<and> single_input P \<and> is_submachine P M \<and> q \<in> reachable_states P \<and> deadlock_state P q \<and> (\<forall>q'\<in>reachable_states P. (q = q' \<or> \<not> deadlock_state P q') \<and> (\<forall>x\<in>FSM.inputs M. (\<exists>t\<in>FSM.transitions P. t_source t = q' \<and> t_input t = x) \<longrightarrow> (\<forall>t'\<in>FSM.transitions M. t_source t' = q' \<and> t_input t' = x \<longrightarrow> t' \<in> FSM.transitions P)))
\<lbrakk>is_submachine ?A ?B; path ?A (FSM.initial ?A) ?p\<rbrakk> \<Longrightarrow> path ?B (FSM.initial ?B) ?p
path P (FSM.initial P) pP

goal (1 subgoal):
 1. path M (FSM.initial M) pP
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
path M (FSM.initial M) pP

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have "target (initial M) pP = q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. target (FSM.initial M) pP = q
[PROOF STEP]
using \<open>target (initial P) pP = q\<close>
[PROOF STATE]
proof (prove)
using this:
target (FSM.initial P) pP = q

goal (1 subgoal):
 1. target (FSM.initial M) pP = q
[PROOF STEP]
unfolding \<open>initial P = initial M\<close>
[PROOF STATE]
proof (prove)
using this:
target (FSM.initial M) pP = q

goal (1 subgoal):
 1. target (FSM.initial M) pP = q
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
target (FSM.initial M) pP = q

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
(* io must be a proper extension of some m-traversal path, as all m-traversal paths pass *)
[PROOF STATE]
proof (state)
this:
target (FSM.initial M) pP = q

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
obtain pM dM ioEx where "(pM,dM) \<in> m_traversal_paths_with_witness M q repetition_sets m"
                    and   "io = (p_io pM)@ioEx"
                    and   "ioEx \<noteq> []"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>pM dM ioEx. \<lbrakk>(pM, dM) \<in> m_traversal_paths_with_witness M q repetition_sets m; io = p_io pM @ ioEx; ioEx \<noteq> []\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<And>pM dM ioEx. \<lbrakk>(pM, dM) \<in> m_traversal_paths_with_witness M q repetition_sets m; io = p_io pM @ ioEx; ioEx \<noteq> []\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
obtain pF where "path M q pF" and "p_io pF = ?ioF"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>pF. \<lbrakk>path M q pF; p_io pF = butlast io\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using observable_path_suffix[OF \<open>((p_io pP) @ ?ioF) \<in> L M\<close> \<open>path M (initial M) pP\<close> \<open>observable M\<close> ]
[PROOF STATE]
proof (prove)
using this:
(\<And>p'. \<lbrakk>path M (target (FSM.initial M) pP) p'; p_io p' = butlast io\<rbrakk> \<Longrightarrow> ?thesis) \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. (\<And>pF. \<lbrakk>path M q pF; p_io pF = butlast io\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding \<open>target (initial M) pP = q\<close>
[PROOF STATE]
proof (prove)
using this:
(\<And>p'. \<lbrakk>path M q p'; p_io p' = butlast io\<rbrakk> \<Longrightarrow> ?thesis) \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. (\<And>pF. \<lbrakk>path M q pF; p_io pF = butlast io\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
path M q pF
p_io pF = butlast io

goal (1 subgoal):
 1. (\<And>pM dM ioEx. \<lbrakk>(pM, dM) \<in> m_traversal_paths_with_witness M q repetition_sets m; io = p_io pM @ ioEx; ioEx \<noteq> []\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
obtain tM where "tM \<in> transitions M" and "t_source tM = target q pF" and "t_input tM = ?xF"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>tM. \<lbrakk>tM \<in> FSM.transitions M; t_source tM = target q pF; t_input tM = fst (last io)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<open>?xF \<in> inputs M\<close> path_target_is_state[OF \<open>path M q pF\<close>]
            \<open>completely_specified M\<close>
[PROOF STATE]
proof (prove)
using this:
fst (last io) \<in> FSM.inputs M
target q pF \<in> FSM.states M
completely_specified M

goal (1 subgoal):
 1. (\<And>tM. \<lbrakk>tM \<in> FSM.transitions M; t_source tM = target q pF; t_input tM = fst (last io)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding completely_specified.simps
[PROOF STATE]
proof (prove)
using this:
fst (last io) \<in> FSM.inputs M
target q pF \<in> FSM.states M
\<forall>q\<in>FSM.states M. \<forall>x\<in>FSM.inputs M. \<exists>t\<in>FSM.transitions M. t_source t = q \<and> t_input t = x

goal (1 subgoal):
 1. (\<And>tM. \<lbrakk>tM \<in> FSM.transitions M; t_source tM = target q pF; t_input tM = fst (last io)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
tM \<in> FSM.transitions M
t_source tM = target q pF
t_input tM = fst (last io)

goal (1 subgoal):
 1. (\<And>pM dM ioEx. \<lbrakk>(pM, dM) \<in> m_traversal_paths_with_witness M q repetition_sets m; io = p_io pM @ ioEx; ioEx \<noteq> []\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
tM \<in> FSM.transitions M
t_source tM = target q pF
t_input tM = fst (last io)
[PROOF STEP]
have "path M q (pF@[tM])"
[PROOF STATE]
proof (prove)
using this:
tM \<in> FSM.transitions M
t_source tM = target q pF
t_input tM = fst (last io)

goal (1 subgoal):
 1. path M q (pF @ [tM])
[PROOF STEP]
using \<open>path M q pF\<close> path_append_transition
[PROOF STATE]
proof (prove)
using this:
tM \<in> FSM.transitions M
t_source tM = target q pF
t_input tM = fst (last io)
path M q pF
\<lbrakk>path ?M ?q ?p; ?t \<in> FSM.transitions ?M; t_source ?t = target ?q ?p\<rbrakk> \<Longrightarrow> path ?M ?q (?p @ [?t])

goal (1 subgoal):
 1. path M q (pF @ [tM])
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
path M q (pF @ [tM])

goal (1 subgoal):
 1. (\<And>pM dM ioEx. \<lbrakk>(pM, dM) \<in> m_traversal_paths_with_witness M q repetition_sets m; io = p_io pM @ ioEx; ioEx \<noteq> []\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. thesis
[PROOF STEP]
proof (cases "find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF@[tM]))) repetition_sets")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = None \<Longrightarrow> thesis
 2. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
case None
[PROOF STATE]
proof (state)
this:
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = None

goal (2 subgoals):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = None \<Longrightarrow> thesis
 2. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
(* if no repetition_sets witness exists for (pF@[tM]), then it is a proper prefix of some m-traversal path and hence also in L M, providing a contradiction*)
[PROOF STATE]
proof (state)
this:
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = None

goal (2 subgoals):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = None \<Longrightarrow> thesis
 2. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
obtain pF' d' where "((pF@[tM]) @ pF', d') \<in> m_traversal_paths_with_witness M q repetition_sets m"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>pF' d'. ((pF @ [tM]) @ pF', d') \<in> m_traversal_paths_with_witness M q repetition_sets m \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using m_traversal_path_extension_exist[OF \<open>completely_specified M\<close> \<open>q \<in> states M\<close> \<open>inputs M \<noteq> {}\<close> t5 t8 \<open>path M q (pF@[tM])\<close> None]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>q. q \<in> FSM.states M \<Longrightarrow> q \<in> FSM.states M; \<And>d. d \<in> set repetition_sets \<Longrightarrow> d \<in> set repetition_sets\<rbrakk> \<Longrightarrow> \<exists>p2 d'. ((pF @ [tM]) @ p2, d') \<in> m_traversal_paths_with_witness M q repetition_sets m

goal (1 subgoal):
 1. (\<And>pF' d'. ((pF @ [tM]) @ pF', d') \<in> m_traversal_paths_with_witness M q repetition_sets m \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
((pF @ [tM]) @ pF', d') \<in> m_traversal_paths_with_witness M q repetition_sets m

goal (2 subgoals):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = None \<Longrightarrow> thesis
 2. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
((pF @ [tM]) @ pF', d') \<in> m_traversal_paths_with_witness M q repetition_sets m
[PROOF STEP]
have "(pF@[tM]) @ pF' \<in> tps q"
[PROOF STATE]
proof (prove)
using this:
((pF @ [tM]) @ pF', d') \<in> m_traversal_paths_with_witness M q repetition_sets m

goal (1 subgoal):
 1. (pF @ [tM]) @ pF' \<in> tps q
[PROOF STEP]
using t6[OF \<open>q \<in> fst ` prs\<close>]
[PROOF STATE]
proof (prove)
using this:
((pF @ [tM]) @ pF', d') \<in> m_traversal_paths_with_witness M q repetition_sets m
tps q \<subseteq> {p1. \<exists>p2 d. (p1 @ p2, d) \<in> m_traversal_paths_with_witness M q repetition_sets m} \<and> fst ` m_traversal_paths_with_witness M q repetition_sets m \<subseteq> tps q

goal (1 subgoal):
 1. (pF @ [tM]) @ pF' \<in> tps q
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
(pF @ [tM]) @ pF' \<in> tps q

goal (2 subgoals):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = None \<Longrightarrow> thesis
 2. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
have "(p_io pF) @ [(?xF,t_output tM)] \<in> set (prefixes (p_io ((pF@[tM])@pF')))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p_io pF @ [(fst (last io), t_output tM)] \<in> set (prefixes (p_io ((pF @ [tM]) @ pF')))
[PROOF STEP]
using \<open>t_input tM = ?xF\<close>
[PROOF STATE]
proof (prove)
using this:
t_input tM = fst (last io)

goal (1 subgoal):
 1. p_io pF @ [(fst (last io), t_output tM)] \<in> set (prefixes (p_io ((pF @ [tM]) @ pF')))
[PROOF STEP]
unfolding prefixes_set
[PROOF STATE]
proof (prove)
using this:
t_input tM = fst (last io)

goal (1 subgoal):
 1. p_io pF @ [(fst (last io), t_output tM)] \<in> {xs'. \<exists>xs''. xs' @ xs'' = p_io ((pF @ [tM]) @ pF')}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
p_io pF @ [(fst (last io), t_output tM)] \<in> set (prefixes (p_io ((pF @ [tM]) @ pF')))

goal (2 subgoals):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = None \<Longrightarrow> thesis
 2. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
have "p_io pP @ p_io pF @ [?xyF] \<in> L M'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p_io pP @ p_io pF @ [(fst (last io), snd (last io))] \<in> L M'
[PROOF STEP]
using \<open>((p_io pP) @ io) \<in> L M'\<close>
[PROOF STATE]
proof (prove)
using this:
p_io pP @ io \<in> L M'

goal (1 subgoal):
 1. p_io pP @ p_io pF @ [(fst (last io), snd (last io))] \<in> L M'
[PROOF STEP]
unfolding \<open>p_io pF = ?ioF\<close> \<open>io = ?ioF@[?xyF]\<close>[symmetric]
[PROOF STATE]
proof (prove)
using this:
p_io pP @ io \<in> L M'

goal (1 subgoal):
 1. p_io pP @ io \<in> L M'
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
p_io pP @ p_io pF @ [(fst (last io), snd (last io))] \<in> L M'

goal (2 subgoals):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = None \<Longrightarrow> thesis
 2. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
obtain pT' where "pT' \<in> tps q"
                 and   "p_io pF @ [(fst (last io), snd (last io))] \<in> set (prefixes (p_io pT'))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>pT'. \<lbrakk>pT' \<in> tps q; p_io pF @ [(fst (last io), snd (last io))] \<in> set (prefixes (p_io pT'))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using pass2[OF \<open>(q,P) \<in> prs\<close> \<open>path P (initial P) pP\<close> \<open>target (initial P) pP = q\<close> \<open>(pF@[tM]) @ pF' \<in> tps q\<close>
                       \<open>(p_io pF) @ [(?xF,t_output tM)] \<in> set (prefixes (p_io ((pF@[tM])@pF')))\<close> \<open>p_io pP @ p_io pF @ [?xyF] \<in> L M'\<close>]
[PROOF STATE]
proof (prove)
using this:
\<exists>pT'. pT' \<in> tps q \<and> p_io pF @ [(fst (last io), snd (last io))] \<in> set (prefixes (p_io pT'))

goal (1 subgoal):
 1. (\<And>pT'. \<lbrakk>pT' \<in> tps q; p_io pF @ [(fst (last io), snd (last io))] \<in> set (prefixes (p_io pT'))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
pT' \<in> tps q
p_io pF @ [(fst (last io), snd (last io))] \<in> set (prefixes (p_io pT'))

goal (2 subgoals):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = None \<Longrightarrow> thesis
 2. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
have "path M q pT'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. path M q pT'
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. path M q pT'
[PROOF STEP]
obtain pT'' d'' where "(pT'@pT'', d'') \<in> m_traversal_paths_with_witness M q repetition_sets m"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>pT'' d''. (pT' @ pT'', d'') \<in> m_traversal_paths_with_witness M q repetition_sets m \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<open>pT' \<in> tps q\<close> t6[OF \<open>q \<in> fst ` prs\<close>]
[PROOF STATE]
proof (prove)
using this:
pT' \<in> tps q
tps q \<subseteq> {p1. \<exists>p2 d. (p1 @ p2, d) \<in> m_traversal_paths_with_witness M q repetition_sets m} \<and> fst ` m_traversal_paths_with_witness M q repetition_sets m \<subseteq> tps q

goal (1 subgoal):
 1. (\<And>pT'' d''. (pT' @ pT'', d'') \<in> m_traversal_paths_with_witness M q repetition_sets m \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(pT' @ pT'', d'') \<in> m_traversal_paths_with_witness M q repetition_sets m

goal (1 subgoal):
 1. path M q pT'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(pT' @ pT'', d'') \<in> m_traversal_paths_with_witness M q repetition_sets m
[PROOF STEP]
have "path M q (pT'@pT'')"
[PROOF STATE]
proof (prove)
using this:
(pT' @ pT'', d'') \<in> m_traversal_paths_with_witness M q repetition_sets m

goal (1 subgoal):
 1. path M q (pT' @ pT'')
[PROOF STEP]
using m_traversal_paths_with_witness_set[OF t5 t8 \<open>q \<in> states M\<close>]
[PROOF STATE]
proof (prove)
using this:
(pT' @ pT'', d'') \<in> m_traversal_paths_with_witness M q repetition_sets m
\<lbrakk>\<And>q. q \<in> FSM.states M \<Longrightarrow> q \<in> FSM.states M; \<And>d. d \<in> set repetition_sets \<Longrightarrow> d \<in> set repetition_sets\<rbrakk> \<Longrightarrow> m_traversal_paths_with_witness M q repetition_sets ?m = {(p, d) |p d. path M q p \<and> find (\<lambda>d. Suc (?m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p)) repetition_sets = Some d \<and> (\<forall>p' p''. p = p' @ p'' \<and> p'' \<noteq> [] \<longrightarrow> find (\<lambda>d. Suc (?m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None)}

goal (1 subgoal):
 1. path M q (pT' @ pT'')
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
path M q (pT' @ pT'')

goal (1 subgoal):
 1. path M q pT'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
path M q (pT' @ pT'')
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
path M q (pT' @ pT'')

goal (1 subgoal):
 1. path M q pT'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
path M q pT'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
path M q pT'

goal (2 subgoals):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = None \<Longrightarrow> thesis
 2. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
path M q pT'
[PROOF STEP]
have "path M (initial M) (pP@pT')"
[PROOF STATE]
proof (prove)
using this:
path M q pT'

goal (1 subgoal):
 1. path M (FSM.initial M) (pP @ pT')
[PROOF STEP]
using \<open>path M (initial M) pP\<close> \<open>target (initial M) pP = q\<close>
[PROOF STATE]
proof (prove)
using this:
path M q pT'
path M (FSM.initial M) pP
target (FSM.initial M) pP = q

goal (1 subgoal):
 1. path M (FSM.initial M) (pP @ pT')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
path M (FSM.initial M) (pP @ pT')

goal (2 subgoals):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = None \<Longrightarrow> thesis
 2. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
path M (FSM.initial M) (pP @ pT')
[PROOF STEP]
have "(p_io (pP@pT')) \<in> L M"
[PROOF STATE]
proof (prove)
using this:
path M (FSM.initial M) (pP @ pT')

goal (1 subgoal):
 1. p_io (pP @ pT') \<in> L M
[PROOF STEP]
unfolding LS.simps
[PROOF STATE]
proof (prove)
using this:
path M (FSM.initial M) (pP @ pT')

goal (1 subgoal):
 1. p_io (pP @ pT') \<in> {p_io p |p. path M (FSM.initial M) p}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
p_io (pP @ pT') \<in> L M

goal (2 subgoals):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = None \<Longrightarrow> thesis
 2. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
p_io (pP @ pT') \<in> L M
[PROOF STEP]
have "(p_io pP)@(p_io pT') \<in> L M"
[PROOF STATE]
proof (prove)
using this:
p_io (pP @ pT') \<in> L M

goal (1 subgoal):
 1. p_io pP @ p_io pT' \<in> L M
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
p_io pP @ p_io pT' \<in> L M

goal (2 subgoals):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = None \<Longrightarrow> thesis
 2. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
have "io \<in> set (prefixes (p_io pT'))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. io \<in> set (prefixes (p_io pT'))
[PROOF STEP]
using \<open>p_io pF @ [(fst (last io), snd (last io))] \<in> set (prefixes (p_io pT'))\<close>
[PROOF STATE]
proof (prove)
using this:
p_io pF @ [(fst (last io), snd (last io))] \<in> set (prefixes (p_io pT'))

goal (1 subgoal):
 1. io \<in> set (prefixes (p_io pT'))
[PROOF STEP]
unfolding \<open>p_io pF = ?ioF\<close> \<open>io = ?ioF@[?xyF]\<close>[symmetric]
[PROOF STATE]
proof (prove)
using this:
io \<in> set (prefixes (p_io pT'))

goal (1 subgoal):
 1. io \<in> set (prefixes (p_io pT'))
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
io \<in> set (prefixes (p_io pT'))

goal (2 subgoals):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = None \<Longrightarrow> thesis
 2. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
io \<in> set (prefixes (p_io pT'))
[PROOF STEP]
obtain io' where "p_io pT' = io @ io'"
[PROOF STATE]
proof (prove)
using this:
io \<in> set (prefixes (p_io pT'))

goal (1 subgoal):
 1. (\<And>io'. p_io pT' = io @ io' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding prefixes_set
[PROOF STATE]
proof (prove)
using this:
io \<in> {xs'. \<exists>xs''. xs' @ xs'' = p_io pT'}

goal (1 subgoal):
 1. (\<And>io'. p_io pT' = io @ io' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by moura
[PROOF STATE]
proof (state)
this:
p_io pT' = io @ io'

goal (2 subgoals):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = None \<Longrightarrow> thesis
 2. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
have " p_io pP @ io \<in> L M"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p_io pP @ io \<in> L M
[PROOF STEP]
using \<open>(p_io pP)@(p_io pT') \<in> L M\<close>
[PROOF STATE]
proof (prove)
using this:
p_io pP @ p_io pT' \<in> L M

goal (1 subgoal):
 1. p_io pP @ io \<in> L M
[PROOF STEP]
unfolding \<open>p_io pT' = io @ io'\<close>
[PROOF STATE]
proof (prove)
using this:
p_io pP @ io @ io' \<in> L M

goal (1 subgoal):
 1. p_io pP @ io \<in> L M
[PROOF STEP]
unfolding append.assoc[symmetric]
[PROOF STATE]
proof (prove)
using this:
(p_io pP @ io) @ io' \<in> L M

goal (1 subgoal):
 1. p_io pP @ io \<in> L M
[PROOF STEP]
using language_prefix[of "p_io pP @ io" io', of M "initial M"]
[PROOF STATE]
proof (prove)
using this:
(p_io pP @ io) @ io' \<in> L M
(p_io pP @ io) @ io' \<in> L M \<Longrightarrow> p_io pP @ io \<in> L M

goal (1 subgoal):
 1. p_io pP @ io \<in> L M
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
p_io pP @ io \<in> L M

goal (2 subgoals):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = None \<Longrightarrow> thesis
 2. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
p_io pP @ io \<in> L M
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
p_io pP @ io \<in> L M

goal (1 subgoal):
 1. thesis
[PROOF STEP]
using \<open>(p_io pP) @ io \<notin> L M\<close>
[PROOF STATE]
proof (prove)
using this:
p_io pP @ io \<in> L M
p_io pP @ io \<notin> L M

goal (1 subgoal):
 1. thesis
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
thesis

goal (1 subgoal):
 1. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
case (Some d)
[PROOF STATE]
proof (state)
this:
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some d

goal (1 subgoal):
 1. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
(* get the shortest prefix of pF that still has a RepSet witness *)
[PROOF STATE]
proof (state)
this:
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some d

goal (1 subgoal):
 1. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
let ?ps = "{ p1 . \<exists> p2 . (pF@[tM]) = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
have "finite ?ps"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. finite {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}
[PROOF STEP]
have "?ps \<subseteq> set (prefixes (pF@[tM]))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None} \<subseteq> set (prefixes (pF @ [tM]))
[PROOF STEP]
unfolding prefixes_set
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None} \<subseteq> {xs'. \<exists>xs''. xs' @ xs'' = pF @ [tM]}
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
{p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None} \<subseteq> set (prefixes (pF @ [tM]))

goal (1 subgoal):
 1. finite {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
{p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None} \<subseteq> set (prefixes (pF @ [tM]))

goal (1 subgoal):
 1. finite {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}
[PROOF STEP]
have "finite (set (prefixes (pF@[tM])))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite (set (prefixes (pF @ [tM])))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
finite (set (prefixes (pF @ [tM])))

goal (1 subgoal):
 1. finite {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
{p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None} \<subseteq> set (prefixes (pF @ [tM]))
finite (set (prefixes (pF @ [tM])))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
{p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None} \<subseteq> set (prefixes (pF @ [tM]))
finite (set (prefixes (pF @ [tM])))

goal (1 subgoal):
 1. finite {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}
[PROOF STEP]
by (simp add: finite_subset)
[PROOF STATE]
proof (state)
this:
finite {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
finite {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}

goal (1 subgoal):
 1. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
finite {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}

goal (1 subgoal):
 1. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
have "?ps \<noteq> {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None} \<noteq> {}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None} \<noteq> {}
[PROOF STEP]
have "pF @ [tM] = (pF @ [tM]) @ [] \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets \<noteq> None"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pF @ [tM] = (pF @ [tM]) @ [] \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets \<noteq> None
[PROOF STEP]
using Some
[PROOF STATE]
proof (prove)
using this:
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some d

goal (1 subgoal):
 1. pF @ [tM] = (pF @ [tM]) @ [] \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets \<noteq> None
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
pF @ [tM] = (pF @ [tM]) @ [] \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets \<noteq> None

goal (1 subgoal):
 1. {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None} \<noteq> {}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
pF @ [tM] = (pF @ [tM]) @ [] \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets \<noteq> None
[PROOF STEP]
have "(pF@[tM]) \<in> ?ps"
[PROOF STATE]
proof (prove)
using this:
pF @ [tM] = (pF @ [tM]) @ [] \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets \<noteq> None

goal (1 subgoal):
 1. pF @ [tM] \<in> {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
pF @ [tM] \<in> {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}

goal (1 subgoal):
 1. {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None} \<noteq> {}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
pF @ [tM] \<in> {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
pF @ [tM] \<in> {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}

goal (1 subgoal):
 1. {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None} \<noteq> {}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
{p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None} \<noteq> {}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
{p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None} \<noteq> {}

goal (1 subgoal):
 1. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
finite {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}
{p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None} \<noteq> {}
[PROOF STEP]
obtain pMin where "pMin \<in> ?ps" and "\<And> p' . p' \<in> ?ps \<Longrightarrow> length pMin \<le> length p'"
[PROOF STATE]
proof (prove)
using this:
finite {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}
{p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None} \<noteq> {}

goal (1 subgoal):
 1. (\<And>pMin. \<lbrakk>pMin \<in> {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}; \<And>p'. p' \<in> {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None} \<Longrightarrow> length pMin \<le> length p'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (meson leI min_length_elem)
[PROOF STATE]
proof (state)
this:
pMin \<in> {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}
?p' \<in> {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None} \<Longrightarrow> length pMin \<le> length ?p'

goal (1 subgoal):
 1. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
obtain pMin' dMin where "(pF@[tM]) = pMin @ pMin'"
                          and "find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) pMin)) repetition_sets = Some dMin"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>pMin' dMin. \<lbrakk>pF @ [tM] = pMin @ pMin'; find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) pMin)) repetition_sets = Some dMin\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<open>pMin \<in> ?ps\<close>
[PROOF STATE]
proof (prove)
using this:
pMin \<in> {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}

goal (1 subgoal):
 1. (\<And>pMin' dMin. \<lbrakk>pF @ [tM] = pMin @ pMin'; find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) pMin)) repetition_sets = Some dMin\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
pF @ [tM] = pMin @ pMin'
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) pMin)) repetition_sets = Some dMin

goal (1 subgoal):
 1. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
pF @ [tM] = pMin @ pMin'
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) pMin)) repetition_sets = Some dMin
[PROOF STEP]
have "path M q pMin"
[PROOF STATE]
proof (prove)
using this:
pF @ [tM] = pMin @ pMin'
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) pMin)) repetition_sets = Some dMin

goal (1 subgoal):
 1. path M q pMin
[PROOF STEP]
using \<open>path M q (pF@[tM])\<close>
[PROOF STATE]
proof (prove)
using this:
pF @ [tM] = pMin @ pMin'
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) pMin)) repetition_sets = Some dMin
path M q (pF @ [tM])

goal (1 subgoal):
 1. path M q pMin
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
path M q pMin

goal (1 subgoal):
 1. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
path M q pMin

goal (1 subgoal):
 1. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
have "(\<forall>p' p''. pMin = p' @ p'' \<and> p'' \<noteq> [] \<longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>p' p''. pMin = p' @ p'' \<and> p'' \<noteq> [] \<longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<forall>p' p''. pMin = p' @ p'' \<and> p'' \<noteq> [] \<longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None
[PROOF STEP]
have "\<And> p' p''. pMin = p' @ p'' \<Longrightarrow> p'' \<noteq> [] \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>p' p''. \<lbrakk>pMin = p' @ p''; p'' \<noteq> []\<rbrakk> \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>p' p''. \<lbrakk>pMin = p' @ p''; p'' \<noteq> []\<rbrakk> \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None
[PROOF STEP]
fix p' p''
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>p' p''. \<lbrakk>pMin = p' @ p''; p'' \<noteq> []\<rbrakk> \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None
[PROOF STEP]
assume "pMin = p' @ p''" and "p'' \<noteq> []"
[PROOF STATE]
proof (state)
this:
pMin = p' @ p''
p'' \<noteq> []

goal (1 subgoal):
 1. \<And>p' p''. \<lbrakk>pMin = p' @ p''; p'' \<noteq> []\<rbrakk> \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None
[PROOF STEP]
show "find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None
[PROOF STEP]
proof (rule ccontr)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets \<noteq> None \<Longrightarrow> False
[PROOF STEP]
assume "find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets \<noteq> None"
[PROOF STATE]
proof (state)
this:
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets \<noteq> None

goal (1 subgoal):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets \<noteq> None \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets \<noteq> None
[PROOF STEP]
have "p' \<in> ?ps"
[PROOF STATE]
proof (prove)
using this:
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets \<noteq> None

goal (1 subgoal):
 1. p' \<in> {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}
[PROOF STEP]
using \<open>(pF@[tM]) = pMin @ pMin'\<close>
[PROOF STATE]
proof (prove)
using this:
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets \<noteq> None
pF @ [tM] = pMin @ pMin'

goal (1 subgoal):
 1. p' \<in> {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}
[PROOF STEP]
unfolding \<open>pMin = p' @ p''\<close> append.assoc
[PROOF STATE]
proof (prove)
using this:
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets \<noteq> None
pF @ [tM] = p' @ p'' @ pMin'

goal (1 subgoal):
 1. p' \<in> {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
p' \<in> {p1. \<exists>p2. pF @ [tM] = p1 @ p2 \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p1)) repetition_sets \<noteq> None}

goal (1 subgoal):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets \<noteq> None \<Longrightarrow> False
[PROOF STEP]
have "length p' < length pMin"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length p' < length pMin
[PROOF STEP]
using \<open>pMin = p' @ p''\<close> \<open>p'' \<noteq> []\<close>
[PROOF STATE]
proof (prove)
using this:
pMin = p' @ p''
p'' \<noteq> []

goal (1 subgoal):
 1. length p' < length pMin
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
length p' < length pMin

goal (1 subgoal):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets \<noteq> None \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
length p' < length pMin
[PROOF STEP]
show "False"
[PROOF STATE]
proof (prove)
using this:
length p' < length pMin

goal (1 subgoal):
 1. False
[PROOF STEP]
using \<open>\<And> p' . p' \<in> ?ps \<Longrightarrow> length pMin \<le> length p'\<close>[OF \<open>p' \<in> ?ps\<close>]
[PROOF STATE]
proof (prove)
using this:
length p' < length pMin
length pMin \<le> length p'

goal (1 subgoal):
 1. False
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>pMin = ?p' @ ?p''; ?p'' \<noteq> []\<rbrakk> \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) ?p')) repetition_sets = None

goal (1 subgoal):
 1. \<forall>p' p''. pMin = p' @ p'' \<and> p'' \<noteq> [] \<longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>pMin = ?p' @ ?p''; ?p'' \<noteq> []\<rbrakk> \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) ?p')) repetition_sets = None
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>pMin = ?p' @ ?p''; ?p'' \<noteq> []\<rbrakk> \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) ?p')) repetition_sets = None

goal (1 subgoal):
 1. \<forall>p' p''. pMin = p' @ p'' \<and> p'' \<noteq> [] \<longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<forall>p' p''. pMin = p' @ p'' \<and> p'' \<noteq> [] \<longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<forall>p' p''. pMin = p' @ p'' \<and> p'' \<noteq> [] \<longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None

goal (1 subgoal):
 1. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
path M q pMin
\<forall>p' p''. pMin = p' @ p'' \<and> p'' \<noteq> [] \<longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None
[PROOF STEP]
have "(pMin,dMin) \<in> m_traversal_paths_with_witness M q repetition_sets m"
[PROOF STATE]
proof (prove)
using this:
path M q pMin
\<forall>p' p''. pMin = p' @ p'' \<and> p'' \<noteq> [] \<longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None

goal (1 subgoal):
 1. (pMin, dMin) \<in> m_traversal_paths_with_witness M q repetition_sets m
[PROOF STEP]
using \<open>find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) pMin)) repetition_sets = Some dMin\<close>
              m_traversal_paths_with_witness_set[OF t5 t8 \<open>q \<in> states M\<close>, of m]
[PROOF STATE]
proof (prove)
using this:
path M q pMin
\<forall>p' p''. pMin = p' @ p'' \<and> p'' \<noteq> [] \<longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) pMin)) repetition_sets = Some dMin
\<lbrakk>\<And>q. q \<in> FSM.states M \<Longrightarrow> q \<in> FSM.states M; \<And>d. d \<in> set repetition_sets \<Longrightarrow> d \<in> set repetition_sets\<rbrakk> \<Longrightarrow> m_traversal_paths_with_witness M q repetition_sets m = {(p, d) |p d. path M q p \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p)) repetition_sets = Some d \<and> (\<forall>p' p''. p = p' @ p'' \<and> p'' \<noteq> [] \<longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None)}

goal (1 subgoal):
 1. (pMin, dMin) \<in> m_traversal_paths_with_witness M q repetition_sets m
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(pMin, dMin) \<in> m_traversal_paths_with_witness M q repetition_sets m

goal (1 subgoal):
 1. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(pMin, dMin) \<in> m_traversal_paths_with_witness M q repetition_sets m
[PROOF STEP]
have "pMin \<in> tps q"
[PROOF STATE]
proof (prove)
using this:
(pMin, dMin) \<in> m_traversal_paths_with_witness M q repetition_sets m

goal (1 subgoal):
 1. pMin \<in> tps q
[PROOF STEP]
using t6[OF \<open>q \<in> fst ` prs\<close>]
[PROOF STATE]
proof (prove)
using this:
(pMin, dMin) \<in> m_traversal_paths_with_witness M q repetition_sets m
tps q \<subseteq> {p1. \<exists>p2 d. (p1 @ p2, d) \<in> m_traversal_paths_with_witness M q repetition_sets m} \<and> fst ` m_traversal_paths_with_witness M q repetition_sets m \<subseteq> tps q

goal (1 subgoal):
 1. pMin \<in> tps q
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
pMin \<in> tps q

goal (1 subgoal):
 1. \<And>a. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pF @ [tM]))) repetition_sets = Some a \<Longrightarrow> thesis
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. thesis
[PROOF STEP]
proof (cases "pMin = (pF@[tM])")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. pMin = pF @ [tM] \<Longrightarrow> thesis
 2. pMin \<noteq> pF @ [tM] \<Longrightarrow> thesis
[PROOF STEP]
(* if the m-traversal path is not shorter than io, then again the failure is observed *)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. pMin = pF @ [tM] \<Longrightarrow> thesis
 2. pMin \<noteq> pF @ [tM] \<Longrightarrow> thesis
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
pMin = pF @ [tM]

goal (2 subgoals):
 1. pMin = pF @ [tM] \<Longrightarrow> thesis
 2. pMin \<noteq> pF @ [tM] \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
pMin = pF @ [tM]
[PROOF STEP]
have "?ioF @ [(?xF, t_output tM)] \<in> set (prefixes (p_io pMin))"
[PROOF STATE]
proof (prove)
using this:
pMin = pF @ [tM]

goal (1 subgoal):
 1. butlast io @ [(fst (last io), t_output tM)] \<in> set (prefixes (p_io pMin))
[PROOF STEP]
using \<open>p_io pF = ?ioF\<close> \<open>t_input tM = ?xF\<close>
[PROOF STATE]
proof (prove)
using this:
pMin = pF @ [tM]
p_io pF = butlast io
t_input tM = fst (last io)

goal (1 subgoal):
 1. butlast io @ [(fst (last io), t_output tM)] \<in> set (prefixes (p_io pMin))
[PROOF STEP]
unfolding prefixes_set
[PROOF STATE]
proof (prove)
using this:
pMin = pF @ [tM]
p_io pF = butlast io
t_input tM = fst (last io)

goal (1 subgoal):
 1. butlast io @ [(fst (last io), t_output tM)] \<in> {xs'. \<exists>xs''. xs' @ xs'' = p_io pMin}
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
butlast io @ [(fst (last io), t_output tM)] \<in> set (prefixes (p_io pMin))

goal (2 subgoals):
 1. pMin = pF @ [tM] \<Longrightarrow> thesis
 2. pMin \<noteq> pF @ [tM] \<Longrightarrow> thesis
[PROOF STEP]
obtain pMinF where "pMinF \<in> tps q" and "io \<in> set (prefixes (p_io pMinF))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>pMinF. \<lbrakk>pMinF \<in> tps q; io \<in> set (prefixes (p_io pMinF))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using pass2[OF \<open>(q,P) \<in> prs\<close> \<open>path P (initial P) pP\<close> \<open>target (initial P) pP = q\<close> \<open>pMin \<in> tps q\<close> \<open>?ioF @ [(?xF, t_output tM)] \<in> set (prefixes (p_io pMin))\<close>, of ?yF]
[PROOF STATE]
proof (prove)
using this:
p_io pP @ butlast io @ [(fst (last io), snd (last io))] \<in> L M' \<Longrightarrow> \<exists>pT'. pT' \<in> tps q \<and> butlast io @ [(fst (last io), snd (last io))] \<in> set (prefixes (p_io pT'))

goal (1 subgoal):
 1. (\<And>pMinF. \<lbrakk>pMinF \<in> tps q; io \<in> set (prefixes (p_io pMinF))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<open>p_io pP @ io \<in> L M'\<close>
[PROOF STATE]
proof (prove)
using this:
p_io pP @ butlast io @ [(fst (last io), snd (last io))] \<in> L M' \<Longrightarrow> \<exists>pT'. pT' \<in> tps q \<and> butlast io @ [(fst (last io), snd (last io))] \<in> set (prefixes (p_io pT'))
p_io pP @ io \<in> L M'

goal (1 subgoal):
 1. (\<And>pMinF. \<lbrakk>pMinF \<in> tps q; io \<in> set (prefixes (p_io pMinF))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding \<open>io = ?ioF@[?xyF]\<close>[symmetric]
[PROOF STATE]
proof (prove)
using this:
p_io pP @ io \<in> L M' \<Longrightarrow> \<exists>pT'. pT' \<in> tps q \<and> io \<in> set (prefixes (p_io pT'))
p_io pP @ io \<in> L M'

goal (1 subgoal):
 1. (\<And>pMinF. \<lbrakk>pMinF \<in> tps q; io \<in> set (prefixes (p_io pMinF))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
pMinF \<in> tps q
io \<in> set (prefixes (p_io pMinF))

goal (2 subgoals):
 1. pMin = pF @ [tM] \<Longrightarrow> thesis
 2. pMin \<noteq> pF @ [tM] \<Longrightarrow> thesis
[PROOF STEP]
have "path M q pMinF"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. path M q pMinF
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. path M q pMinF
[PROOF STEP]
obtain pT'' d'' where "(pMinF@pT'', d'') \<in> m_traversal_paths_with_witness M q repetition_sets m"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>pT'' d''. (pMinF @ pT'', d'') \<in> m_traversal_paths_with_witness M q repetition_sets m \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<open>pMinF \<in> tps q\<close> t6[OF \<open>q \<in> fst ` prs\<close>]
[PROOF STATE]
proof (prove)
using this:
pMinF \<in> tps q
tps q \<subseteq> {p1. \<exists>p2 d. (p1 @ p2, d) \<in> m_traversal_paths_with_witness M q repetition_sets m} \<and> fst ` m_traversal_paths_with_witness M q repetition_sets m \<subseteq> tps q

goal (1 subgoal):
 1. (\<And>pT'' d''. (pMinF @ pT'', d'') \<in> m_traversal_paths_with_witness M q repetition_sets m \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(pMinF @ pT'', d'') \<in> m_traversal_paths_with_witness M q repetition_sets m

goal (1 subgoal):
 1. path M q pMinF
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(pMinF @ pT'', d'') \<in> m_traversal_paths_with_witness M q repetition_sets m
[PROOF STEP]
have "path M q (pMinF@pT'')"
[PROOF STATE]
proof (prove)
using this:
(pMinF @ pT'', d'') \<in> m_traversal_paths_with_witness M q repetition_sets m

goal (1 subgoal):
 1. path M q (pMinF @ pT'')
[PROOF STEP]
using m_traversal_paths_with_witness_set[OF t5 t8 \<open>q \<in> states M\<close>]
[PROOF STATE]
proof (prove)
using this:
(pMinF @ pT'', d'') \<in> m_traversal_paths_with_witness M q repetition_sets m
\<lbrakk>\<And>q. q \<in> FSM.states M \<Longrightarrow> q \<in> FSM.states M; \<And>d. d \<in> set repetition_sets \<Longrightarrow> d \<in> set repetition_sets\<rbrakk> \<Longrightarrow> m_traversal_paths_with_witness M q repetition_sets ?m = {(p, d) |p d. path M q p \<and> find (\<lambda>d. Suc (?m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p)) repetition_sets = Some d \<and> (\<forall>p' p''. p = p' @ p'' \<and> p'' \<noteq> [] \<longrightarrow> find (\<lambda>d. Suc (?m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None)}

goal (1 subgoal):
 1. path M q (pMinF @ pT'')
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
path M q (pMinF @ pT'')

goal (1 subgoal):
 1. path M q pMinF
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
path M q (pMinF @ pT'')
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
path M q (pMinF @ pT'')

goal (1 subgoal):
 1. path M q pMinF
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
path M q pMinF

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
path M q pMinF

goal (2 subgoals):
 1. pMin = pF @ [tM] \<Longrightarrow> thesis
 2. pMin \<noteq> pF @ [tM] \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
path M q pMinF
[PROOF STEP]
have "path M (initial M) (pP@pMinF)"
[PROOF STATE]
proof (prove)
using this:
path M q pMinF

goal (1 subgoal):
 1. path M (FSM.initial M) (pP @ pMinF)
[PROOF STEP]
using \<open>path M (initial M) pP\<close> \<open>target (initial M) pP = q\<close>
[PROOF STATE]
proof (prove)
using this:
path M q pMinF
path M (FSM.initial M) pP
target (FSM.initial M) pP = q

goal (1 subgoal):
 1. path M (FSM.initial M) (pP @ pMinF)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
path M (FSM.initial M) (pP @ pMinF)

goal (2 subgoals):
 1. pMin = pF @ [tM] \<Longrightarrow> thesis
 2. pMin \<noteq> pF @ [tM] \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
path M (FSM.initial M) (pP @ pMinF)
[PROOF STEP]
have "(p_io (pP@pMinF)) \<in> L M"
[PROOF STATE]
proof (prove)
using this:
path M (FSM.initial M) (pP @ pMinF)

goal (1 subgoal):
 1. p_io (pP @ pMinF) \<in> L M
[PROOF STEP]
unfolding LS.simps
[PROOF STATE]
proof (prove)
using this:
path M (FSM.initial M) (pP @ pMinF)

goal (1 subgoal):
 1. p_io (pP @ pMinF) \<in> {p_io p |p. path M (FSM.initial M) p}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
p_io (pP @ pMinF) \<in> L M

goal (2 subgoals):
 1. pMin = pF @ [tM] \<Longrightarrow> thesis
 2. pMin \<noteq> pF @ [tM] \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
p_io (pP @ pMinF) \<in> L M
[PROOF STEP]
have "(p_io pP)@(p_io pMinF) \<in> L M"
[PROOF STATE]
proof (prove)
using this:
p_io (pP @ pMinF) \<in> L M

goal (1 subgoal):
 1. p_io pP @ p_io pMinF \<in> L M
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
p_io pP @ p_io pMinF \<in> L M

goal (2 subgoals):
 1. pMin = pF @ [tM] \<Longrightarrow> thesis
 2. pMin \<noteq> pF @ [tM] \<Longrightarrow> thesis
[PROOF STEP]
obtain io' where "p_io pMinF = io @ io'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>io'. p_io pMinF = io @ io' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<open>io \<in> set (prefixes (p_io pMinF))\<close>
[PROOF STATE]
proof (prove)
using this:
io \<in> set (prefixes (p_io pMinF))

goal (1 subgoal):
 1. (\<And>io'. p_io pMinF = io @ io' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding prefixes_set
[PROOF STATE]
proof (prove)
using this:
io \<in> {xs'. \<exists>xs''. xs' @ xs'' = p_io pMinF}

goal (1 subgoal):
 1. (\<And>io'. p_io pMinF = io @ io' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by moura
[PROOF STATE]
proof (state)
this:
p_io pMinF = io @ io'

goal (2 subgoals):
 1. pMin = pF @ [tM] \<Longrightarrow> thesis
 2. pMin \<noteq> pF @ [tM] \<Longrightarrow> thesis
[PROOF STEP]
have " p_io pP @ io \<in> L M"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p_io pP @ io \<in> L M
[PROOF STEP]
using \<open>(p_io pP)@(p_io pMinF) \<in> L M\<close>
[PROOF STATE]
proof (prove)
using this:
p_io pP @ p_io pMinF \<in> L M

goal (1 subgoal):
 1. p_io pP @ io \<in> L M
[PROOF STEP]
unfolding \<open>p_io pMinF = io @ io'\<close>
[PROOF STATE]
proof (prove)
using this:
p_io pP @ io @ io' \<in> L M

goal (1 subgoal):
 1. p_io pP @ io \<in> L M
[PROOF STEP]
unfolding append.assoc[symmetric]
[PROOF STATE]
proof (prove)
using this:
(p_io pP @ io) @ io' \<in> L M

goal (1 subgoal):
 1. p_io pP @ io \<in> L M
[PROOF STEP]
using language_prefix[of "p_io pP @ io" io', of M "initial M"]
[PROOF STATE]
proof (prove)
using this:
(p_io pP @ io) @ io' \<in> L M
(p_io pP @ io) @ io' \<in> L M \<Longrightarrow> p_io pP @ io \<in> L M

goal (1 subgoal):
 1. p_io pP @ io \<in> L M
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
p_io pP @ io \<in> L M

goal (2 subgoals):
 1. pMin = pF @ [tM] \<Longrightarrow> thesis
 2. pMin \<noteq> pF @ [tM] \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
p_io pP @ io \<in> L M
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
p_io pP @ io \<in> L M

goal (1 subgoal):
 1. thesis
[PROOF STEP]
using \<open>(p_io pP) @ io \<notin> L M\<close>
[PROOF STATE]
proof (prove)
using this:
p_io pP @ io \<in> L M
p_io pP @ io \<notin> L M

goal (1 subgoal):
 1. thesis
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
thesis

goal (1 subgoal):
 1. pMin \<noteq> pF @ [tM] \<Longrightarrow> thesis
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. pMin \<noteq> pF @ [tM] \<Longrightarrow> thesis
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
pMin \<noteq> pF @ [tM]

goal (1 subgoal):
 1. pMin \<noteq> pF @ [tM] \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
pMin \<noteq> pF @ [tM]
[PROOF STEP]
obtain pMin'' where "pF = pMin @ pMin''"
[PROOF STATE]
proof (prove)
using this:
pMin \<noteq> pF @ [tM]

goal (1 subgoal):
 1. (\<And>pMin''. pF = pMin @ pMin'' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<open>(pF@[tM]) = pMin @ pMin'\<close>
[PROOF STATE]
proof (prove)
using this:
pMin \<noteq> pF @ [tM]
pF @ [tM] = pMin @ pMin'

goal (1 subgoal):
 1. (\<And>pMin''. pF = pMin @ pMin'' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis butlast_append butlast_snoc)
[PROOF STATE]
proof (state)
this:
pF = pMin @ pMin''

goal (1 subgoal):
 1. pMin \<noteq> pF @ [tM] \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
pF = pMin @ pMin''
[PROOF STEP]
have "io = (p_io pMin) @ (p_io pMin'') @ [?xyF]"
[PROOF STATE]
proof (prove)
using this:
pF = pMin @ pMin''

goal (1 subgoal):
 1. io = p_io pMin @ p_io pMin'' @ [(fst (last io), snd (last io))]
[PROOF STEP]
using \<open>io = ?ioF @ [?xyF]\<close> \<open>p_io pF = ?ioF\<close>
[PROOF STATE]
proof (prove)
using this:
pF = pMin @ pMin''
io = butlast io @ [(fst (last io), snd (last io))]
p_io pF = butlast io

goal (1 subgoal):
 1. io = p_io pMin @ p_io pMin'' @ [(fst (last io), snd (last io))]
[PROOF STEP]
by (metis (no_types, lifting) append_assoc map_append)
[PROOF STATE]
proof (state)
this:
io = p_io pMin @ p_io pMin'' @ [(fst (last io), snd (last io))]

goal (1 subgoal):
 1. pMin \<noteq> pF @ [tM] \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
io = p_io pMin @ p_io pMin'' @ [(fst (last io), snd (last io))]
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
io = p_io pMin @ p_io pMin'' @ [(fst (last io), snd (last io))]

goal (1 subgoal):
 1. thesis
[PROOF STEP]
using that[OF \<open>(pMin,dMin) \<in> m_traversal_paths_with_witness M q repetition_sets m\<close>, of "(p_io pMin'') @ [?xyF]"]
[PROOF STATE]
proof (prove)
using this:
io = p_io pMin @ p_io pMin'' @ [(fst (last io), snd (last io))]
\<lbrakk>io = p_io pMin @ p_io pMin'' @ [(fst (last io), snd (last io))]; p_io pMin'' @ [(fst (last io), snd (last io))] \<noteq> []\<rbrakk> \<Longrightarrow> thesis

goal (1 subgoal):
 1. thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
thesis

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
thesis

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
thesis

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(pM, dM) \<in> m_traversal_paths_with_witness M q repetition_sets m
io = p_io pM @ ioEx
ioEx \<noteq> []

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
(* collect length properties on pM to ultimately show that M' must have at least m+1 states *)
[PROOF STATE]
proof (state)
this:
(pM, dM) \<in> m_traversal_paths_with_witness M q repetition_sets m
io = p_io pM @ ioEx
ioEx \<noteq> []

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have "p_io pP @ p_io pM \<in> L M'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p_io pP @ p_io pM \<in> L M'
[PROOF STEP]
using \<open>((p_io pP) @ io) \<in> L M'\<close>
[PROOF STATE]
proof (prove)
using this:
p_io pP @ io \<in> L M'

goal (1 subgoal):
 1. p_io pP @ p_io pM \<in> L M'
[PROOF STEP]
unfolding \<open>io = (p_io pM)@ioEx\<close> append.assoc[symmetric]
[PROOF STATE]
proof (prove)
using this:
(p_io pP @ p_io pM) @ ioEx \<in> L M'

goal (1 subgoal):
 1. p_io pP @ p_io pM \<in> L M'
[PROOF STEP]
using language_prefix[of "p_io pP @ p_io pM" ioEx M' "initial M'"]
[PROOF STATE]
proof (prove)
using this:
(p_io pP @ p_io pM) @ ioEx \<in> L M'
(p_io pP @ p_io pM) @ ioEx \<in> L M' \<Longrightarrow> p_io pP @ p_io pM \<in> L M'

goal (1 subgoal):
 1. p_io pP @ p_io pM \<in> L M'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
p_io pP @ p_io pM \<in> L M'

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have no_shared_targets_for_distinct_states : "\<And> q' q'' pR1 pR2. q' \<noteq> q'' \<Longrightarrow>
                                                  q' \<in> fst dM \<Longrightarrow>
                                                  q'' \<in> fst dM \<Longrightarrow>
                                                  pR1 \<in> RP M q q' pP pM prs M' \<Longrightarrow>
                                                  pR2 \<in> RP M q q'' pP pM prs M' \<Longrightarrow>
                                                  io_targets M' (p_io pR1) (initial M') \<inter> io_targets M' (p_io pR2) (initial M') = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q' q'' pR1 pR2. \<lbrakk>q' \<noteq> q''; q' \<in> fst dM; q'' \<in> fst dM; pR1 \<in> RP M q q' pP pM prs M'; pR2 \<in> RP M q q'' pP pM prs M'\<rbrakk> \<Longrightarrow> io_targets M' (p_io pR1) (FSM.initial M') \<inter> io_targets M' (p_io pR2) (FSM.initial M') = {}
[PROOF STEP]
using passes_test_suite_exhaustiveness_helper_1[OF \<open>completely_specified M'\<close> \<open>inputs M' = inputs M\<close> \<open>observable M\<close> \<open>observable M'\<close> \<open>(q,P) \<in> prs\<close> \<open>path P (initial P) pP\<close> \<open>target (FSM.initial P) pP = q\<close> \<open>p_io pP @ p_io pM \<in> L M'\<close> \<open>(pM, dM) \<in> m_traversal_paths_with_witness M q repetition_sets m\<close> repetition_sets_def \<open>passes_test_suite M (Test_Suite prs tps rd_targets separators) M'\<close>]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?q' \<noteq> ?q''; ?q' \<in> fst dM; ?q'' \<in> fst dM; ?pR1.0 \<in> RP M q ?q' pP pM prs M'; ?pR2.0 \<in> RP M q ?q'' pP pM prs M'\<rbrakk> \<Longrightarrow> io_targets M' (p_io ?pR1.0) (FSM.initial M') \<inter> io_targets M' (p_io ?pR2.0) (FSM.initial M') = {}

goal (1 subgoal):
 1. \<And>q' q'' pR1 pR2. \<lbrakk>q' \<noteq> q''; q' \<in> fst dM; q'' \<in> fst dM; pR1 \<in> RP M q q' pP pM prs M'; pR2 \<in> RP M q q'' pP pM prs M'\<rbrakk> \<Longrightarrow> io_targets M' (p_io pR1) (FSM.initial M') \<inter> io_targets M' (p_io pR2) (FSM.initial M') = {}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>?q' \<noteq> ?q''; ?q' \<in> fst dM; ?q'' \<in> fst dM; ?pR1.0 \<in> RP M q ?q' pP pM prs M'; ?pR2.0 \<in> RP M q ?q'' pP pM prs M'\<rbrakk> \<Longrightarrow> io_targets M' (p_io ?pR1.0) (FSM.initial M') \<inter> io_targets M' (p_io ?pR2.0) (FSM.initial M') = {}

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have "path M q pM"
  and  "find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) pM)) repetition_sets = Some dM"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. path M q pM &&& find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) pM)) repetition_sets = Some dM
[PROOF STEP]
using \<open>(pM,dM) \<in> m_traversal_paths_with_witness M q repetition_sets m\<close>
[PROOF STATE]
proof (prove)
using this:
(pM, dM) \<in> m_traversal_paths_with_witness M q repetition_sets m

goal (1 subgoal):
 1. path M q pM &&& find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) pM)) repetition_sets = Some dM
[PROOF STEP]
using m_traversal_paths_with_witness_set[OF t5 t8 \<open>q \<in> states M\<close>, of m]
[PROOF STATE]
proof (prove)
using this:
(pM, dM) \<in> m_traversal_paths_with_witness M q repetition_sets m
\<lbrakk>\<And>q. q \<in> FSM.states M \<Longrightarrow> q \<in> FSM.states M; \<And>d. d \<in> set repetition_sets \<Longrightarrow> d \<in> set repetition_sets\<rbrakk> \<Longrightarrow> m_traversal_paths_with_witness M q repetition_sets m = {(p, d) |p d. path M q p \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p)) repetition_sets = Some d \<and> (\<forall>p' p''. p = p' @ p'' \<and> p'' \<noteq> [] \<longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None)}

goal (1 subgoal):
 1. path M q pM &&& find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) pM)) repetition_sets = Some dM
[PROOF STEP]
by force+
[PROOF STATE]
proof (state)
this:
path M q pM
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) pM)) repetition_sets = Some dM

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
path M q pM
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) pM)) repetition_sets = Some dM
[PROOF STEP]
have "path M (target (FSM.initial M) pP) pM"
[PROOF STATE]
proof (prove)
using this:
path M q pM
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) pM)) repetition_sets = Some dM

goal (1 subgoal):
 1. path M (target (FSM.initial M) pP) pM
[PROOF STEP]
unfolding \<open>(target (FSM.initial M) pP) = q\<close>
[PROOF STATE]
proof (prove)
using this:
path M q pM
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) pM)) repetition_sets = Some dM

goal (1 subgoal):
 1. path M q pM
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
path M (target (FSM.initial M) pP) pM

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have "dM \<in> set repetition_sets"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dM \<in> set repetition_sets
[PROOF STEP]
using find_set[OF \<open>find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) pM)) repetition_sets = Some dM\<close>]
[PROOF STATE]
proof (prove)
using this:
dM \<in> set repetition_sets

goal (1 subgoal):
 1. dM \<in> set repetition_sets
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
dM \<in> set repetition_sets

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have "Suc (m - card (snd dM)) \<le> length (filter (\<lambda>t. t_target t \<in> fst dM) pM)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Suc (m - card (snd dM)) \<le> length (filter (\<lambda>t. t_target t \<in> fst dM) pM)
[PROOF STEP]
using find_condition[OF \<open>find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) pM)) repetition_sets = Some dM\<close>]
[PROOF STATE]
proof (prove)
using this:
Suc (m - card (snd dM)) \<le> length (filter (\<lambda>t. t_target t \<in> fst dM) pM)

goal (1 subgoal):
 1. Suc (m - card (snd dM)) \<le> length (filter (\<lambda>t. t_target t \<in> fst dM) pM)
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
Suc (m - card (snd dM)) \<le> length (filter (\<lambda>t. t_target t \<in> fst dM) pM)

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
obtain ioX where "butlast io = (p_io pM)@ioX"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>ioX. butlast io = p_io pM @ ioX \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<open>io = (p_io pM)@ioEx\<close>
[PROOF STATE]
proof (prove)
using this:
io = p_io pM @ ioEx

goal (1 subgoal):
 1. (\<And>ioX. butlast io = p_io pM @ ioX \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (simp add: \<open>ioEx \<noteq> []\<close> butlast_append)
[PROOF STATE]
proof (state)
this:
butlast io = p_io pM @ ioX

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have RP_card : "\<And> q' . card (\<Union>pR\<in>RP M (target (FSM.initial M) pP) q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) = card (RP M (target (FSM.initial M) pP) q' pP pM prs M')"
  and  RP_targets: "\<And> q' pR . pR \<in> RP M (target (FSM.initial M) pP) q' pP pM prs M' \<Longrightarrow> \<exists>q. io_targets M' (p_io pR) (FSM.initial M') = {q}"
  and  no_shared_targets_for_identical_states: "\<And> q' pR1 pR2 . pR1 \<in> RP M (target (FSM.initial M) pP) q' pP pM prs M' \<Longrightarrow> pR2 \<in> RP M (target (FSM.initial M) pP) q' pP pM prs M' \<Longrightarrow> pR1 \<noteq> pR2 \<Longrightarrow> io_targets M' (p_io pR1) (FSM.initial M') \<inter> io_targets M' (p_io pR2) (FSM.initial M') = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>q'. card (\<Union>pR\<in>RP M (target (FSM.initial M) pP) q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) = card (RP M (target (FSM.initial M) pP) q' pP pM prs M')) &&& (\<And>q' pR. pR \<in> RP M (target (FSM.initial M) pP) q' pP pM prs M' \<Longrightarrow> \<exists>q. io_targets M' (p_io pR) (FSM.initial M') = {q}) &&& (\<And>q' pR1 pR2. \<lbrakk>pR1 \<in> RP M (target (FSM.initial M) pP) q' pP pM prs M'; pR2 \<in> RP M (target (FSM.initial M) pP) q' pP pM prs M'; pR1 \<noteq> pR2\<rbrakk> \<Longrightarrow> io_targets M' (p_io pR1) (FSM.initial M') \<inter> io_targets M' (p_io pR2) (FSM.initial M') = {})
[PROOF STEP]
using RP_count[OF \<open>minimal_sequence_to_failure_extending_preamble_path M M' prs pP io\<close> \<open>observable M\<close> \<open>observable M'\<close> t2 \<open>path M (target (FSM.initial M) pP) pM\<close> \<open>butlast io = (p_io pM)@ioX\<close> pass1 \<open>completely_specified M'\<close> \<open>inputs M' = inputs M\<close>, of "\<lambda> q P io x y y' . q" "\<lambda> q P io x y y' . y"]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>q P. (q, P) \<in> prs \<Longrightarrow> (q, P) \<in> prs; \<And>q P io x y y'. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> (q, P) \<in> prs; \<And>q P io x y y'. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> io @ [(x, y)] \<in> L P; \<And>q P io x y y'. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> card (\<Union>pR\<in>RP M (target (FSM.initial M) pP) ?q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) = card (RP M (target (FSM.initial M) pP) ?q' pP pM prs M')
\<lbrakk>\<And>q P. (q, P) \<in> prs \<Longrightarrow> (q, P) \<in> prs; \<And>q P io x y y'. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> (q, P) \<in> prs; \<And>q P io x y y'. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> io @ [(x, y)] \<in> L P; \<And>q P io x y y'. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> L M'; ?pR \<in> RP M (target (FSM.initial M) pP) ?q' pP pM prs M'\<rbrakk> \<Longrightarrow> \<exists>q. io_targets M' (p_io ?pR) (FSM.initial M') = {q}
\<lbrakk>\<And>q P. (q, P) \<in> prs \<Longrightarrow> (q, P) \<in> prs; \<And>q P io x y y'. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> (q, P) \<in> prs; \<And>q P io x y y'. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> io @ [(x, y)] \<in> L P; \<And>q P io x y y'. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> L M'; ?pR1.0 \<in> RP M (target (FSM.initial M) pP) ?q' pP pM prs M'; ?pR2.0 \<in> RP M (target (FSM.initial M) pP) ?q' pP pM prs M'; ?pR1.0 \<noteq> ?pR2.0\<rbrakk> \<Longrightarrow> io_targets M' (p_io ?pR1.0) (FSM.initial M') \<inter> io_targets M' (p_io ?pR2.0) (FSM.initial M') = {}

goal (1 subgoal):
 1. (\<And>q'. card (\<Union>pR\<in>RP M (target (FSM.initial M) pP) q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) = card (RP M (target (FSM.initial M) pP) q' pP pM prs M')) &&& (\<And>q' pR. pR \<in> RP M (target (FSM.initial M) pP) q' pP pM prs M' \<Longrightarrow> \<exists>q. io_targets M' (p_io pR) (FSM.initial M') = {q}) &&& (\<And>q' pR1 pR2. \<lbrakk>pR1 \<in> RP M (target (FSM.initial M) pP) q' pP pM prs M'; pR2 \<in> RP M (target (FSM.initial M) pP) q' pP pM prs M'; pR1 \<noteq> pR2\<rbrakk> \<Longrightarrow> io_targets M' (p_io pR1) (FSM.initial M') \<inter> io_targets M' (p_io pR2) (FSM.initial M') = {})
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
card (\<Union>pR\<in>RP M (target (FSM.initial M) pP) ?q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) = card (RP M (target (FSM.initial M) pP) ?q' pP pM prs M')
?pR \<in> RP M (target (FSM.initial M) pP) ?q' pP pM prs M' \<Longrightarrow> \<exists>q. io_targets M' (p_io ?pR) (FSM.initial M') = {q}
\<lbrakk>?pR1.0 \<in> RP M (target (FSM.initial M) pP) ?q' pP pM prs M'; ?pR2.0 \<in> RP M (target (FSM.initial M) pP) ?q' pP pM prs M'; ?pR1.0 \<noteq> ?pR2.0\<rbrakk> \<Longrightarrow> io_targets M' (p_io ?pR1.0) (FSM.initial M') \<inter> io_targets M' (p_io ?pR2.0) (FSM.initial M') = {}

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have snd_dM_prop: "\<And> q' . q' \<in> snd dM \<Longrightarrow> (\<Union> pR \<in> (RP M q q' pP pM prs M') . io_targets M' (p_io pR) (initial M')) \<noteq> (\<Union> pR \<in> (R M q q' pP pM) . io_targets M' (p_io pR) (initial M'))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
fix q'
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
assume "q' \<in> snd dM"
[PROOF STATE]
proof (state)
this:
q' \<in> snd dM

goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
let ?RP = "(RP M q q' pP pM prs M')"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
let ?R  = "(R M q q' pP pM)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
let ?P  = "\<lambda> pP' . \<exists>P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') pP' \<and> target (FSM.initial P') pP' = q' \<and> p_io pP' \<in> L M'"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
obtain PQ where "(q',PQ) \<in> prs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>PQ. (q', PQ) \<in> prs \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<open>q' \<in> snd dM\<close> t8'[OF \<open>dM \<in> set repetition_sets\<close>]
[PROOF STATE]
proof (prove)
using this:
q' \<in> snd dM
snd dM = fst dM \<inter> fst ` prs

goal (1 subgoal):
 1. (\<And>PQ. (q', PQ) \<in> prs \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(q', PQ) \<in> prs

goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(q', PQ) \<in> prs
[PROOF STEP]
have "is_preamble PQ M q'" and "\<exists>P'. (q', P') \<in> prs"
[PROOF STATE]
proof (prove)
using this:
(q', PQ) \<in> prs

goal (1 subgoal):
 1. is_preamble PQ M q' &&& \<exists>P'. (q', P') \<in> prs
[PROOF STEP]
using t2
[PROOF STATE]
proof (prove)
using this:
(q', PQ) \<in> prs
(?q, ?P) \<in> prs \<Longrightarrow> is_preamble ?P M ?q

goal (1 subgoal):
 1. is_preamble PQ M q' &&& \<exists>P'. (q', P') \<in> prs
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
is_preamble PQ M q'
\<exists>P'. (q', P') \<in> prs

goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
obtain pq where "path PQ (initial PQ) pq" and "target (initial PQ) pq = q'" and "p_io pq \<in> L M'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>pq. \<lbrakk>path PQ (FSM.initial PQ) pq; target (FSM.initial PQ) pq = q'; p_io pq \<in> L M'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using preamble_pass_path[OF \<open>is_preamble PQ M q'\<close> pass1[OF \<open>(q',PQ) \<in> prs\<close>] \<open>completely_specified M'\<close> \<open>inputs M' = inputs M\<close>]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> L PQ; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> io @ [(x, ?y1 io x y y')] \<in> L PQ; \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> L PQ; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> L M'; \<And>p. \<lbrakk>path PQ (FSM.initial PQ) p; target (FSM.initial PQ) p = q'; p_io p \<in> L M'\<rbrakk> \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. (\<And>pq. \<lbrakk>path PQ (FSM.initial PQ) pq; target (FSM.initial PQ) pq = q'; p_io pq \<in> L M'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
path PQ (FSM.initial PQ) pq
target (FSM.initial PQ) pq = q'
p_io pq \<in> L M'

goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
path PQ (FSM.initial PQ) pq
target (FSM.initial PQ) pq = q'
p_io pq \<in> L M'
[PROOF STEP]
have "\<exists> pP' . ?P pP'"
[PROOF STATE]
proof (prove)
using this:
path PQ (FSM.initial PQ) pq
target (FSM.initial PQ) pq = q'
p_io pq \<in> L M'

goal (1 subgoal):
 1. \<exists>pP' P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') pP' \<and> target (FSM.initial P') pP' = q' \<and> p_io pP' \<in> L M'
[PROOF STEP]
using \<open>(q',PQ) \<in> prs\<close>
[PROOF STATE]
proof (prove)
using this:
path PQ (FSM.initial PQ) pq
target (FSM.initial PQ) pq = q'
p_io pq \<in> L M'
(q', PQ) \<in> prs

goal (1 subgoal):
 1. \<exists>pP' P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') pP' \<and> target (FSM.initial P') pP' = q' \<and> p_io pP' \<in> L M'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>pP' P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') pP' \<and> target (FSM.initial P') pP' = q' \<and> p_io pP' \<in> L M'

goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
define pPQ where pPQ_def: "pPQ = (SOME pP'. ?P pP')"
[PROOF STATE]
proof (state)
this:
pPQ = (SOME pP'. \<exists>P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') pP' \<and> target (FSM.initial P') pP' = q' \<and> p_io pP' \<in> L M')

goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
have "?P pPQ"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') pPQ \<and> target (FSM.initial P') pPQ = q' \<and> p_io pPQ \<in> L M'
[PROOF STEP]
unfolding pPQ_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') (SOME pP'. \<exists>P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') pP' \<and> target (FSM.initial P') pP' = q' \<and> p_io pP' \<in> L M') \<and> target (FSM.initial P') (SOME pP'. \<exists>P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') pP' \<and> target (FSM.initial P') pP' = q' \<and> p_io pP' \<in> L M') = q' \<and> p_io (SOME pP'. \<exists>P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') pP' \<and> target (FSM.initial P') pP' = q' \<and> p_io pP' \<in> L M') \<in> L M'
[PROOF STEP]
using someI_ex[OF \<open>\<exists> pP' . ?P pP'\<close>]
[PROOF STATE]
proof (prove)
using this:
\<exists>P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') (SOME x. \<exists>P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') x \<and> target (FSM.initial P') x = q' \<and> p_io x \<in> L M') \<and> target (FSM.initial P') (SOME x. \<exists>P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') x \<and> target (FSM.initial P') x = q' \<and> p_io x \<in> L M') = q' \<and> p_io (SOME x. \<exists>P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') x \<and> target (FSM.initial P') x = q' \<and> p_io x \<in> L M') \<in> L M'

goal (1 subgoal):
 1. \<exists>P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') (SOME pP'. \<exists>P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') pP' \<and> target (FSM.initial P') pP' = q' \<and> p_io pP' \<in> L M') \<and> target (FSM.initial P') (SOME pP'. \<exists>P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') pP' \<and> target (FSM.initial P') pP' = q' \<and> p_io pP' \<in> L M') = q' \<and> p_io (SOME pP'. \<exists>P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') pP' \<and> target (FSM.initial P') pP' = q' \<and> p_io pP' \<in> L M') \<in> L M'
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
\<exists>P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') pPQ \<and> target (FSM.initial P') pPQ = q' \<and> p_io pPQ \<in> L M'

goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') pPQ \<and> target (FSM.initial P') pPQ = q' \<and> p_io pPQ \<in> L M'
[PROOF STEP]
obtain PQ' where "(q',PQ') \<in> prs"
                      and "path PQ' (initial PQ') pPQ"
                      and "target (initial PQ') pPQ = q'"
                      and "p_io pPQ \<in> L M'"
[PROOF STATE]
proof (prove)
using this:
\<exists>P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') pPQ \<and> target (FSM.initial P') pPQ = q' \<and> p_io pPQ \<in> L M'

goal (1 subgoal):
 1. (\<And>PQ'. \<lbrakk>(q', PQ') \<in> prs; path PQ' (FSM.initial PQ') pPQ; target (FSM.initial PQ') pPQ = q'; p_io pPQ \<in> L M'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(q', PQ') \<in> prs
path PQ' (FSM.initial PQ') pPQ
target (FSM.initial PQ') pPQ = q'
p_io pPQ \<in> L M'

goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
have "?RP = insert pPQ (R M q q' pP pM)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. RP M q q' pP pM prs M' = insert pPQ (R M q q' pP pM)
[PROOF STEP]
unfolding RP_def pPQ_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if \<exists>P'. (q', P') \<in> prs then insert (SOME pP'. \<exists>P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') pP' \<and> target (FSM.initial P') pP' = q' \<and> p_io pP' \<in> L M') (R M q q' pP pM) else R M q q' pP pM) = insert (SOME pP'. \<exists>P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') pP' \<and> target (FSM.initial P') pP' = q' \<and> p_io pP' \<in> L M') (R M q q' pP pM)
[PROOF STEP]
using \<open>\<exists>P'. (q', P') \<in> prs\<close>
[PROOF STATE]
proof (prove)
using this:
\<exists>P'. (q', P') \<in> prs

goal (1 subgoal):
 1. (if \<exists>P'. (q', P') \<in> prs then insert (SOME pP'. \<exists>P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') pP' \<and> target (FSM.initial P') pP' = q' \<and> p_io pP' \<in> L M') (R M q q' pP pM) else R M q q' pP pM) = insert (SOME pP'. \<exists>P'. (q', P') \<in> prs \<and> path P' (FSM.initial P') pP' \<and> target (FSM.initial P') pP' = q' \<and> p_io pP' \<in> L M') (R M q q' pP pM)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
RP M q q' pP pM prs M' = insert pPQ (R M q q' pP pM)

goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
obtain pPQ' where "path M' (initial M') pPQ'" and "p_io pPQ' = p_io pPQ"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>pPQ'. \<lbrakk>path M' (FSM.initial M') pPQ'; p_io pPQ' = p_io pPQ\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<open>p_io pPQ \<in> L M'\<close>
[PROOF STATE]
proof (prove)
using this:
p_io pPQ \<in> L M'

goal (1 subgoal):
 1. (\<And>pPQ'. \<lbrakk>path M' (FSM.initial M') pPQ'; p_io pPQ' = p_io pPQ\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
path M' (FSM.initial M') pPQ'
p_io pPQ' = p_io pPQ

goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
path M' (FSM.initial M') pPQ'
p_io pPQ' = p_io pPQ
[PROOF STEP]
have "io_targets M' (p_io pPQ) (initial M') = {target (initial M') pPQ'}"
[PROOF STATE]
proof (prove)
using this:
path M' (FSM.initial M') pPQ'
p_io pPQ' = p_io pPQ

goal (1 subgoal):
 1. io_targets M' (p_io pPQ) (FSM.initial M') = {target (FSM.initial M') pPQ'}
[PROOF STEP]
using \<open>observable M'\<close>
[PROOF STATE]
proof (prove)
using this:
path M' (FSM.initial M') pPQ'
p_io pPQ' = p_io pPQ
observable M'

goal (1 subgoal):
 1. io_targets M' (p_io pPQ) (FSM.initial M') = {target (FSM.initial M') pPQ'}
[PROOF STEP]
by (metis (mono_tags, lifting) observable_path_io_target)
[PROOF STATE]
proof (state)
this:
io_targets M' (p_io pPQ) (FSM.initial M') = {target (FSM.initial M') pPQ'}

goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
io_targets M' (p_io pPQ) (FSM.initial M') = {target (FSM.initial M') pPQ'}

goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
have "target (initial M') pPQ' \<notin> (\<Union> (image (\<lambda> pR . io_targets M' (p_io pR) (initial M')) ?R))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<notin> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) \<Longrightarrow> False
[PROOF STEP]
assume "target (initial M') pPQ' \<in> (\<Union> (image (\<lambda> pR . io_targets M' (p_io pR) (initial M')) ?R))"
[PROOF STATE]
proof (state)
this:
target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))

goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
obtain pR where "pR \<in> ?R" and "target (initial M') pPQ' \<in> io_targets M' (p_io pR) (initial M')"
[PROOF STATE]
proof (prove)
using this:
target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))

goal (1 subgoal):
 1. (\<And>pR. \<lbrakk>pR \<in> R M q q' pP pM; target (FSM.initial M') pPQ' \<in> io_targets M' (p_io pR) (FSM.initial M')\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
pR \<in> R M q q' pP pM
target (FSM.initial M') pPQ' \<in> io_targets M' (p_io pR) (FSM.initial M')

goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) \<Longrightarrow> False
[PROOF STEP]
obtain pR' where "pR = pP@pR'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>pR'. pR = pP @ pR' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using R_component_ob[OF \<open>pR \<in> ?R\<close>]
[PROOF STATE]
proof (prove)
using this:
(\<And>pRa. pR = pP @ pRa \<Longrightarrow> ?thesis) \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. (\<And>pR'. pR = pP @ pR' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
pR = pP @ pR'

goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
pR = pP @ pR'
[PROOF STEP]
have "pP@pR' \<in> ?R"
[PROOF STATE]
proof (prove)
using this:
pR = pP @ pR'

goal (1 subgoal):
 1. pP @ pR' \<in> R M q q' pP pM
[PROOF STEP]
using \<open>pR \<in> ?R\<close>
[PROOF STATE]
proof (prove)
using this:
pR = pP @ pR'
pR \<in> R M q q' pP pM

goal (1 subgoal):
 1. pP @ pR' \<in> R M q q' pP pM
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
pP @ pR' \<in> R M q q' pP pM

goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) \<Longrightarrow> False
[PROOF STEP]
have "pR' = take (length pR') pM"
       and "length pR' \<le> length pM"
       and "t_target (pM ! (length pR' - 1)) = q'"
       and "pR' \<noteq> []"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (pR' = take (length pR') pM &&& length pR' \<le> length pM) &&& t_target (pM ! (length pR' - 1)) = q' &&& pR' \<noteq> []
[PROOF STEP]
using R_component[OF \<open>pP@pR' \<in> ?R\<close>]
[PROOF STATE]
proof (prove)
using this:
pR' = take (length pR') pM
length pR' \<le> length pM
t_target (pM ! (length pR' - 1)) = q'
pR' \<noteq> []

goal (1 subgoal):
 1. (pR' = take (length pR') pM &&& length pR' \<le> length pM) &&& t_target (pM ! (length pR' - 1)) = q' &&& pR' \<noteq> []
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
pR' = take (length pR') pM
length pR' \<le> length pM
t_target (pM ! (length pR' - 1)) = q'
pR' \<noteq> []

goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) \<Longrightarrow> False
[PROOF STEP]
(* get the full path along (butlast io) in M, of which p is a (possibly proper) prefix *)
[PROOF STATE]
proof (state)
this:
pR' = take (length pR') pM
length pR' \<le> length pM
t_target (pM ! (length pR' - 1)) = q'
pR' \<noteq> []

goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) \<Longrightarrow> False
[PROOF STEP]
obtain pX where "path M (target (initial M) pP) (pM@pX)" and "p_io (pM@pX) = butlast io"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>pX. \<lbrakk>path M (target (FSM.initial M) pP) (pM @ pX); p_io (pM @ pX) = butlast io\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<And>pX. \<lbrakk>path M (target (FSM.initial M) pP) (pM @ pX); p_io (pM @ pX) = butlast io\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
have "p_io pP @ p_io pM @ ioX \<in> L M"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p_io pP @ p_io pM @ ioX \<in> L M
[PROOF STEP]
using \<open>((p_io pP) @ butlast io) \<in> L M\<close>
[PROOF STATE]
proof (prove)
using this:
p_io pP @ butlast io \<in> L M

goal (1 subgoal):
 1. p_io pP @ p_io pM @ ioX \<in> L M
[PROOF STEP]
unfolding \<open>butlast io = p_io pM @ ioX\<close>
[PROOF STATE]
proof (prove)
using this:
p_io pP @ p_io pM @ ioX \<in> L M

goal (1 subgoal):
 1. p_io pP @ p_io pM @ ioX \<in> L M
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
p_io pP @ p_io pM @ ioX \<in> L M

goal (1 subgoal):
 1. (\<And>pX. \<lbrakk>path M (target (FSM.initial M) pP) (pM @ pX); p_io (pM @ pX) = butlast io\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
obtain p1 p23 where "path M (FSM.initial M) p1"
                        and "path M (target (FSM.initial M) p1) p23"
                        and "p_io p1 = p_io pP"
                        and "p_io p23 = p_io pM @ ioX"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>p1 p23. \<lbrakk>path M (FSM.initial M) p1; path M (target (FSM.initial M) p1) p23; p_io p1 = p_io pP; p_io p23 = p_io pM @ ioX\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using language_state_split[OF \<open>p_io pP @ p_io pM @ ioX \<in> L M\<close>]
[PROOF STATE]
proof (prove)
using this:
(\<And>p1 p2. \<lbrakk>path M (FSM.initial M) p1; path M (target (FSM.initial M) p1) p2; p_io p1 = p_io pP; p_io p2 = p_io pM @ ioX\<rbrakk> \<Longrightarrow> ?thesis) \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. (\<And>p1 p23. \<lbrakk>path M (FSM.initial M) p1; path M (target (FSM.initial M) p1) p23; p_io p1 = p_io pP; p_io p23 = p_io pM @ ioX\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
path M (FSM.initial M) p1
path M (target (FSM.initial M) p1) p23
p_io p1 = p_io pP
p_io p23 = p_io pM @ ioX

goal (1 subgoal):
 1. (\<And>pX. \<lbrakk>path M (target (FSM.initial M) pP) (pM @ pX); p_io (pM @ pX) = butlast io\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
have "p1 = pP"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p1 = pP
[PROOF STEP]
using observable_path_unique[OF \<open>observable M\<close> \<open>path M (FSM.initial M) p1\<close> \<open>path M (FSM.initial M) pP\<close> \<open>p_io p1 = p_io pP\<close>]
[PROOF STATE]
proof (prove)
using this:
p1 = pP

goal (1 subgoal):
 1. p1 = pP
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
p1 = pP

goal (1 subgoal):
 1. (\<And>pX. \<lbrakk>path M (target (FSM.initial M) pP) (pM @ pX); p_io (pM @ pX) = butlast io\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
p1 = pP
[PROOF STEP]
have "path M (target (FSM.initial M) pP) p23"
[PROOF STATE]
proof (prove)
using this:
p1 = pP

goal (1 subgoal):
 1. path M (target (FSM.initial M) pP) p23
[PROOF STEP]
using \<open>path M (target (FSM.initial M) p1) p23\<close>
[PROOF STATE]
proof (prove)
using this:
p1 = pP
path M (target (FSM.initial M) p1) p23

goal (1 subgoal):
 1. path M (target (FSM.initial M) pP) p23
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
path M (target (FSM.initial M) pP) p23

goal (1 subgoal):
 1. (\<And>pX. \<lbrakk>path M (target (FSM.initial M) pP) (pM @ pX); p_io (pM @ pX) = butlast io\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
path M (target (FSM.initial M) pP) p23
[PROOF STEP]
have "p_io pM @ ioX \<in> LS M (target (initial M) pP)"
[PROOF STATE]
proof (prove)
using this:
path M (target (FSM.initial M) pP) p23

goal (1 subgoal):
 1. p_io pM @ ioX \<in> LS M (target (FSM.initial M) pP)
[PROOF STEP]
using \<open>p_io p23 = p_io pM @ ioX\<close> language_state_containment
[PROOF STATE]
proof (prove)
using this:
path M (target (FSM.initial M) pP) p23
p_io p23 = p_io pM @ ioX
\<lbrakk>path ?M ?q ?p; p_io ?p = ?io\<rbrakk> \<Longrightarrow> ?io \<in> LS ?M ?q

goal (1 subgoal):
 1. p_io pM @ ioX \<in> LS M (target (FSM.initial M) pP)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
p_io pM @ ioX \<in> LS M (target (FSM.initial M) pP)

goal (1 subgoal):
 1. (\<And>pX. \<lbrakk>path M (target (FSM.initial M) pP) (pM @ pX); p_io (pM @ pX) = butlast io\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
obtain p2 p3 where "path M (target (FSM.initial M) pP) p2"
                       and "path M (target (target (FSM.initial M) pP) p2) p3"
                       and "p_io p2 = p_io pM"
                       and "p_io p3 = ioX"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>p2 p3. \<lbrakk>path M (target (FSM.initial M) pP) p2; path M (target (target (FSM.initial M) pP) p2) p3; p_io p2 = p_io pM; p_io p3 = ioX\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using language_state_split[OF \<open>p_io pM @ ioX \<in> LS M (target (initial M) pP)\<close>]
[PROOF STATE]
proof (prove)
using this:
(\<And>p1 p2. \<lbrakk>path M (target (FSM.initial M) pP) p1; path M (target (target (FSM.initial M) pP) p1) p2; p_io p1 = p_io pM; p_io p2 = ioX\<rbrakk> \<Longrightarrow> ?thesis) \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. (\<And>p2 p3. \<lbrakk>path M (target (FSM.initial M) pP) p2; path M (target (target (FSM.initial M) pP) p2) p3; p_io p2 = p_io pM; p_io p3 = ioX\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
path M (target (FSM.initial M) pP) p2
path M (target (target (FSM.initial M) pP) p2) p3
p_io p2 = p_io pM
p_io p3 = ioX

goal (1 subgoal):
 1. (\<And>pX. \<lbrakk>path M (target (FSM.initial M) pP) (pM @ pX); p_io (pM @ pX) = butlast io\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
have "p2 = pM"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p2 = pM
[PROOF STEP]
using observable_path_unique[OF \<open>observable M\<close> \<open>path M (target (FSM.initial M) pP) p2\<close>
                                          \<open>path M (target (FSM.initial M) pP) pM\<close> \<open>p_io p2 = p_io pM\<close>]
[PROOF STATE]
proof (prove)
using this:
p2 = pM

goal (1 subgoal):
 1. p2 = pM
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
p2 = pM

goal (1 subgoal):
 1. (\<And>pX. \<lbrakk>path M (target (FSM.initial M) pP) (pM @ pX); p_io (pM @ pX) = butlast io\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
p2 = pM
[PROOF STEP]
have "path M (target (FSM.initial M) pP) (pM@p3)"
[PROOF STATE]
proof (prove)
using this:
p2 = pM

goal (1 subgoal):
 1. path M (target (FSM.initial M) pP) (pM @ p3)
[PROOF STEP]
using \<open>path M (target (FSM.initial M) pP) pM\<close> \<open>path M (target (target (FSM.initial M) pP) p2) p3\<close>
[PROOF STATE]
proof (prove)
using this:
p2 = pM
path M (target (FSM.initial M) pP) pM
path M (target (target (FSM.initial M) pP) p2) p3

goal (1 subgoal):
 1. path M (target (FSM.initial M) pP) (pM @ p3)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
path M (target (FSM.initial M) pP) (pM @ p3)

goal (1 subgoal):
 1. (\<And>pX. \<lbrakk>path M (target (FSM.initial M) pP) (pM @ pX); p_io (pM @ pX) = butlast io\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
path M (target (FSM.initial M) pP) (pM @ p3)

goal (1 subgoal):
 1. (\<And>pX. \<lbrakk>path M (target (FSM.initial M) pP) (pM @ pX); p_io (pM @ pX) = butlast io\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
have "p_io (pM@p3) = butlast io"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p_io (pM @ p3) = butlast io
[PROOF STEP]
unfolding \<open>butlast io = p_io pM @ ioX\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p_io (pM @ p3) = p_io pM @ ioX
[PROOF STEP]
using \<open>p_io p3 = ioX\<close>
[PROOF STATE]
proof (prove)
using this:
p_io p3 = ioX

goal (1 subgoal):
 1. p_io (pM @ p3) = p_io pM @ ioX
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
p_io (pM @ p3) = butlast io

goal (1 subgoal):
 1. (\<And>pX. \<lbrakk>path M (target (FSM.initial M) pP) (pM @ pX); p_io (pM @ pX) = butlast io\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
path M (target (FSM.initial M) pP) (pM @ p3)
p_io (pM @ p3) = butlast io
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
path M (target (FSM.initial M) pP) (pM @ p3)
p_io (pM @ p3) = butlast io

goal (1 subgoal):
 1. thesis
[PROOF STEP]
using that[of p3]
[PROOF STATE]
proof (prove)
using this:
path M (target (FSM.initial M) pP) (pM @ p3)
p_io (pM @ p3) = butlast io
\<lbrakk>path M (target (FSM.initial M) pP) (pM @ p3); p_io (pM @ p3) = butlast io\<rbrakk> \<Longrightarrow> thesis

goal (1 subgoal):
 1. thesis
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
thesis

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
path M (target (FSM.initial M) pP) (pM @ pX)
p_io (pM @ pX) = butlast io

goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) \<Longrightarrow> False
[PROOF STEP]
obtain pP' pIO where "path M' (FSM.initial M') pP'"
                       and "path M' (target (FSM.initial M') pP') pIO"
                       and "p_io pP' = p_io pP"
                       and "p_io pIO = io"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>pP' pIO. \<lbrakk>path M' (FSM.initial M') pP'; path M' (target (FSM.initial M') pP') pIO; p_io pP' = p_io pP; p_io pIO = io\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using language_state_split[OF \<open>((p_io pP) @ io) \<in> L M'\<close>]
[PROOF STATE]
proof (prove)
using this:
(\<And>p1 p2. \<lbrakk>path M' (FSM.initial M') p1; path M' (target (FSM.initial M') p1) p2; p_io p1 = p_io pP; p_io p2 = io\<rbrakk> \<Longrightarrow> ?thesis) \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. (\<And>pP' pIO. \<lbrakk>path M' (FSM.initial M') pP'; path M' (target (FSM.initial M') pP') pIO; p_io pP' = p_io pP; p_io pIO = io\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
path M' (FSM.initial M') pP'
path M' (target (FSM.initial M') pP') pIO
p_io pP' = p_io pP
p_io pIO = io

goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) \<Longrightarrow> False
[PROOF STEP]
have "target (initial M') pP' \<in> io_targets M' (p_io pP) (FSM.initial M')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. target (FSM.initial M') pP' \<in> io_targets M' (p_io pP) (FSM.initial M')
[PROOF STEP]
using \<open>path M' (FSM.initial M') pP'\<close>
[PROOF STATE]
proof (prove)
using this:
path M' (FSM.initial M') pP'

goal (1 subgoal):
 1. target (FSM.initial M') pP' \<in> io_targets M' (p_io pP) (FSM.initial M')
[PROOF STEP]
unfolding \<open>p_io pP' = p_io pP\<close>[symmetric]
[PROOF STATE]
proof (prove)
using this:
path M' (FSM.initial M') pP'

goal (1 subgoal):
 1. target (FSM.initial M') pP' \<in> io_targets M' (p_io pP') (FSM.initial M')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
target (FSM.initial M') pP' \<in> io_targets M' (p_io pP) (FSM.initial M')

goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) \<Longrightarrow> False
[PROOF STEP]
let ?i = "length pR' - 1"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) \<Longrightarrow> False
[PROOF STEP]
have "?i < length pR'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length pR' - 1 < length pR'
[PROOF STEP]
using \<open>pR' \<noteq> []\<close>
[PROOF STATE]
proof (prove)
using this:
pR' \<noteq> []

goal (1 subgoal):
 1. length pR' - 1 < length pR'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
length pR' - 1 < length pR'

goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) \<Longrightarrow> False
[PROOF STEP]
have "?i < length (butlast io)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length pR' - 1 < length (butlast io)
[PROOF STEP]
using \<open>pR' = take (length pR') pM\<close> \<open>pR' \<noteq> []\<close>
[PROOF STATE]
proof (prove)
using this:
pR' = take (length pR') pM
pR' \<noteq> []

goal (1 subgoal):
 1. length pR' - 1 < length (butlast io)
[PROOF STEP]
unfolding \<open>p_io (pM@pX) = butlast io\<close>[symmetric]
[PROOF STATE]
proof (prove)
using this:
pR' = take (length pR') pM
pR' \<noteq> []

goal (1 subgoal):
 1. length pR' - 1 < length (p_io (pM @ pX))
[PROOF STEP]
using leI
[PROOF STATE]
proof (prove)
using this:
pR' = take (length pR') pM
pR' \<noteq> []
\<not> ?x < ?y \<Longrightarrow> ?y \<le> ?x

goal (1 subgoal):
 1. length pR' - 1 < length (p_io (pM @ pX))
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
length pR' - 1 < length (butlast io)

goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) \<Longrightarrow> False
[PROOF STEP]
have "t_target ((pM @ pX) ! (length pR' - 1)) = q'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. t_target ((pM @ pX) ! (length pR' - 1)) = q'
[PROOF STEP]
by (metis \<open>length pR' - 1 < length pR'\<close> \<open>length pR' \<le> length pM\<close> \<open>t_target (pM ! (length pR' - 1)) = q'\<close>
              dual_order.strict_trans1 nth_append)
[PROOF STATE]
proof (state)
this:
t_target ((pM @ pX) ! (length pR' - 1)) = q'

goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
t_target ((pM @ pX) ! (length pR' - 1)) = q'
[PROOF STEP]
have "(t_target ((pM @ pX) ! (length pR' - 1)), PQ') \<in> prs"
[PROOF STATE]
proof (prove)
using this:
t_target ((pM @ pX) ! (length pR' - 1)) = q'

goal (1 subgoal):
 1. (t_target ((pM @ pX) ! (length pR' - 1)), PQ') \<in> prs
[PROOF STEP]
using \<open>(q',PQ') \<in> prs\<close>
[PROOF STATE]
proof (prove)
using this:
t_target ((pM @ pX) ! (length pR' - 1)) = q'
(q', PQ') \<in> prs

goal (1 subgoal):
 1. (t_target ((pM @ pX) ! (length pR' - 1)), PQ') \<in> prs
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(t_target ((pM @ pX) ! (length pR' - 1)), PQ') \<in> prs

goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) \<Longrightarrow> False
[PROOF STEP]
have "target (FSM.initial PQ') pPQ = t_target ((pM @ pX) ! (length pR' - 1))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. target (FSM.initial PQ') pPQ = t_target ((pM @ pX) ! (length pR' - 1))
[PROOF STEP]
using \<open>t_target ((pM @ pX) ! (length pR' - 1)) = q'\<close> \<open>target (FSM.initial PQ') pPQ = q'\<close>
[PROOF STATE]
proof (prove)
using this:
t_target ((pM @ pX) ! (length pR' - 1)) = q'
target (FSM.initial PQ') pPQ = q'

goal (1 subgoal):
 1. target (FSM.initial PQ') pPQ = t_target ((pM @ pX) ! (length pR' - 1))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
target (FSM.initial PQ') pPQ = t_target ((pM @ pX) ! (length pR' - 1))

goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) \<Longrightarrow> False
[PROOF STEP]
have "t_target (pIO ! ?i) \<notin> io_targets M' (p_io pPQ) (FSM.initial M')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. t_target (pIO ! (length pR' - 1)) \<notin> io_targets M' (p_io pPQ) (FSM.initial M')
[PROOF STEP]
using minimal_sequence_to_failure_extending_preamble_no_repetitions_with_other_preambles
          [OF \<open>minimal_sequence_to_failure_extending_preamble_path M M' prs pP io\<close> \<open>observable M\<close> \<open>
              path M (target (initial M) pP) (pM@pX)\<close> \<open>p_io (pM@pX) = butlast io\<close>
              \<open>target (initial M') pP' \<in> io_targets M' (p_io pP) (FSM.initial M')\<close>
              \<open>path M' (target (FSM.initial M') pP') pIO\<close> \<open>p_io pIO = io\<close> t2
              \<open>?i < length (butlast io)\<close> \<open>(t_target ((pM @ pX) ! (length pR' - 1)), PQ') \<in> prs\<close>
              \<open>path PQ' (initial PQ') pPQ\<close> \<open>target (FSM.initial PQ') pPQ = t_target ((pM @ pX) ! (length pR' - 1))\<close>]
[PROOF STATE]
proof (prove)
using this:
(\<And>q P. (q, P) \<in> prs \<Longrightarrow> (q, P) \<in> prs) \<Longrightarrow> t_target (pIO ! (length pR' - 1)) \<notin> io_targets M' (p_io pPQ) (FSM.initial M')

goal (1 subgoal):
 1. t_target (pIO ! (length pR' - 1)) \<notin> io_targets M' (p_io pPQ) (FSM.initial M')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
t_target (pIO ! (length pR' - 1)) \<notin> io_targets M' (p_io pPQ) (FSM.initial M')

goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
t_target (pIO ! (length pR' - 1)) \<notin> io_targets M' (p_io pPQ) (FSM.initial M')

goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) \<Longrightarrow> False
[PROOF STEP]
have "io_targets M' (p_io pPQ) (FSM.initial M') = {target (initial M') pPQ'}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. io_targets M' (p_io pPQ) (FSM.initial M') = {target (FSM.initial M') pPQ'}
[PROOF STEP]
using \<open>path M' (initial M') pPQ'\<close>
[PROOF STATE]
proof (prove)
using this:
path M' (FSM.initial M') pPQ'

goal (1 subgoal):
 1. io_targets M' (p_io pPQ) (FSM.initial M') = {target (FSM.initial M') pPQ'}
[PROOF STEP]
using \<open>io_targets M' (p_io pPQ) (FSM.initial M') = {target (FSM.initial M') pPQ'}\<close> \<open>p_io pPQ' = p_io pPQ\<close>
[PROOF STATE]
proof (prove)
using this:
path M' (FSM.initial M') pPQ'
io_targets M' (p_io pPQ) (FSM.initial M') = {target (FSM.initial M') pPQ'}
p_io pPQ' = p_io pPQ

goal (1 subgoal):
 1. io_targets M' (p_io pPQ) (FSM.initial M') = {target (FSM.initial M') pPQ'}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
io_targets M' (p_io pPQ) (FSM.initial M') = {target (FSM.initial M') pPQ'}

goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
io_targets M' (p_io pPQ) (FSM.initial M') = {target (FSM.initial M') pPQ'}

goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) \<Longrightarrow> False
[PROOF STEP]
have "io_targets M' (p_io (pP@pR')) (FSM.initial M') = {t_target (pIO ! ?i)}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {t_target (pIO ! (length pR' - 1))}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {t_target (pIO ! (length pR' - 1))}
[PROOF STEP]
have "(take (length pR') pIO) \<noteq> []"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. take (length pR') pIO \<noteq> []
[PROOF STEP]
using \<open>p_io pIO = io\<close> \<open>?i < length pR'\<close>
[PROOF STATE]
proof (prove)
using this:
p_io pIO = io
length pR' - 1 < length pR'

goal (1 subgoal):
 1. take (length pR') pIO \<noteq> []
[PROOF STEP]
using \<open>io = p_io pM @ ioEx\<close> \<open>pR' = take (length pR') pM\<close>
[PROOF STATE]
proof (prove)
using this:
p_io pIO = io
length pR' - 1 < length pR'
io = p_io pM @ ioEx
pR' = take (length pR') pM

goal (1 subgoal):
 1. take (length pR') pIO \<noteq> []
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
take (length pR') pIO \<noteq> []

goal (1 subgoal):
 1. io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {t_target (pIO ! (length pR' - 1))}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
take (length pR') pIO \<noteq> []

goal (1 subgoal):
 1. io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {t_target (pIO ! (length pR' - 1))}
[PROOF STEP]
have "pIO ! ?i = last (take (length pR') pIO)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pIO ! (length pR' - 1) = last (take (length pR') pIO)
[PROOF STEP]
using \<open>p_io pIO = io\<close> \<open>?i < length pR'\<close>
[PROOF STATE]
proof (prove)
using this:
p_io pIO = io
length pR' - 1 < length pR'

goal (1 subgoal):
 1. pIO ! (length pR' - 1) = last (take (length pR') pIO)
[PROOF STEP]
by (metis (no_types, lifting) \<open>io = p_io pM @ ioEx\<close> \<open>length pR' \<le> length pM\<close> \<open>pR' = take (length pR') pM\<close>
                butlast.simps(1) last_conv_nth length_butlast length_map neq_iff nth_take take_le take_map)
[PROOF STATE]
proof (state)
this:
pIO ! (length pR' - 1) = last (take (length pR') pIO)

goal (1 subgoal):
 1. io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {t_target (pIO ! (length pR' - 1))}
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
take (length pR') pIO \<noteq> []
pIO ! (length pR' - 1) = last (take (length pR') pIO)
[PROOF STEP]
have "t_target (pIO ! ?i) = target (target (FSM.initial M') pP') (take (length pR') pIO)"
[PROOF STATE]
proof (prove)
using this:
take (length pR') pIO \<noteq> []
pIO ! (length pR' - 1) = last (take (length pR') pIO)

goal (1 subgoal):
 1. t_target (pIO ! (length pR' - 1)) = target (target (FSM.initial M') pP') (take (length pR') pIO)
[PROOF STEP]
unfolding target.simps visited_states.simps
[PROOF STATE]
proof (prove)
using this:
take (length pR') pIO \<noteq> []
pIO ! (length pR' - 1) = last (take (length pR') pIO)

goal (1 subgoal):
 1. t_target (pIO ! (length pR' - 1)) = last (last (FSM.initial M' # map t_target pP') # map t_target (take (length pR') pIO))
[PROOF STEP]
by (simp add: last_map)
[PROOF STATE]
proof (state)
this:
t_target (pIO ! (length pR' - 1)) = target (target (FSM.initial M') pP') (take (length pR') pIO)

goal (1 subgoal):
 1. io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {t_target (pIO ! (length pR' - 1))}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
t_target (pIO ! (length pR' - 1)) = target (target (FSM.initial M') pP') (take (length pR') pIO)
[PROOF STEP]
have "t_target (pIO ! ?i) = target (initial M') (pP' @ (take (length pR') pIO))"
[PROOF STATE]
proof (prove)
using this:
t_target (pIO ! (length pR' - 1)) = target (target (FSM.initial M') pP') (take (length pR') pIO)

goal (1 subgoal):
 1. t_target (pIO ! (length pR' - 1)) = target (FSM.initial M') (pP' @ take (length pR') pIO)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
t_target (pIO ! (length pR' - 1)) = target (FSM.initial M') (pP' @ take (length pR') pIO)

goal (1 subgoal):
 1. io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {t_target (pIO ! (length pR' - 1))}
[PROOF STEP]
have "path M' (target (FSM.initial M') pP') (take (length pR') pIO)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. path M' (target (FSM.initial M') pP') (take (length pR') pIO)
[PROOF STEP]
using \<open>path M' (target (FSM.initial M') pP') pIO\<close>
[PROOF STATE]
proof (prove)
using this:
path M' (target (FSM.initial M') pP') pIO

goal (1 subgoal):
 1. path M' (target (FSM.initial M') pP') (take (length pR') pIO)
[PROOF STEP]
by (simp add: path_prefix_take)
[PROOF STATE]
proof (state)
this:
path M' (target (FSM.initial M') pP') (take (length pR') pIO)

goal (1 subgoal):
 1. io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {t_target (pIO ! (length pR' - 1))}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
path M' (target (FSM.initial M') pP') (take (length pR') pIO)
[PROOF STEP]
have "path M' (initial M') (pP' @ (take (length pR') pIO))"
[PROOF STATE]
proof (prove)
using this:
path M' (target (FSM.initial M') pP') (take (length pR') pIO)

goal (1 subgoal):
 1. path M' (FSM.initial M') (pP' @ take (length pR') pIO)
[PROOF STEP]
using \<open>path M' (FSM.initial M') pP'\<close>
[PROOF STATE]
proof (prove)
using this:
path M' (target (FSM.initial M') pP') (take (length pR') pIO)
path M' (FSM.initial M') pP'

goal (1 subgoal):
 1. path M' (FSM.initial M') (pP' @ take (length pR') pIO)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
path M' (FSM.initial M') (pP' @ take (length pR') pIO)

goal (1 subgoal):
 1. io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {t_target (pIO ! (length pR' - 1))}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
path M' (FSM.initial M') (pP' @ take (length pR') pIO)

goal (1 subgoal):
 1. io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {t_target (pIO ! (length pR' - 1))}
[PROOF STEP]
have "p_io (pP' @ (take (length pR') pIO)) = (p_io (pP@pR'))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p_io (pP' @ take (length pR') pIO) = p_io (pP @ pR')
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. p_io (pP' @ take (length pR') pIO) = p_io (pP @ pR')
[PROOF STEP]
have "p_io (take (length pR') pIO) = p_io pR'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p_io (take (length pR') pIO) = p_io pR'
[PROOF STEP]
using \<open>p_io pIO = io\<close> \<open>pR' = take (length pR') pM\<close> \<open>p_io (pM@pX) = butlast io\<close> \<open>length pR' \<le> length pM\<close>
[PROOF STATE]
proof (prove)
using this:
p_io pIO = io
pR' = take (length pR') pM
p_io (pM @ pX) = butlast io
length pR' \<le> length pM

goal (1 subgoal):
 1. p_io (take (length pR') pIO) = p_io pR'
[PROOF STEP]
by (metis (no_types, lifting) \<open>io = p_io pM @ ioEx\<close> length_map take_le take_map)
[PROOF STATE]
proof (state)
this:
p_io (take (length pR') pIO) = p_io pR'

goal (1 subgoal):
 1. p_io (pP' @ take (length pR') pIO) = p_io (pP @ pR')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
p_io (take (length pR') pIO) = p_io pR'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
p_io (take (length pR') pIO) = p_io pR'

goal (1 subgoal):
 1. p_io (pP' @ take (length pR') pIO) = p_io (pP @ pR')
[PROOF STEP]
using \<open>p_io pP' = p_io pP\<close>
[PROOF STATE]
proof (prove)
using this:
p_io (take (length pR') pIO) = p_io pR'
p_io pP' = p_io pP

goal (1 subgoal):
 1. p_io (pP' @ take (length pR') pIO) = p_io (pP @ pR')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
p_io (pP' @ take (length pR') pIO) = p_io (pP @ pR')

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
p_io (pP' @ take (length pR') pIO) = p_io (pP @ pR')

goal (1 subgoal):
 1. io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {t_target (pIO ! (length pR' - 1))}
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
path M' (FSM.initial M') (pP' @ take (length pR') pIO)
p_io (pP' @ take (length pR') pIO) = p_io (pP @ pR')
[PROOF STEP]
have "io_targets M' (p_io (pP@pR')) (FSM.initial M') = {target (initial M') (pP' @ (take (length pR') pIO))}"
[PROOF STATE]
proof (prove)
using this:
path M' (FSM.initial M') (pP' @ take (length pR') pIO)
p_io (pP' @ take (length pR') pIO) = p_io (pP @ pR')

goal (1 subgoal):
 1. io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {target (FSM.initial M') (pP' @ take (length pR') pIO)}
[PROOF STEP]
by (metis (mono_tags, lifting) assms(4) observable_path_io_target)
[PROOF STATE]
proof (state)
this:
io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {target (FSM.initial M') (pP' @ take (length pR') pIO)}

goal (1 subgoal):
 1. io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {t_target (pIO ! (length pR' - 1))}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {target (FSM.initial M') (pP' @ take (length pR') pIO)}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {target (FSM.initial M') (pP' @ take (length pR') pIO)}

goal (1 subgoal):
 1. io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {t_target (pIO ! (length pR' - 1))}
[PROOF STEP]
unfolding \<open>t_target (pIO ! ?i) = target (initial M') (pP' @ (take (length pR') pIO))\<close>
[PROOF STATE]
proof (prove)
using this:
io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {target (FSM.initial M') (pP' @ take (length pR') pIO)}

goal (1 subgoal):
 1. io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {target (FSM.initial M') (pP' @ take (length pR') pIO)}
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {t_target (pIO ! (length pR' - 1))}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {t_target (pIO ! (length pR' - 1))}

goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
t_target (pIO ! (length pR' - 1)) \<notin> io_targets M' (p_io pPQ) (FSM.initial M')
io_targets M' (p_io pPQ) (FSM.initial M') = {target (FSM.initial M') pPQ'}
io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {t_target (pIO ! (length pR' - 1))}
[PROOF STEP]
have "target (initial M') pPQ' \<notin> io_targets M' (p_io pR) (initial M')"
[PROOF STATE]
proof (prove)
using this:
t_target (pIO ! (length pR' - 1)) \<notin> io_targets M' (p_io pPQ) (FSM.initial M')
io_targets M' (p_io pPQ) (FSM.initial M') = {target (FSM.initial M') pPQ'}
io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {t_target (pIO ! (length pR' - 1))}

goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<notin> io_targets M' (p_io pR) (FSM.initial M')
[PROOF STEP]
unfolding \<open>pR = pP@pR'\<close>
[PROOF STATE]
proof (prove)
using this:
t_target (pIO ! (length pR' - 1)) \<notin> io_targets M' (p_io pPQ) (FSM.initial M')
io_targets M' (p_io pPQ) (FSM.initial M') = {target (FSM.initial M') pPQ'}
io_targets M' (p_io (pP @ pR')) (FSM.initial M') = {t_target (pIO ! (length pR' - 1))}

goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<notin> io_targets M' (p_io (pP @ pR')) (FSM.initial M')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
target (FSM.initial M') pPQ' \<notin> io_targets M' (p_io pR) (FSM.initial M')

goal (1 subgoal):
 1. target (FSM.initial M') pPQ' \<in> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
target (FSM.initial M') pPQ' \<notin> io_targets M' (p_io pR) (FSM.initial M')
[PROOF STEP]
show "False"
[PROOF STATE]
proof (prove)
using this:
target (FSM.initial M') pPQ' \<notin> io_targets M' (p_io pR) (FSM.initial M')

goal (1 subgoal):
 1. False
[PROOF STEP]
using \<open>target (initial M') pPQ' \<in> io_targets M' (p_io pR) (initial M')\<close>
[PROOF STATE]
proof (prove)
using this:
target (FSM.initial M') pPQ' \<notin> io_targets M' (p_io pR) (FSM.initial M')
target (FSM.initial M') pPQ' \<in> io_targets M' (p_io pR) (FSM.initial M')

goal (1 subgoal):
 1. False
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
target (FSM.initial M') pPQ' \<notin> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))

goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
io_targets M' (p_io pPQ) (FSM.initial M') = {target (FSM.initial M') pPQ'}
target (FSM.initial M') pPQ' \<notin> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
have "io_targets M' (p_io pPQ) (initial M') \<inter> (\<Union> (image (\<lambda> pR . io_targets M' (p_io pR) (initial M')) ?R)) = {}"
[PROOF STATE]
proof (prove)
using this:
io_targets M' (p_io pPQ) (FSM.initial M') = {target (FSM.initial M') pPQ'}
target (FSM.initial M') pPQ' \<notin> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))

goal (1 subgoal):
 1. io_targets M' (p_io pPQ) (FSM.initial M') \<inter> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) = {}
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
io_targets M' (p_io pPQ) (FSM.initial M') \<inter> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) = {}

goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
io_targets M' (p_io pPQ) (FSM.initial M') \<inter> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) = {}
[PROOF STEP]
show "(\<Union> pR \<in> (RP M q q' pP pM prs M') . io_targets M' (p_io pR) (initial M')) \<noteq> (\<Union> pR \<in> (R M q q' pP pM) . io_targets M' (p_io pR) (initial M'))"
[PROOF STATE]
proof (prove)
using this:
io_targets M' (p_io pPQ) (FSM.initial M') \<inter> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) = {}

goal (1 subgoal):
 1. (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
unfolding \<open>?RP = insert pPQ (R M q q' pP pM)\<close>
[PROOF STATE]
proof (prove)
using this:
io_targets M' (p_io pPQ) (FSM.initial M') \<inter> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) = {}

goal (1 subgoal):
 1. (\<Union>pR\<in>insert pPQ (R M q q' pP pM). io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
using \<open>io_targets M' (p_io pPQ) (FSM.initial M') = {target (FSM.initial M') pPQ'}\<close>
[PROOF STATE]
proof (prove)
using this:
io_targets M' (p_io pPQ) (FSM.initial M') \<inter> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M')) = {}
io_targets M' (p_io pPQ) (FSM.initial M') = {target (FSM.initial M') pPQ'}

goal (1 subgoal):
 1. (\<Union>pR\<in>insert pPQ (R M q q' pP pM). io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
(\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q ?q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q ?q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
(* create a function that separates the additional entries for the preambles in the RP sets of states in (snd dM) *)
[PROOF STATE]
proof (state)
this:
?q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q ?q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q ?q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
?q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q ?q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q ?q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
obtain f where f_def: "\<And> q' . q' \<in> snd dM \<Longrightarrow> (RP M q q' pP pM prs M') = insert (f q') (R M q q' pP pM) \<and> (f q') \<notin> (R M q q' pP pM)"
[PROOF STATE]
proof (prove)
using this:
?q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q ?q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q ?q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))

goal (1 subgoal):
 1. (\<And>f. (\<And>q'. q' \<in> snd dM \<Longrightarrow> RP M q q' pP pM prs M' = insert (f q') (R M q q' pP pM) \<and> f q' \<notin> R M q q' pP pM) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>\<And>f. (\<And>q'. q' \<in> snd dM \<Longrightarrow> RP M q q' pP pM prs M' = insert (f q') (R M q q' pP pM) \<and> f q' \<notin> R M q q' pP pM) \<Longrightarrow> thesis; \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
define f where f_def : "f = (\<lambda> q' . SOME p . (RP M q q' pP pM prs M') = insert p (R M q q' pP pM) \<and> p \<notin> (R M q q' pP pM))"
[PROOF STATE]
proof (state)
this:
f = (\<lambda>q'. SOME p. RP M q q' pP pM prs M' = insert p (R M q q' pP pM) \<and> p \<notin> R M q q' pP pM)

goal (1 subgoal):
 1. \<lbrakk>\<And>f. (\<And>q'. q' \<in> snd dM \<Longrightarrow> RP M q q' pP pM prs M' = insert (f q') (R M q q' pP pM) \<and> f q' \<notin> R M q q' pP pM) \<Longrightarrow> thesis; \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
have "\<And> q' . q' \<in> snd dM \<Longrightarrow> (RP M q q' pP pM prs M') = insert (f q') (R M q q' pP pM) \<and> (RP M q q' pP pM prs M') \<noteq> (R M q q' pP pM)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> RP M q q' pP pM prs M' = insert (f q') (R M q q' pP pM) \<and> RP M q q' pP pM prs M' \<noteq> R M q q' pP pM
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> RP M q q' pP pM prs M' = insert (f q') (R M q q' pP pM) \<and> RP M q q' pP pM prs M' \<noteq> R M q q' pP pM
[PROOF STEP]
fix q'
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> RP M q q' pP pM prs M' = insert (f q') (R M q q' pP pM) \<and> RP M q q' pP pM prs M' \<noteq> R M q q' pP pM
[PROOF STEP]
assume "q' \<in> snd dM"
[PROOF STATE]
proof (state)
this:
q' \<in> snd dM

goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> RP M q q' pP pM prs M' = insert (f q') (R M q q' pP pM) \<and> RP M q q' pP pM prs M' \<noteq> R M q q' pP pM
[PROOF STEP]
have "(\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
using snd_dM_prop[OF \<open>q' \<in> snd dM\<close>]
[PROOF STATE]
proof (prove)
using this:
(\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))

goal (1 subgoal):
 1. (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
(\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))

goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> RP M q q' pP pM prs M' = insert (f q') (R M q q' pP pM) \<and> RP M q q' pP pM prs M' \<noteq> R M q q' pP pM
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))
[PROOF STEP]
have "(RP M q q' pP pM prs M') \<noteq> (R M q q' pP pM)"
[PROOF STATE]
proof (prove)
using this:
(\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))

goal (1 subgoal):
 1. RP M q q' pP pM prs M' \<noteq> R M q q' pP pM
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
RP M q q' pP pM prs M' \<noteq> R M q q' pP pM

goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> RP M q q' pP pM prs M' = insert (f q') (R M q q' pP pM) \<and> RP M q q' pP pM prs M' \<noteq> R M q q' pP pM
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
RP M q q' pP pM prs M' \<noteq> R M q q' pP pM
[PROOF STEP]
obtain x where "(RP M q q' pP pM prs M') = insert x (R M q q' pP pM)"
[PROOF STATE]
proof (prove)
using this:
RP M q q' pP pM prs M' \<noteq> R M q q' pP pM

goal (1 subgoal):
 1. (\<And>x. RP M q q' pP pM prs M' = insert x (R M q q' pP pM) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using RP_from_R[OF t2 pass1 \<open>completely_specified M'\<close> \<open>inputs M' = inputs M\<close>, of prs "\<lambda> q P io x y y' . q" "\<lambda> q P io x y y' . y" q q' pP pM]
[PROOF STATE]
proof (prove)
using this:
RP M q q' pP pM prs M' \<noteq> R M q q' pP pM
\<lbrakk>\<And>q P. (q, P) \<in> prs \<Longrightarrow> (q, P) \<in> prs; \<And>q P io x y y'. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> (q, P) \<in> prs; \<And>q P io x y y'. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> io @ [(x, y)] \<in> L P; \<And>q P io x y y'. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> RP M q q' pP pM prs M' = R M q q' pP pM \<or> (\<exists>P' pP'. (q', P') \<in> prs \<and> path P' (FSM.initial P') pP' \<and> target (FSM.initial P') pP' = q' \<and> path M (FSM.initial M) pP' \<and> target (FSM.initial M) pP' = q' \<and> p_io pP' \<in> L M' \<and> RP M q q' pP pM prs M' = insert pP' (R M q q' pP pM))

goal (1 subgoal):
 1. (\<And>x. RP M q q' pP pM prs M' = insert x (R M q q' pP pM) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
RP M q q' pP pM prs M' = insert x (R M q q' pP pM)

goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> RP M q q' pP pM prs M' = insert (f q') (R M q q' pP pM) \<and> RP M q q' pP pM prs M' \<noteq> R M q q' pP pM
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
RP M q q' pP pM prs M' = insert x (R M q q' pP pM)
[PROOF STEP]
have "x \<notin> (R M q q' pP pM)"
[PROOF STATE]
proof (prove)
using this:
RP M q q' pP pM prs M' = insert x (R M q q' pP pM)

goal (1 subgoal):
 1. x \<notin> R M q q' pP pM
[PROOF STEP]
using \<open>(RP M q q' pP pM prs M') \<noteq> (R M q q' pP pM)\<close>
[PROOF STATE]
proof (prove)
using this:
RP M q q' pP pM prs M' = insert x (R M q q' pP pM)
RP M q q' pP pM prs M' \<noteq> R M q q' pP pM

goal (1 subgoal):
 1. x \<notin> R M q q' pP pM
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
x \<notin> R M q q' pP pM

goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> RP M q q' pP pM prs M' = insert (f q') (R M q q' pP pM) \<and> RP M q q' pP pM prs M' \<noteq> R M q q' pP pM
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
x \<notin> R M q q' pP pM
[PROOF STEP]
have "\<exists> p . (RP M q q' pP pM prs M') = insert p (R M q q' pP pM) \<and> p \<notin> (R M q q' pP pM)"
[PROOF STATE]
proof (prove)
using this:
x \<notin> R M q q' pP pM

goal (1 subgoal):
 1. \<exists>p. RP M q q' pP pM prs M' = insert p (R M q q' pP pM) \<and> p \<notin> R M q q' pP pM
[PROOF STEP]
using \<open>(RP M q q' pP pM prs M') = insert x (R M q q' pP pM)\<close>
[PROOF STATE]
proof (prove)
using this:
x \<notin> R M q q' pP pM
RP M q q' pP pM prs M' = insert x (R M q q' pP pM)

goal (1 subgoal):
 1. \<exists>p. RP M q q' pP pM prs M' = insert p (R M q q' pP pM) \<and> p \<notin> R M q q' pP pM
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>p. RP M q q' pP pM prs M' = insert p (R M q q' pP pM) \<and> p \<notin> R M q q' pP pM

goal (1 subgoal):
 1. \<And>q'. q' \<in> snd dM \<Longrightarrow> RP M q q' pP pM prs M' = insert (f q') (R M q q' pP pM) \<and> RP M q q' pP pM prs M' \<noteq> R M q q' pP pM
[PROOF STEP]
show "(RP M q q' pP pM prs M') = insert (f q') (R M q q' pP pM) \<and> (RP M q q' pP pM prs M') \<noteq> (R M q q' pP pM)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. RP M q q' pP pM prs M' = insert (f q') (R M q q' pP pM) \<and> RP M q q' pP pM prs M' \<noteq> R M q q' pP pM
[PROOF STEP]
using someI_ex[OF \<open>\<exists> p . (RP M q q' pP pM prs M') = insert p (R M q q' pP pM) \<and> p \<notin> (R M q q' pP pM)\<close>]
[PROOF STATE]
proof (prove)
using this:
RP M q q' pP pM prs M' = insert (SOME x. RP M q q' pP pM prs M' = insert x (R M q q' pP pM) \<and> x \<notin> R M q q' pP pM) (R M q q' pP pM) \<and> (SOME x. RP M q q' pP pM prs M' = insert x (R M q q' pP pM) \<and> x \<notin> R M q q' pP pM) \<notin> R M q q' pP pM

goal (1 subgoal):
 1. RP M q q' pP pM prs M' = insert (f q') (R M q q' pP pM) \<and> RP M q q' pP pM prs M' \<noteq> R M q q' pP pM
[PROOF STEP]
unfolding f_def
[PROOF STATE]
proof (prove)
using this:
RP M q q' pP pM prs M' = insert (SOME x. RP M q q' pP pM prs M' = insert x (R M q q' pP pM) \<and> x \<notin> R M q q' pP pM) (R M q q' pP pM) \<and> (SOME x. RP M q q' pP pM prs M' = insert x (R M q q' pP pM) \<and> x \<notin> R M q q' pP pM) \<notin> R M q q' pP pM

goal (1 subgoal):
 1. RP M q q' pP pM prs M' = insert (SOME p. RP M q q' pP pM prs M' = insert p (R M q q' pP pM) \<and> p \<notin> R M q q' pP pM) (R M q q' pP pM) \<and> RP M q q' pP pM prs M' \<noteq> R M q q' pP pM
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
RP M q q' pP pM prs M' = insert (f q') (R M q q' pP pM) \<and> RP M q q' pP pM prs M' \<noteq> R M q q' pP pM

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?q' \<in> snd dM \<Longrightarrow> RP M q ?q' pP pM prs M' = insert (f ?q') (R M q ?q' pP pM) \<and> RP M q ?q' pP pM prs M' \<noteq> R M q ?q' pP pM

goal (1 subgoal):
 1. \<lbrakk>\<And>f. (\<And>q'. q' \<in> snd dM \<Longrightarrow> RP M q q' pP pM prs M' = insert (f q') (R M q q' pP pM) \<and> f q' \<notin> R M q q' pP pM) \<Longrightarrow> thesis; \<And>q'. q' \<in> snd dM \<Longrightarrow> (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) \<noteq> (\<Union>pR\<in>R M q q' pP pM. io_targets M' (p_io pR) (FSM.initial M'))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
?q' \<in> snd dM \<Longrightarrow> RP M q ?q' pP pM prs M' = insert (f ?q') (R M q ?q' pP pM) \<and> RP M q ?q' pP pM prs M' \<noteq> R M q ?q' pP pM
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
?q' \<in> snd dM \<Longrightarrow> RP M q ?q' pP pM prs M' = insert (f ?q') (R M q ?q' pP pM) \<and> RP M q ?q' pP pM prs M' \<noteq> R M q ?q' pP pM

goal (1 subgoal):
 1. thesis
[PROOF STEP]
using that
[PROOF STATE]
proof (prove)
using this:
?q' \<in> snd dM \<Longrightarrow> RP M q ?q' pP pM prs M' = insert (f ?q') (R M q ?q' pP pM) \<and> RP M q ?q' pP pM prs M' \<noteq> R M q ?q' pP pM
(\<And>q'. q' \<in> snd dM \<Longrightarrow> RP M q q' pP pM prs M' = insert (?f q') (R M q q' pP pM) \<and> ?f q' \<notin> R M q q' pP pM) \<Longrightarrow> thesis

goal (1 subgoal):
 1. thesis
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
thesis

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?q' \<in> snd dM \<Longrightarrow> RP M q ?q' pP pM prs M' = insert (f ?q') (R M q ?q' pP pM) \<and> f ?q' \<notin> R M q ?q' pP pM

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
(*
     combine counting results on RP (from R) to show that the path along pM collects
     at least m+1 distinct io-targets (i.e. visites at least m+1 distinct states) in M'
   *)
[PROOF STATE]
proof (state)
this:
?q' \<in> snd dM \<Longrightarrow> RP M q ?q' pP pM prs M' = insert (f ?q') (R M q ?q' pP pM) \<and> f ?q' \<notin> R M q ?q' pP pM

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have "(\<Sum> q' \<in> fst dM . card (\<Union> pR \<in> (RP M q q' pP pM prs M') . io_targets M' (p_io pR) (initial M'))) \<ge> Suc m"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Suc m \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. Suc m \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))
[PROOF STEP]
have "\<And> nds . finite nds \<Longrightarrow> nds \<subseteq> fst dM \<Longrightarrow> (\<Sum> q' \<in> nds . card (RP M q q' pP pM prs M')) \<ge> length (filter (\<lambda>t. t_target t \<in> nds) pM) + card (nds \<inter> snd dM)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>nds. \<lbrakk>finite nds; nds \<subseteq> fst dM\<rbrakk> \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> nds) pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>nds. \<lbrakk>finite nds; nds \<subseteq> fst dM\<rbrakk> \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> nds) pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
fix nds
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>nds. \<lbrakk>finite nds; nds \<subseteq> fst dM\<rbrakk> \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> nds) pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
assume "finite nds" and "nds \<subseteq> fst dM"
[PROOF STATE]
proof (state)
this:
finite nds
nds \<subseteq> fst dM

goal (1 subgoal):
 1. \<And>nds. \<lbrakk>finite nds; nds \<subseteq> fst dM\<rbrakk> \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> nds) pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
finite nds
nds \<subseteq> fst dM
[PROOF STEP]
show "(\<Sum> q' \<in> nds . card (RP M q q' pP pM prs M')) \<ge> length (filter (\<lambda>t. t_target t \<in> nds) pM) + card (nds \<inter> snd dM)"
[PROOF STATE]
proof (prove)
using this:
finite nds
nds \<subseteq> fst dM

goal (1 subgoal):
 1. length (filter (\<lambda>t. t_target t \<in> nds) pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
proof induction
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. {} \<subseteq> fst dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> {}) pM) + card ({} \<inter> snd dM) \<le> (\<Sum>q'\<in>{}. card (RP M q q' pP pM prs M'))
 2. \<And>x F. \<lbrakk>finite F; x \<notin> F; F \<subseteq> fst dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> F) pM) + card (F \<inter> snd dM) \<le> (\<Sum>q'\<in>F. card (RP M q q' pP pM prs M')); insert x F \<subseteq> fst dM\<rbrakk> \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert x F) pM) + card (insert x F \<inter> snd dM) \<le> (\<Sum>q'\<in>insert x F. card (RP M q q' pP pM prs M'))
[PROOF STEP]
case empty
[PROOF STATE]
proof (state)
this:
{} \<subseteq> fst dM

goal (2 subgoals):
 1. {} \<subseteq> fst dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> {}) pM) + card ({} \<inter> snd dM) \<le> (\<Sum>q'\<in>{}. card (RP M q q' pP pM prs M'))
 2. \<And>x F. \<lbrakk>finite F; x \<notin> F; F \<subseteq> fst dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> F) pM) + card (F \<inter> snd dM) \<le> (\<Sum>q'\<in>F. card (RP M q q' pP pM prs M')); insert x F \<subseteq> fst dM\<rbrakk> \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert x F) pM) + card (insert x F \<inter> snd dM) \<le> (\<Sum>q'\<in>insert x F. card (RP M q q' pP pM prs M'))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
{} \<subseteq> fst dM
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
{} \<subseteq> fst dM

goal (1 subgoal):
 1. length (filter (\<lambda>t. t_target t \<in> {}) pM) + card ({} \<inter> snd dM) \<le> (\<Sum>q'\<in>{}. card (RP M q q' pP pM prs M'))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
length (filter (\<lambda>t. t_target t \<in> {}) pM) + card ({} \<inter> snd dM) \<le> (\<Sum>q'\<in>{}. card (RP M q q' pP pM prs M'))

goal (1 subgoal):
 1. \<And>x F. \<lbrakk>finite F; x \<notin> F; F \<subseteq> fst dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> F) pM) + card (F \<inter> snd dM) \<le> (\<Sum>q'\<in>F. card (RP M q q' pP pM prs M')); insert x F \<subseteq> fst dM\<rbrakk> \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert x F) pM) + card (insert x F \<inter> snd dM) \<le> (\<Sum>q'\<in>insert x F. card (RP M q q' pP pM prs M'))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x F. \<lbrakk>finite F; x \<notin> F; F \<subseteq> fst dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> F) pM) + card (F \<inter> snd dM) \<le> (\<Sum>q'\<in>F. card (RP M q q' pP pM prs M')); insert x F \<subseteq> fst dM\<rbrakk> \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert x F) pM) + card (insert x F \<inter> snd dM) \<le> (\<Sum>q'\<in>insert x F. card (RP M q q' pP pM prs M'))
[PROOF STEP]
case (insert q' nds)
[PROOF STATE]
proof (state)
this:
finite nds
q' \<notin> nds
nds \<subseteq> fst dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> nds) pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M'))
insert q' nds \<subseteq> fst dM

goal (1 subgoal):
 1. \<And>x F. \<lbrakk>finite F; x \<notin> F; F \<subseteq> fst dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> F) pM) + card (F \<inter> snd dM) \<le> (\<Sum>q'\<in>F. card (RP M q q' pP pM prs M')); insert x F \<subseteq> fst dM\<rbrakk> \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert x F) pM) + card (insert x F \<inter> snd dM) \<le> (\<Sum>q'\<in>insert x F. card (RP M q q' pP pM prs M'))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
finite nds
q' \<notin> nds
nds \<subseteq> fst dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> nds) pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M'))
insert q' nds \<subseteq> fst dM
[PROOF STEP]
have leq1: "length (filter (\<lambda>t. t_target t \<in> nds) pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M'))"
[PROOF STATE]
proof (prove)
using this:
finite nds
q' \<notin> nds
nds \<subseteq> fst dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> nds) pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M'))
insert q' nds \<subseteq> fst dM

goal (1 subgoal):
 1. length (filter (\<lambda>t. t_target t \<in> nds) pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
length (filter (\<lambda>t. t_target t \<in> nds) pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M'))

goal (1 subgoal):
 1. \<And>x F. \<lbrakk>finite F; x \<notin> F; F \<subseteq> fst dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> F) pM) + card (F \<inter> snd dM) \<le> (\<Sum>q'\<in>F. card (RP M q q' pP pM prs M')); insert x F \<subseteq> fst dM\<rbrakk> \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert x F) pM) + card (insert x F \<inter> snd dM) \<le> (\<Sum>q'\<in>insert x F. card (RP M q q' pP pM prs M'))
[PROOF STEP]
have p4: "(card (R M q q' pP pM)) = length (filter (\<lambda>t. t_target t = q') pM)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card (R M q q' pP pM) = length (filter (\<lambda>t. t_target t = q') pM)
[PROOF STEP]
using \<open>path M q pM\<close>
[PROOF STATE]
proof (prove)
using this:
path M q pM

goal (1 subgoal):
 1. card (R M q q' pP pM) = length (filter (\<lambda>t. t_target t = q') pM)
[PROOF STEP]
proof (induction pM rule: rev_induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. path M q [] \<Longrightarrow> card (R M q q' pP []) = length (filter (\<lambda>t. t_target t = q') [])
 2. \<And>x xs. \<lbrakk>path M q xs \<Longrightarrow> card (R M q q' pP xs) = length (filter (\<lambda>t. t_target t = q') xs); path M q (xs @ [x])\<rbrakk> \<Longrightarrow> card (R M q q' pP (xs @ [x])) = length (filter (\<lambda>t. t_target t = q') (xs @ [x]))
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
path M q []

goal (2 subgoals):
 1. path M q [] \<Longrightarrow> card (R M q q' pP []) = length (filter (\<lambda>t. t_target t = q') [])
 2. \<And>x xs. \<lbrakk>path M q xs \<Longrightarrow> card (R M q q' pP xs) = length (filter (\<lambda>t. t_target t = q') xs); path M q (xs @ [x])\<rbrakk> \<Longrightarrow> card (R M q q' pP (xs @ [x])) = length (filter (\<lambda>t. t_target t = q') (xs @ [x]))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
path M q []
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
path M q []

goal (1 subgoal):
 1. card (R M q q' pP []) = length (filter (\<lambda>t. t_target t = q') [])
[PROOF STEP]
unfolding R_def
[PROOF STATE]
proof (prove)
using this:
path M q []

goal (1 subgoal):
 1. card {pP @ p' |p'. p' \<noteq> [] \<and> target q p' = q' \<and> (\<exists>p''. [] = p' @ p'')} = length (filter (\<lambda>t. t_target t = q') [])
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
card (R M q q' pP []) = length (filter (\<lambda>t. t_target t = q') [])

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>path M q xs \<Longrightarrow> card (R M q q' pP xs) = length (filter (\<lambda>t. t_target t = q') xs); path M q (xs @ [x])\<rbrakk> \<Longrightarrow> card (R M q q' pP (xs @ [x])) = length (filter (\<lambda>t. t_target t = q') (xs @ [x]))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>path M q xs \<Longrightarrow> card (R M q q' pP xs) = length (filter (\<lambda>t. t_target t = q') xs); path M q (xs @ [x])\<rbrakk> \<Longrightarrow> card (R M q q' pP (xs @ [x])) = length (filter (\<lambda>t. t_target t = q') (xs @ [x]))
[PROOF STEP]
case (snoc t pM)
[PROOF STATE]
proof (state)
this:
path M q pM \<Longrightarrow> card (R M q q' pP pM) = length (filter (\<lambda>t. t_target t = q') pM)
path M q (pM @ [t])

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>path M q xs \<Longrightarrow> card (R M q q' pP xs) = length (filter (\<lambda>t. t_target t = q') xs); path M q (xs @ [x])\<rbrakk> \<Longrightarrow> card (R M q q' pP (xs @ [x])) = length (filter (\<lambda>t. t_target t = q') (xs @ [x]))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
path M q pM \<Longrightarrow> card (R M q q' pP pM) = length (filter (\<lambda>t. t_target t = q') pM)
path M q (pM @ [t])
[PROOF STEP]
have "path M q pM" and "card (R M q q' pP pM) = length (filter (\<lambda>t. t_target t = q') pM)"
[PROOF STATE]
proof (prove)
using this:
path M q pM \<Longrightarrow> card (R M q q' pP pM) = length (filter (\<lambda>t. t_target t = q') pM)
path M q (pM @ [t])

goal (1 subgoal):
 1. path M q pM &&& card (R M q q' pP pM) = length (filter (\<lambda>t. t_target t = q') pM)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
path M q pM
card (R M q q' pP pM) = length (filter (\<lambda>t. t_target t = q') pM)

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>path M q xs \<Longrightarrow> card (R M q q' pP xs) = length (filter (\<lambda>t. t_target t = q') xs); path M q (xs @ [x])\<rbrakk> \<Longrightarrow> card (R M q q' pP (xs @ [x])) = length (filter (\<lambda>t. t_target t = q') (xs @ [x]))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
[PROOF STEP]
proof (cases "target q (pM @ [t]) = q'")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. target q (pM @ [t]) = q' \<Longrightarrow> card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
 2. target q (pM @ [t]) \<noteq> q' \<Longrightarrow> card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
target q (pM @ [t]) = q'

goal (2 subgoals):
 1. target q (pM @ [t]) = q' \<Longrightarrow> card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
 2. target q (pM @ [t]) \<noteq> q' \<Longrightarrow> card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
target q (pM @ [t]) = q'
[PROOF STEP]
have "(R M q q' pP (pM @ [t])) = insert (pP @ pM @ [t]) (R M q q' pP pM)"
[PROOF STATE]
proof (prove)
using this:
target q (pM @ [t]) = q'

goal (1 subgoal):
 1. R M q q' pP (pM @ [t]) = insert (pP @ pM @ [t]) (R M q q' pP pM)
[PROOF STEP]
unfolding R_update[of M q q' pP pM t]
[PROOF STATE]
proof (prove)
using this:
target q (pM @ [t]) = q'

goal (1 subgoal):
 1. (if target q (pM @ [t]) = q' then insert (pP @ pM @ [t]) (R M q q' pP pM) else R M q q' pP pM) = insert (pP @ pM @ [t]) (R M q q' pP pM)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
R M q q' pP (pM @ [t]) = insert (pP @ pM @ [t]) (R M q q' pP pM)

goal (2 subgoals):
 1. target q (pM @ [t]) = q' \<Longrightarrow> card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
 2. target q (pM @ [t]) \<noteq> q' \<Longrightarrow> card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
R M q q' pP (pM @ [t]) = insert (pP @ pM @ [t]) (R M q q' pP pM)

goal (2 subgoals):
 1. target q (pM @ [t]) = q' \<Longrightarrow> card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
 2. target q (pM @ [t]) \<noteq> q' \<Longrightarrow> card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
[PROOF STEP]
have "(pP @ pM @ [t]) \<notin> (R M q q' pP pM)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pP @ pM @ [t] \<notin> R M q q' pP pM
[PROOF STEP]
unfolding R_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pP @ pM @ [t] \<notin> {pP @ p' |p'. p' \<noteq> [] \<and> target q p' = q' \<and> (\<exists>p''. pM = p' @ p'')}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
pP @ pM @ [t] \<notin> R M q q' pP pM

goal (2 subgoals):
 1. target q (pM @ [t]) = q' \<Longrightarrow> card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
 2. target q (pM @ [t]) \<noteq> q' \<Longrightarrow> card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
R M q q' pP (pM @ [t]) = insert (pP @ pM @ [t]) (R M q q' pP pM)
pP @ pM @ [t] \<notin> R M q q' pP pM
[PROOF STEP]
have "card (R M q q' pP (pM @ [t])) = Suc (card (R M q q' pP pM))"
[PROOF STATE]
proof (prove)
using this:
R M q q' pP (pM @ [t]) = insert (pP @ pM @ [t]) (R M q q' pP pM)
pP @ pM @ [t] \<notin> R M q q' pP pM

goal (1 subgoal):
 1. card (R M q q' pP (pM @ [t])) = Suc (card (R M q q' pP pM))
[PROOF STEP]
using finite_R[OF \<open>path M q pM\<close>, of q' pP]
[PROOF STATE]
proof (prove)
using this:
R M q q' pP (pM @ [t]) = insert (pP @ pM @ [t]) (R M q q' pP pM)
pP @ pM @ [t] \<notin> R M q q' pP pM
finite (R M q q' pP pM)

goal (1 subgoal):
 1. card (R M q q' pP (pM @ [t])) = Suc (card (R M q q' pP pM))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
card (R M q q' pP (pM @ [t])) = Suc (card (R M q q' pP pM))

goal (2 subgoals):
 1. target q (pM @ [t]) = q' \<Longrightarrow> card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
 2. target q (pM @ [t]) \<noteq> q' \<Longrightarrow> card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
card (R M q q' pP (pM @ [t])) = Suc (card (R M q q' pP pM))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
card (R M q q' pP (pM @ [t])) = Suc (card (R M q q' pP pM))

goal (1 subgoal):
 1. card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
[PROOF STEP]
using True
[PROOF STATE]
proof (prove)
using this:
card (R M q q' pP (pM @ [t])) = Suc (card (R M q q' pP pM))
target q (pM @ [t]) = q'

goal (1 subgoal):
 1. card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
[PROOF STEP]
unfolding \<open>card (R M q q' pP pM) = length (filter (\<lambda>t. t_target t = q') pM)\<close>
[PROOF STATE]
proof (prove)
using this:
card (R M q q' pP (pM @ [t])) = Suc (length (filter (\<lambda>t. t_target t = q') pM))
target q (pM @ [t]) = q'

goal (1 subgoal):
 1. card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))

goal (1 subgoal):
 1. target q (pM @ [t]) \<noteq> q' \<Longrightarrow> card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. target q (pM @ [t]) \<noteq> q' \<Longrightarrow> card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
target q (pM @ [t]) \<noteq> q'

goal (1 subgoal):
 1. target q (pM @ [t]) \<noteq> q' \<Longrightarrow> card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
target q (pM @ [t]) \<noteq> q'
[PROOF STEP]
have "card (R M q q' pP (pM @ [t])) = card (R M q q' pP pM)"
[PROOF STATE]
proof (prove)
using this:
target q (pM @ [t]) \<noteq> q'

goal (1 subgoal):
 1. card (R M q q' pP (pM @ [t])) = card (R M q q' pP pM)
[PROOF STEP]
unfolding R_update[of M q q' pP pM t]
[PROOF STATE]
proof (prove)
using this:
target q (pM @ [t]) \<noteq> q'

goal (1 subgoal):
 1. card (if target q (pM @ [t]) = q' then insert (pP @ pM @ [t]) (R M q q' pP pM) else R M q q' pP pM) = card (R M q q' pP pM)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
card (R M q q' pP (pM @ [t])) = card (R M q q' pP pM)

goal (1 subgoal):
 1. target q (pM @ [t]) \<noteq> q' \<Longrightarrow> card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
card (R M q q' pP (pM @ [t])) = card (R M q q' pP pM)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
card (R M q q' pP (pM @ [t])) = card (R M q q' pP pM)

goal (1 subgoal):
 1. card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
[PROOF STEP]
using False
[PROOF STATE]
proof (prove)
using this:
card (R M q q' pP (pM @ [t])) = card (R M q q' pP pM)
target q (pM @ [t]) \<noteq> q'

goal (1 subgoal):
 1. card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
[PROOF STEP]
unfolding \<open>card (R M q q' pP pM) = length (filter (\<lambda>t. t_target t = q') pM)\<close>
[PROOF STATE]
proof (prove)
using this:
card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') pM)
target q (pM @ [t]) \<noteq> q'

goal (1 subgoal):
 1. card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
card (R M q q' pP (pM @ [t])) = length (filter (\<lambda>t. t_target t = q') (pM @ [t]))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
card (R M q q' pP pM) = length (filter (\<lambda>t. t_target t = q') pM)

goal (1 subgoal):
 1. \<And>x F. \<lbrakk>finite F; x \<notin> F; F \<subseteq> fst dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> F) pM) + card (F \<inter> snd dM) \<le> (\<Sum>q'\<in>F. card (RP M q q' pP pM prs M')); insert x F \<subseteq> fst dM\<rbrakk> \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert x F) pM) + card (insert x F \<inter> snd dM) \<le> (\<Sum>q'\<in>insert x F. card (RP M q q' pP pM prs M'))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
proof (cases "q' \<in> snd dM")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. q' \<in> snd dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
 2. q' \<notin> snd dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
q' \<in> snd dM

goal (2 subgoals):
 1. q' \<in> snd dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
 2. q' \<notin> snd dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
q' \<in> snd dM
[PROOF STEP]
have p0: "(RP M q q' pP pM prs M') = insert (f q') (R M q q' pP pM)" and "(f q') \<notin> (R M q q' pP pM)"
[PROOF STATE]
proof (prove)
using this:
q' \<in> snd dM

goal (1 subgoal):
 1. RP M q q' pP pM prs M' = insert (f q') (R M q q' pP pM) &&& f q' \<notin> R M q q' pP pM
[PROOF STEP]
using f_def
[PROOF STATE]
proof (prove)
using this:
q' \<in> snd dM
?q' \<in> snd dM \<Longrightarrow> RP M q ?q' pP pM prs M' = insert (f ?q') (R M q ?q' pP pM) \<and> f ?q' \<notin> R M q ?q' pP pM

goal (1 subgoal):
 1. RP M q q' pP pM prs M' = insert (f q') (R M q q' pP pM) &&& f q' \<notin> R M q q' pP pM
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
RP M q q' pP pM prs M' = insert (f q') (R M q q' pP pM)
f q' \<notin> R M q q' pP pM

goal (2 subgoals):
 1. q' \<in> snd dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
 2. q' \<notin> snd dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
RP M q q' pP pM prs M' = insert (f q') (R M q q' pP pM)
f q' \<notin> R M q q' pP pM
[PROOF STEP]
have "card (RP M q q' pP pM prs M') = Suc (card (R M q q' pP pM))"
[PROOF STATE]
proof (prove)
using this:
RP M q q' pP pM prs M' = insert (f q') (R M q q' pP pM)
f q' \<notin> R M q q' pP pM

goal (1 subgoal):
 1. card (RP M q q' pP pM prs M') = Suc (card (R M q q' pP pM))
[PROOF STEP]
by (simp add: \<open>path M q pM\<close> finite_R)
[PROOF STATE]
proof (state)
this:
card (RP M q q' pP pM prs M') = Suc (card (R M q q' pP pM))

goal (2 subgoals):
 1. q' \<in> snd dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
 2. q' \<notin> snd dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
card (RP M q q' pP pM prs M') = Suc (card (R M q q' pP pM))
[PROOF STEP]
have p1: "(\<Sum>q' \<in> (insert q' nds). card (RP M q q' pP pM prs M')) = (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M')) + Suc (card (R M q q' pP pM))"
[PROOF STATE]
proof (prove)
using this:
card (RP M q q' pP pM prs M') = Suc (card (R M q q' pP pM))

goal (1 subgoal):
 1. (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M')) = (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M')) + Suc (card (R M q q' pP pM))
[PROOF STEP]
by (simp add: insert.hyps(1) insert.hyps(2))
[PROOF STATE]
proof (state)
this:
(\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M')) = (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M')) + Suc (card (R M q q' pP pM))

goal (2 subgoals):
 1. q' \<in> snd dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
 2. q' \<notin> snd dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
have p2: "length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) = length (filter (\<lambda>t. t_target t \<in> nds) pM) + length (filter (\<lambda>t. t_target t = q') pM)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) = length (filter (\<lambda>t. t_target t \<in> nds) pM) + length (filter (\<lambda>t. t_target t = q') pM)
[PROOF STEP]
using \<open>q' \<notin> nds\<close>
[PROOF STATE]
proof (prove)
using this:
q' \<notin> nds

goal (1 subgoal):
 1. length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) = length (filter (\<lambda>t. t_target t \<in> nds) pM) + length (filter (\<lambda>t. t_target t = q') pM)
[PROOF STEP]
by (induction pM; auto)
[PROOF STATE]
proof (state)
this:
length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) = length (filter (\<lambda>t. t_target t \<in> nds) pM) + length (filter (\<lambda>t. t_target t = q') pM)

goal (2 subgoals):
 1. q' \<in> snd dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
 2. q' \<notin> snd dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
have p3: "card ((insert q' nds) \<inter> snd dM) = Suc (card (nds \<inter> snd dM))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card (insert q' nds \<inter> snd dM) = Suc (card (nds \<inter> snd dM))
[PROOF STEP]
using True \<open>finite nds\<close> \<open>q' \<notin> nds\<close>
[PROOF STATE]
proof (prove)
using this:
q' \<in> snd dM
finite nds
q' \<notin> nds

goal (1 subgoal):
 1. card (insert q' nds \<inter> snd dM) = Suc (card (nds \<inter> snd dM))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
card (insert q' nds \<inter> snd dM) = Suc (card (nds \<inter> snd dM))

goal (2 subgoals):
 1. q' \<in> snd dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
 2. q' \<notin> snd dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
using leq1
[PROOF STATE]
proof (prove)
using this:
length (filter (\<lambda>t. t_target t \<in> nds) pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M'))

goal (1 subgoal):
 1. length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
unfolding  p1 p2 p3 p4
[PROOF STATE]
proof (prove)
using this:
length (filter (\<lambda>t. t_target t \<in> nds) pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M'))

goal (1 subgoal):
 1. length (filter (\<lambda>t. t_target t \<in> nds) pM) + length (filter (\<lambda>t. t_target t = q') pM) + Suc (card (nds \<inter> snd dM)) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M')) + Suc (length (filter (\<lambda>t. t_target t = q') pM))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))

goal (1 subgoal):
 1. q' \<notin> snd dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. q' \<notin> snd dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
q' \<notin> snd dM

goal (1 subgoal):
 1. q' \<notin> snd dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
have "card (RP M q q' pP pM prs M') \<ge> (card (R M q q' pP pM))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card (R M q q' pP pM) \<le> card (RP M q q' pP pM prs M')
[PROOF STEP]
proof (cases "(RP M q q' pP pM prs M') = (R M q q' pP pM)")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. RP M q q' pP pM prs M' = R M q q' pP pM \<Longrightarrow> card (R M q q' pP pM) \<le> card (RP M q q' pP pM prs M')
 2. RP M q q' pP pM prs M' \<noteq> R M q q' pP pM \<Longrightarrow> card (R M q q' pP pM) \<le> card (RP M q q' pP pM prs M')
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
RP M q q' pP pM prs M' = R M q q' pP pM

goal (2 subgoals):
 1. RP M q q' pP pM prs M' = R M q q' pP pM \<Longrightarrow> card (R M q q' pP pM) \<le> card (RP M q q' pP pM prs M')
 2. RP M q q' pP pM prs M' \<noteq> R M q q' pP pM \<Longrightarrow> card (R M q q' pP pM) \<le> card (RP M q q' pP pM prs M')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
RP M q q' pP pM prs M' = R M q q' pP pM
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
RP M q q' pP pM prs M' = R M q q' pP pM

goal (1 subgoal):
 1. card (R M q q' pP pM) \<le> card (RP M q q' pP pM prs M')
[PROOF STEP]
using finite_R[OF \<open>path M q pM\<close>, of q' pP]
[PROOF STATE]
proof (prove)
using this:
RP M q q' pP pM prs M' = R M q q' pP pM
finite (R M q q' pP pM)

goal (1 subgoal):
 1. card (R M q q' pP pM) \<le> card (RP M q q' pP pM prs M')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
card (R M q q' pP pM) \<le> card (RP M q q' pP pM prs M')

goal (1 subgoal):
 1. RP M q q' pP pM prs M' \<noteq> R M q q' pP pM \<Longrightarrow> card (R M q q' pP pM) \<le> card (RP M q q' pP pM prs M')
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. RP M q q' pP pM prs M' \<noteq> R M q q' pP pM \<Longrightarrow> card (R M q q' pP pM) \<le> card (RP M q q' pP pM prs M')
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
RP M q q' pP pM prs M' \<noteq> R M q q' pP pM

goal (1 subgoal):
 1. RP M q q' pP pM prs M' \<noteq> R M q q' pP pM \<Longrightarrow> card (R M q q' pP pM) \<le> card (RP M q q' pP pM prs M')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
RP M q q' pP pM prs M' \<noteq> R M q q' pP pM
[PROOF STEP]
obtain pX where "(RP M q q' pP pM prs M') = insert pX (R M q q' pP pM)"
[PROOF STATE]
proof (prove)
using this:
RP M q q' pP pM prs M' \<noteq> R M q q' pP pM

goal (1 subgoal):
 1. (\<And>pX. RP M q q' pP pM prs M' = insert pX (R M q q' pP pM) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using RP_from_R[OF t2 pass1 \<open>completely_specified M'\<close> \<open>inputs M' = inputs M\<close>, of prs "\<lambda> q P io x y y' . q" "\<lambda> q P io x y y' . y" q q' pP pM]
[PROOF STATE]
proof (prove)
using this:
RP M q q' pP pM prs M' \<noteq> R M q q' pP pM
\<lbrakk>\<And>q P. (q, P) \<in> prs \<Longrightarrow> (q, P) \<in> prs; \<And>q P io x y y'. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> (q, P) \<in> prs; \<And>q P io x y y'. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> io @ [(x, y)] \<in> L P; \<And>q P io x y y'. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> RP M q q' pP pM prs M' = R M q q' pP pM \<or> (\<exists>P' pP'. (q', P') \<in> prs \<and> path P' (FSM.initial P') pP' \<and> target (FSM.initial P') pP' = q' \<and> path M (FSM.initial M) pP' \<and> target (FSM.initial M) pP' = q' \<and> p_io pP' \<in> L M' \<and> RP M q q' pP pM prs M' = insert pP' (R M q q' pP pM))

goal (1 subgoal):
 1. (\<And>pX. RP M q q' pP pM prs M' = insert pX (R M q q' pP pM) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
RP M q q' pP pM prs M' = insert pX (R M q q' pP pM)

goal (1 subgoal):
 1. RP M q q' pP pM prs M' \<noteq> R M q q' pP pM \<Longrightarrow> card (R M q q' pP pM) \<le> card (RP M q q' pP pM prs M')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
RP M q q' pP pM prs M' = insert pX (R M q q' pP pM)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
RP M q q' pP pM prs M' = insert pX (R M q q' pP pM)

goal (1 subgoal):
 1. card (R M q q' pP pM) \<le> card (RP M q q' pP pM prs M')
[PROOF STEP]
using finite_R[OF \<open>path M q pM\<close>, of q' pP]
[PROOF STATE]
proof (prove)
using this:
RP M q q' pP pM prs M' = insert pX (R M q q' pP pM)
finite (R M q q' pP pM)

goal (1 subgoal):
 1. card (R M q q' pP pM) \<le> card (RP M q q' pP pM prs M')
[PROOF STEP]
by (simp add: card_insert_le)
[PROOF STATE]
proof (state)
this:
card (R M q q' pP pM) \<le> card (RP M q q' pP pM prs M')

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
card (R M q q' pP pM) \<le> card (RP M q q' pP pM prs M')

goal (1 subgoal):
 1. q' \<notin> snd dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
card (R M q q' pP pM) \<le> card (RP M q q' pP pM prs M')
[PROOF STEP]
have p1: "(\<Sum>q' \<in> (insert q' nds). card (RP M q q' pP pM prs M')) \<ge> ((\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M')) + (card (R M q q' pP pM)))"
[PROOF STATE]
proof (prove)
using this:
card (R M q q' pP pM) \<le> card (RP M q q' pP pM prs M')

goal (1 subgoal):
 1. (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M')) + card (R M q q' pP pM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
by (simp add: insert.hyps(1) insert.hyps(2))
[PROOF STATE]
proof (state)
this:
(\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M')) + card (R M q q' pP pM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))

goal (1 subgoal):
 1. q' \<notin> snd dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
have p2: "length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) = length (filter (\<lambda>t. t_target t \<in> nds) pM) + length (filter (\<lambda>t. t_target t = q') pM)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) = length (filter (\<lambda>t. t_target t \<in> nds) pM) + length (filter (\<lambda>t. t_target t = q') pM)
[PROOF STEP]
using \<open>q' \<notin> nds\<close>
[PROOF STATE]
proof (prove)
using this:
q' \<notin> nds

goal (1 subgoal):
 1. length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) = length (filter (\<lambda>t. t_target t \<in> nds) pM) + length (filter (\<lambda>t. t_target t = q') pM)
[PROOF STEP]
by (induction pM; auto)
[PROOF STATE]
proof (state)
this:
length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) = length (filter (\<lambda>t. t_target t \<in> nds) pM) + length (filter (\<lambda>t. t_target t = q') pM)

goal (1 subgoal):
 1. q' \<notin> snd dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
have p3: "card ((insert q' nds) \<inter> snd dM) = (card (nds \<inter> snd dM))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card (insert q' nds \<inter> snd dM) = card (nds \<inter> snd dM)
[PROOF STEP]
using False \<open>finite nds\<close> \<open>q' \<notin> nds\<close>
[PROOF STATE]
proof (prove)
using this:
q' \<notin> snd dM
finite nds
q' \<notin> nds

goal (1 subgoal):
 1. card (insert q' nds \<inter> snd dM) = card (nds \<inter> snd dM)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
card (insert q' nds \<inter> snd dM) = card (nds \<inter> snd dM)

goal (1 subgoal):
 1. q' \<notin> snd dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
have "length (filter (\<lambda>t. t_target t \<in> nds) pM) + length (filter (\<lambda>t. t_target t = q') pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M')) + length (filter (\<lambda>t. t_target t = q') pM)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length (filter (\<lambda>t. t_target t \<in> nds) pM) + length (filter (\<lambda>t. t_target t = q') pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M')) + length (filter (\<lambda>t. t_target t = q') pM)
[PROOF STEP]
using leq1 add_le_cancel_right
[PROOF STATE]
proof (prove)
using this:
length (filter (\<lambda>t. t_target t \<in> nds) pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M'))
(?a + ?c \<le> ?b + ?c) = (?a \<le> ?b)

goal (1 subgoal):
 1. length (filter (\<lambda>t. t_target t \<in> nds) pM) + length (filter (\<lambda>t. t_target t = q') pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M')) + length (filter (\<lambda>t. t_target t = q') pM)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
length (filter (\<lambda>t. t_target t \<in> nds) pM) + length (filter (\<lambda>t. t_target t = q') pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M')) + length (filter (\<lambda>t. t_target t = q') pM)

goal (1 subgoal):
 1. q' \<notin> snd dM \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
length (filter (\<lambda>t. t_target t \<in> nds) pM) + length (filter (\<lambda>t. t_target t = q') pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M')) + length (filter (\<lambda>t. t_target t = q') pM)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
length (filter (\<lambda>t. t_target t \<in> nds) pM) + length (filter (\<lambda>t. t_target t = q') pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M')) + length (filter (\<lambda>t. t_target t = q') pM)

goal (1 subgoal):
 1. length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
using p1
[PROOF STATE]
proof (prove)
using this:
length (filter (\<lambda>t. t_target t \<in> nds) pM) + length (filter (\<lambda>t. t_target t = q') pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M')) + length (filter (\<lambda>t. t_target t = q') pM)
(\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M')) + card (R M q q' pP pM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))

goal (1 subgoal):
 1. length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
unfolding p2 p3 p4
[PROOF STATE]
proof (prove)
using this:
length (filter (\<lambda>t. t_target t \<in> nds) pM) + length (filter (\<lambda>t. t_target t = q') pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M')) + length (filter (\<lambda>t. t_target t = q') pM)
(\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M')) + length (filter (\<lambda>t. t_target t = q') pM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))

goal (1 subgoal):
 1. length (filter (\<lambda>t. t_target t \<in> nds) pM) + length (filter (\<lambda>t. t_target t = q') pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
length (filter (\<lambda>t. t_target t \<in> insert q' nds) pM) + card (insert q' nds \<inter> snd dM) \<le> (\<Sum>q'\<in>insert q' nds. card (RP M q q' pP pM prs M'))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
length (filter (\<lambda>t. t_target t \<in> nds) pM) + card (nds \<inter> snd dM) \<le> (\<Sum>q'\<in>nds. card (RP M q q' pP pM prs M'))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>finite ?nds; ?nds \<subseteq> fst dM\<rbrakk> \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> ?nds) pM) + card (?nds \<inter> snd dM) \<le> (\<Sum>q'\<in>?nds. card (RP M q q' pP pM prs M'))

goal (1 subgoal):
 1. Suc m \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<lbrakk>finite ?nds; ?nds \<subseteq> fst dM\<rbrakk> \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> ?nds) pM) + card (?nds \<inter> snd dM) \<le> (\<Sum>q'\<in>?nds. card (RP M q q' pP pM prs M'))

goal (1 subgoal):
 1. Suc m \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))
[PROOF STEP]
have "finite (fst dM)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite (fst dM)
[PROOF STEP]
using t7[OF \<open>dM \<in> set repetition_sets\<close>] fsm_states_finite[of M]
[PROOF STATE]
proof (prove)
using this:
fst dM \<subseteq> FSM.states M
finite (FSM.states M)

goal (1 subgoal):
 1. finite (fst dM)
[PROOF STEP]
using rev_finite_subset
[PROOF STATE]
proof (prove)
using this:
fst dM \<subseteq> FSM.states M
finite (FSM.states M)
\<lbrakk>finite ?B; ?A \<subseteq> ?B\<rbrakk> \<Longrightarrow> finite ?A

goal (1 subgoal):
 1. finite (fst dM)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
finite (fst dM)

goal (1 subgoal):
 1. Suc m \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>finite ?nds; ?nds \<subseteq> fst dM\<rbrakk> \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> ?nds) pM) + card (?nds \<inter> snd dM) \<le> (\<Sum>q'\<in>?nds. card (RP M q q' pP pM prs M'))
finite (fst dM)
[PROOF STEP]
have "(\<Sum> q' \<in> fst dM . card (RP M q q' pP pM prs M')) \<ge> length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (fst dM \<inter> snd dM)"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>finite ?nds; ?nds \<subseteq> fst dM\<rbrakk> \<Longrightarrow> length (filter (\<lambda>t. t_target t \<in> ?nds) pM) + card (?nds \<inter> snd dM) \<le> (\<Sum>q'\<in>?nds. card (RP M q q' pP pM prs M'))
finite (fst dM)

goal (1 subgoal):
 1. length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (fst dM \<inter> snd dM) \<le> (\<Sum>q'\<in>fst dM. card (RP M q q' pP pM prs M'))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (fst dM \<inter> snd dM) \<le> (\<Sum>q'\<in>fst dM. card (RP M q q' pP pM prs M'))

goal (1 subgoal):
 1. Suc m \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))
[PROOF STEP]
have "(fst dM \<inter> snd dM) = (snd dM)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fst dM \<inter> snd dM = snd dM
[PROOF STEP]
using t8[OF \<open>dM \<in> set repetition_sets\<close>]
[PROOF STATE]
proof (prove)
using this:
snd dM \<subseteq> fst dM

goal (1 subgoal):
 1. fst dM \<inter> snd dM = snd dM
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
fst dM \<inter> snd dM = snd dM

goal (1 subgoal):
 1. Suc m \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))
[PROOF STEP]
have "(\<Sum> q' \<in> fst dM . card (RP M q q' pP pM prs M')) \<ge> length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (snd dM)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (snd dM) \<le> (\<Sum>q'\<in>fst dM. card (RP M q q' pP pM prs M'))
[PROOF STEP]
using \<open>(\<Sum> q' \<in> fst dM . card (RP M q q' pP pM prs M')) \<ge> length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (fst dM \<inter> snd dM)\<close>
[PROOF STATE]
proof (prove)
using this:
length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (fst dM \<inter> snd dM) \<le> (\<Sum>q'\<in>fst dM. card (RP M q q' pP pM prs M'))

goal (1 subgoal):
 1. length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (snd dM) \<le> (\<Sum>q'\<in>fst dM. card (RP M q q' pP pM prs M'))
[PROOF STEP]
unfolding \<open>(fst dM \<inter> snd dM) = (snd dM)\<close>
[PROOF STATE]
proof (prove)
using this:
length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (snd dM) \<le> (\<Sum>q'\<in>fst dM. card (RP M q q' pP pM prs M'))

goal (1 subgoal):
 1. length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (snd dM) \<le> (\<Sum>q'\<in>fst dM. card (RP M q q' pP pM prs M'))
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (snd dM) \<le> (\<Sum>q'\<in>fst dM. card (RP M q q' pP pM prs M'))

goal (1 subgoal):
 1. Suc m \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (snd dM) \<le> (\<Sum>q'\<in>fst dM. card (RP M q q' pP pM prs M'))

goal (1 subgoal):
 1. Suc m \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))
[PROOF STEP]
have "(\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M'))) = (\<Sum> q' \<in> fst dM . card (RP M q q' pP pM prs M'))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M'))) = (\<Sum>q'\<in>fst dM. card (RP M q q' pP pM prs M'))
[PROOF STEP]
using RP_card \<open>FSM.initial P = FSM.initial M\<close> \<open>target (FSM.initial P) pP = q\<close>
[PROOF STATE]
proof (prove)
using this:
card (\<Union>pR\<in>RP M (target (FSM.initial M) pP) ?q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')) = card (RP M (target (FSM.initial M) pP) ?q' pP pM prs M')
FSM.initial P = FSM.initial M
target (FSM.initial P) pP = q

goal (1 subgoal):
 1. (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M'))) = (\<Sum>q'\<in>fst dM. card (RP M q q' pP pM prs M'))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M'))) = (\<Sum>q'\<in>fst dM. card (RP M q q' pP pM prs M'))

goal (1 subgoal):
 1. Suc m \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (snd dM) \<le> (\<Sum>q'\<in>fst dM. card (RP M q q' pP pM prs M'))
(\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M'))) = (\<Sum>q'\<in>fst dM. card (RP M q q' pP pM prs M'))
[PROOF STEP]
have "(\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M'))) \<ge> length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (snd dM)"
[PROOF STATE]
proof (prove)
using this:
length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (snd dM) \<le> (\<Sum>q'\<in>fst dM. card (RP M q q' pP pM prs M'))
(\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M'))) = (\<Sum>q'\<in>fst dM. card (RP M q q' pP pM prs M'))

goal (1 subgoal):
 1. length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (snd dM) \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))
[PROOF STEP]
by linarith
[PROOF STATE]
proof (state)
this:
length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (snd dM) \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))

goal (1 subgoal):
 1. Suc m \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (snd dM) \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))

goal (1 subgoal):
 1. Suc m \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))
[PROOF STEP]
have "Suc m \<le> length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (snd dM)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Suc m \<le> length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (snd dM)
[PROOF STEP]
using \<open>Suc (m - card (snd dM)) \<le> length (filter (\<lambda>t. t_target t \<in> fst dM) pM)\<close>
[PROOF STATE]
proof (prove)
using this:
Suc (m - card (snd dM)) \<le> length (filter (\<lambda>t. t_target t \<in> fst dM) pM)

goal (1 subgoal):
 1. Suc m \<le> length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (snd dM)
[PROOF STEP]
by linarith
[PROOF STATE]
proof (state)
this:
Suc m \<le> length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (snd dM)

goal (1 subgoal):
 1. Suc m \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (snd dM) \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))
Suc m \<le> length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (snd dM)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (snd dM) \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))
Suc m \<le> length (filter (\<lambda>t. t_target t \<in> fst dM) pM) + card (snd dM)

goal (1 subgoal):
 1. Suc m \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))
[PROOF STEP]
by linarith
[PROOF STATE]
proof (state)
this:
Suc m \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
Suc m \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Suc m \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have "(\<Sum> q' \<in> fst dM . card (\<Union> pR \<in> (RP M q q' pP pM prs M') . io_targets M' (p_io pR) (initial M'))) \<le> card (states M')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M'))) \<le> card (FSM.states M')
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M'))) \<le> card (FSM.states M')
[PROOF STEP]
have "finite (fst dM)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite (fst dM)
[PROOF STEP]
by (meson \<open>dM \<in> set repetition_sets\<close> fsm_states_finite rev_finite_subset t7)
[PROOF STATE]
proof (state)
this:
finite (fst dM)

goal (1 subgoal):
 1. (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M'))) \<le> card (FSM.states M')
[PROOF STEP]
have "(\<And>x1. finite (RP M q x1 pP pM prs M'))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x1. finite (RP M q x1 pP pM prs M')
[PROOF STEP]
using finite_RP[OF \<open>path M q pM\<close> t2 pass1 \<open>completely_specified M'\<close> \<open>inputs M' = inputs M\<close>]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>q P. (q, P) \<in> ?PS \<Longrightarrow> (q, P) \<in> prs; \<And>q P io x y y'. \<lbrakk>(q, P) \<in> ?PS; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> (?q1 q P io x y y', P) \<in> prs; \<And>q P io x y y'. \<lbrakk>(q, P) \<in> ?PS; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> io @ [(x, ?y1 q P io x y y')] \<in> L P; \<And>q P io x y y'. \<lbrakk>(q, P) \<in> ?PS; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> finite (RP M q ?q' ?pP pM ?PS M')

goal (1 subgoal):
 1. \<And>x1. finite (RP M q x1 pP pM prs M')
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
finite (RP M q ?x1.0 pP pM prs M')

goal (1 subgoal):
 1. (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M'))) \<le> card (FSM.states M')
[PROOF STEP]
have "(\<And>y1. finite (io_targets M' (p_io y1) (FSM.initial M')))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>y1. finite (io_targets M' (p_io y1) (FSM.initial M'))
[PROOF STEP]
by (meson io_targets_finite)
[PROOF STATE]
proof (state)
this:
finite (io_targets M' (p_io ?y1.0) (FSM.initial M'))

goal (1 subgoal):
 1. (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M'))) \<le> card (FSM.states M')
[PROOF STEP]
have "(\<And>y1. io_targets M' (p_io y1) (FSM.initial M') \<subseteq> states M')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>y1. io_targets M' (p_io y1) (FSM.initial M') \<subseteq> FSM.states M'
[PROOF STEP]
by (meson io_targets_states)
[PROOF STATE]
proof (state)
this:
io_targets M' (p_io ?y1.1) (FSM.initial M') \<subseteq> FSM.states M'

goal (1 subgoal):
 1. (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M'))) \<le> card (FSM.states M')
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M'))) \<le> card (FSM.states M')
[PROOF STEP]
using distinct_union_union_card
        [ of "fst dM" "\<lambda> q' . (RP M q q' pP pM prs M')" "\<lambda> pR . io_targets M' (p_io pR) (initial M')"
        , OF \<open>finite (fst dM)\<close>
             no_shared_targets_for_distinct_states
             no_shared_targets_for_identical_states
             \<open>(\<And>x1. finite (RP M q x1 pP pM prs M'))\<close>
             io_targets_finite
             io_targets_states
             fsm_states_finite[of M']]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>x1 x2 y1 y2. \<lbrakk>x1 \<noteq> x2; x1 \<in> fst dM; x2 \<in> fst dM; y1 \<in> RP M q x1 pP pM prs M'; y2 \<in> RP M q x2 pP pM prs M'\<rbrakk> \<Longrightarrow> ?q'5 x1 x2 y1 y2 \<noteq> ?q''5 x1 x2 y1 y2; \<And>x1 x2 y1 y2. \<lbrakk>x1 \<noteq> x2; x1 \<in> fst dM; x2 \<in> fst dM; y1 \<in> RP M q x1 pP pM prs M'; y2 \<in> RP M q x2 pP pM prs M'\<rbrakk> \<Longrightarrow> ?q'5 x1 x2 y1 y2 \<in> fst dM; \<And>x1 x2 y1 y2. \<lbrakk>x1 \<noteq> x2; x1 \<in> fst dM; x2 \<in> fst dM; y1 \<in> RP M q x1 pP pM prs M'; y2 \<in> RP M q x2 pP pM prs M'\<rbrakk> \<Longrightarrow> ?q''5 x1 x2 y1 y2 \<in> fst dM; \<And>x1 x2 y1 y2. \<lbrakk>x1 \<noteq> x2; x1 \<in> fst dM; x2 \<in> fst dM; y1 \<in> RP M q x1 pP pM prs M'; y2 \<in> RP M q x2 pP pM prs M'\<rbrakk> \<Longrightarrow> y1 \<in> RP M q (?q'5 x1 x2 y1 y2) pP pM prs M'; \<And>x1 x2 y1 y2. \<lbrakk>x1 \<noteq> x2; x1 \<in> fst dM; x2 \<in> fst dM; y1 \<in> RP M q x1 pP pM prs M'; y2 \<in> RP M q x2 pP pM prs M'\<rbrakk> \<Longrightarrow> y2 \<in> RP M q (?q''5 x1 x2 y1 y2) pP pM prs M'; \<And>x1 y1 y2. \<lbrakk>y1 \<in> RP M q x1 pP pM prs M'; y2 \<in> RP M q x1 pP pM prs M'; y1 \<noteq> y2\<rbrakk> \<Longrightarrow> y1 \<in> RP M (target (FSM.initial M) pP) (?q'4 x1 y1 y2) pP pM prs M'; \<And>x1 y1 y2. \<lbrakk>y1 \<in> RP M q x1 pP pM prs M'; y2 \<in> RP M q x1 pP pM prs M'; y1 \<noteq> y2\<rbrakk> \<Longrightarrow> y2 \<in> RP M (target (FSM.initial M) pP) (?q'4 x1 y1 y2) pP pM prs M'; \<And>x1 y1 y2. \<lbrakk>y1 \<in> RP M q x1 pP pM prs M'; y2 \<in> RP M q x1 pP pM prs M'; y1 \<noteq> y2\<rbrakk> \<Longrightarrow> y1 \<noteq> y2\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>fst dM. card (\<Union>y\<in>RP M q x pP pM prs M'. io_targets M' (p_io y) (FSM.initial M'))) \<le> card (FSM.states M')

goal (1 subgoal):
 1. (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M'))) \<le> card (FSM.states M')
[PROOF STEP]
unfolding \<open>(target (FSM.initial M) pP) = q\<close>
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>x1 x2 y1 y2. \<lbrakk>x1 \<noteq> x2; x1 \<in> fst dM; x2 \<in> fst dM; y1 \<in> RP M q x1 pP pM prs M'; y2 \<in> RP M q x2 pP pM prs M'\<rbrakk> \<Longrightarrow> ?q'5 x1 x2 y1 y2 \<noteq> ?q''5 x1 x2 y1 y2; \<And>x1 x2 y1 y2. \<lbrakk>x1 \<noteq> x2; x1 \<in> fst dM; x2 \<in> fst dM; y1 \<in> RP M q x1 pP pM prs M'; y2 \<in> RP M q x2 pP pM prs M'\<rbrakk> \<Longrightarrow> ?q'5 x1 x2 y1 y2 \<in> fst dM; \<And>x1 x2 y1 y2. \<lbrakk>x1 \<noteq> x2; x1 \<in> fst dM; x2 \<in> fst dM; y1 \<in> RP M q x1 pP pM prs M'; y2 \<in> RP M q x2 pP pM prs M'\<rbrakk> \<Longrightarrow> ?q''5 x1 x2 y1 y2 \<in> fst dM; \<And>x1 x2 y1 y2. \<lbrakk>x1 \<noteq> x2; x1 \<in> fst dM; x2 \<in> fst dM; y1 \<in> RP M q x1 pP pM prs M'; y2 \<in> RP M q x2 pP pM prs M'\<rbrakk> \<Longrightarrow> y1 \<in> RP M q (?q'5 x1 x2 y1 y2) pP pM prs M'; \<And>x1 x2 y1 y2. \<lbrakk>x1 \<noteq> x2; x1 \<in> fst dM; x2 \<in> fst dM; y1 \<in> RP M q x1 pP pM prs M'; y2 \<in> RP M q x2 pP pM prs M'\<rbrakk> \<Longrightarrow> y2 \<in> RP M q (?q''5 x1 x2 y1 y2) pP pM prs M'; \<And>x1 y1 y2. \<lbrakk>y1 \<in> RP M q x1 pP pM prs M'; y2 \<in> RP M q x1 pP pM prs M'; y1 \<noteq> y2\<rbrakk> \<Longrightarrow> y1 \<in> RP M q (?q'4 x1 y1 y2) pP pM prs M'; \<And>x1 y1 y2. \<lbrakk>y1 \<in> RP M q x1 pP pM prs M'; y2 \<in> RP M q x1 pP pM prs M'; y1 \<noteq> y2\<rbrakk> \<Longrightarrow> y2 \<in> RP M q (?q'4 x1 y1 y2) pP pM prs M'; \<And>x1 y1 y2. \<lbrakk>y1 \<in> RP M q x1 pP pM prs M'; y2 \<in> RP M q x1 pP pM prs M'; y1 \<noteq> y2\<rbrakk> \<Longrightarrow> y1 \<noteq> y2\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>fst dM. card (\<Union>y\<in>RP M q x pP pM prs M'. io_targets M' (p_io y) (FSM.initial M'))) \<le> card (FSM.states M')

goal (1 subgoal):
 1. (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M'))) \<le> card (FSM.states M')
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
(\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M'))) \<le> card (FSM.states M')

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M'))) \<le> card (FSM.states M')

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
(* create a contradiction due to the assumption that M' has at most m states *)
[PROOF STATE]
proof (state)
this:
(\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M'))) \<le> card (FSM.states M')

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M'))) \<le> card (FSM.states M')

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
have "card (states M') \<le> m"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card (FSM.states M') \<le> m
[PROOF STEP]
using \<open>size M' \<le> m\<close>
[PROOF STATE]
proof (prove)
using this:
FSM.size M' \<le> m

goal (1 subgoal):
 1. card (FSM.states M') \<le> m
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
card (FSM.states M') \<le> m

goal (1 subgoal):
 1. \<not> L M' \<subseteq> L M \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
Suc m \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))
(\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M'))) \<le> card (FSM.states M')
card (FSM.states M') \<le> m
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
Suc m \<le> (\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M')))
(\<Sum>q'\<in>fst dM. card (\<Union>pR\<in>RP M q q' pP pM prs M'. io_targets M' (p_io pR) (FSM.initial M'))) \<le> card (FSM.states M')
card (FSM.states M') \<le> m

goal (1 subgoal):
 1. False
[PROOF STEP]
by linarith
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed