[STATEMENT]
lemma test_suite_to_io_pass :
  assumes "implies_completeness T M m"
  and     "observable M"
  and     "observable M'"
  and     "inputs M' = inputs M"
  and     "inputs M \<noteq> {}"
  and     "completely_specified M"
  and     "completely_specified M'"
shows "pass_io_set M' (test_suite_to_io M T) = passes_test_suite M T M'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pass_io_set M' (test_suite_to_io M T) = passes_test_suite M T M'
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. pass_io_set M' (test_suite_to_io M T) = passes_test_suite M T M'
[PROOF STEP]
obtain prs tps rd_targets atcs where "T = Test_Suite prs tps rd_targets atcs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>prs tps rd_targets atcs. T = Test_Suite prs tps rd_targets atcs \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (meson test_suite.exhaust)
[PROOF STATE]
proof (state)
this:
T = Test_Suite prs tps rd_targets atcs

goal (1 subgoal):
 1. pass_io_set M' (test_suite_to_io M T) = passes_test_suite M T M'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
T = Test_Suite prs tps rd_targets atcs
[PROOF STEP]
obtain repetition_sets where repetition_sets_def: "implies_completeness_for_repetition_sets (Test_Suite prs tps rd_targets atcs) M m repetition_sets"
[PROOF STATE]
proof (prove)
using this:
T = Test_Suite prs tps rd_targets atcs

goal (1 subgoal):
 1. (\<And>repetition_sets. implies_completeness_for_repetition_sets (Test_Suite prs tps rd_targets atcs) M m repetition_sets \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using assms(1)
[PROOF STATE]
proof (prove)
using this:
T = Test_Suite prs tps rd_targets atcs
implies_completeness T M m

goal (1 subgoal):
 1. (\<And>repetition_sets. implies_completeness_for_repetition_sets (Test_Suite prs tps rd_targets atcs) M m repetition_sets \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding implies_completeness_def
[PROOF STATE]
proof (prove)
using this:
T = Test_Suite prs tps rd_targets atcs
Ex (implies_completeness_for_repetition_sets T M m)

goal (1 subgoal):
 1. (\<And>repetition_sets. implies_completeness_for_repetition_sets (Test_Suite prs tps rd_targets atcs) M m repetition_sets \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
implies_completeness_for_repetition_sets (Test_Suite prs tps rd_targets atcs) M m repetition_sets

goal (1 subgoal):
 1. pass_io_set M' (test_suite_to_io M T) = passes_test_suite M T M'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
implies_completeness_for_repetition_sets (Test_Suite prs tps rd_targets atcs) M m repetition_sets
[PROOF STEP]
have "implies_completeness (Test_Suite prs tps rd_targets atcs) M m"
[PROOF STATE]
proof (prove)
using this:
implies_completeness_for_repetition_sets (Test_Suite prs tps rd_targets atcs) M m repetition_sets

goal (1 subgoal):
 1. implies_completeness (Test_Suite prs tps rd_targets atcs) M m
[PROOF STEP]
unfolding implies_completeness_def
[PROOF STATE]
proof (prove)
using this:
implies_completeness_for_repetition_sets (Test_Suite prs tps rd_targets atcs) M m repetition_sets

goal (1 subgoal):
 1. Ex (implies_completeness_for_repetition_sets (Test_Suite prs tps rd_targets atcs) M m)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
implies_completeness (Test_Suite prs tps rd_targets atcs) M m

goal (1 subgoal):
 1. pass_io_set M' (test_suite_to_io M T) = passes_test_suite M T M'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
implies_completeness (Test_Suite prs tps rd_targets atcs) M m
[PROOF STEP]
have test_suite_language_prop: "test_suite_to_io M (Test_Suite prs tps rd_targets atcs) \<subseteq> L M"
[PROOF STATE]
proof (prove)
using this:
implies_completeness (Test_Suite prs tps rd_targets atcs) M m

goal (1 subgoal):
 1. test_suite_to_io M (Test_Suite prs tps rd_targets atcs) \<subseteq> L M
[PROOF STEP]
using test_suite_to_io_language
[PROOF STATE]
proof (prove)
using this:
implies_completeness (Test_Suite prs tps rd_targets atcs) M m
implies_completeness ?T ?M ?m \<Longrightarrow> test_suite_to_io ?M ?T \<subseteq> L ?M

goal (1 subgoal):
 1. test_suite_to_io M (Test_Suite prs tps rd_targets atcs) \<subseteq> L M
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
test_suite_to_io M (Test_Suite prs tps rd_targets atcs) \<subseteq> L M

goal (1 subgoal):
 1. pass_io_set M' (test_suite_to_io M T) = passes_test_suite M T M'
[PROOF STEP]
have t1: "(initial M, initial_preamble M) \<in> prs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (FSM.initial M, initial_preamble M) \<in> prs
[PROOF STEP]
using implies_completeness_for_repetition_sets_simps(1)[OF repetition_sets_def]
[PROOF STATE]
proof (prove)
using this:
(FSM.initial M, initial_preamble M) \<in> prs

goal (1 subgoal):
 1. (FSM.initial M, initial_preamble M) \<in> prs
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
(FSM.initial M, initial_preamble M) \<in> prs

goal (1 subgoal):
 1. pass_io_set M' (test_suite_to_io M T) = passes_test_suite M T M'
[PROOF STEP]
have t2: "\<And> q P. (q, P) \<in> prs \<Longrightarrow> is_preamble P M q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q P. (q, P) \<in> prs \<Longrightarrow> is_preamble P M q
[PROOF STEP]
using implies_completeness_for_repetition_sets_simps(2)[OF repetition_sets_def]
[PROOF STATE]
proof (prove)
using this:
(?q, ?P) \<in> prs \<Longrightarrow> is_preamble ?P M ?q \<and> tps ?q \<noteq> {}

goal (1 subgoal):
 1. \<And>q P. (q, P) \<in> prs \<Longrightarrow> is_preamble P M q
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(?q, ?P) \<in> prs \<Longrightarrow> is_preamble ?P M ?q

goal (1 subgoal):
 1. pass_io_set M' (test_suite_to_io M T) = passes_test_suite M T M'
[PROOF STEP]
have t3: "\<And> q1 q2 A d1 d2. (A, d1, d2) \<in> atcs (q1, q2) \<Longrightarrow> (A, d2, d1) \<in> atcs (q2, q1) \<and> is_separator M q1 q2 A d1 d2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q1 q2 A d1 d2. (A, d1, d2) \<in> atcs (q1, q2) \<Longrightarrow> (A, d2, d1) \<in> atcs (q2, q1) \<and> is_separator M q1 q2 A d1 d2
[PROOF STEP]
using implies_completeness_for_repetition_sets_simps(3)[OF repetition_sets_def]
[PROOF STATE]
proof (prove)
using this:
(?A, ?d1.0, ?d2.0) \<in> atcs (?q1.0, ?q2.0) \<Longrightarrow> (?A, ?d2.0, ?d1.0) \<in> atcs (?q2.0, ?q1.0) \<and> is_separator M ?q1.0 ?q2.0 ?A ?d1.0 ?d2.0

goal (1 subgoal):
 1. \<And>q1 q2 A d1 d2. (A, d1, d2) \<in> atcs (q1, q2) \<Longrightarrow> (A, d2, d1) \<in> atcs (q2, q1) \<and> is_separator M q1 q2 A d1 d2
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
(?A, ?d1.0, ?d2.0) \<in> atcs (?q1.0, ?q2.0) \<Longrightarrow> (?A, ?d2.0, ?d1.0) \<in> atcs (?q2.0, ?q1.0) \<and> is_separator M ?q1.0 ?q2.0 ?A ?d1.0 ?d2.0

goal (1 subgoal):
 1. pass_io_set M' (test_suite_to_io M T) = passes_test_suite M T M'
[PROOF STEP]
have t5: "\<And>q. q \<in> FSM.states M \<Longrightarrow> (\<exists>d\<in>set repetition_sets. q \<in> fst d)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q. q \<in> FSM.states M \<Longrightarrow> \<exists>d\<in>set repetition_sets. q \<in> fst d
[PROOF STEP]
using implies_completeness_for_repetition_sets_simps(4)[OF repetition_sets_def]
[PROOF STATE]
proof (prove)
using this:
?q \<in> FSM.states M \<Longrightarrow> \<exists>d\<in>set repetition_sets. ?q \<in> fst d

goal (1 subgoal):
 1. \<And>q. q \<in> FSM.states M \<Longrightarrow> \<exists>d\<in>set repetition_sets. q \<in> fst d
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
?q \<in> FSM.states M \<Longrightarrow> \<exists>d\<in>set repetition_sets. ?q \<in> fst d

goal (1 subgoal):
 1. pass_io_set M' (test_suite_to_io M T) = passes_test_suite M T M'
[PROOF STEP]
have t6: "\<And> q. q \<in> fst ` prs \<Longrightarrow> tps q \<subseteq> {p1 . \<exists> p2 d . (p1@p2,d) \<in> m_traversal_paths_with_witness M q repetition_sets m} \<and> fst ` (m_traversal_paths_with_witness M q repetition_sets m) \<subseteq> tps q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q. q \<in> fst ` prs \<Longrightarrow> tps q \<subseteq> {p1. \<exists>p2 d. (p1 @ p2, d) \<in> m_traversal_paths_with_witness M q repetition_sets m} \<and> fst ` m_traversal_paths_with_witness M q repetition_sets m \<subseteq> tps q
[PROOF STEP]
using implies_completeness_for_repetition_sets_simps(7)[OF repetition_sets_def]
[PROOF STATE]
proof (prove)
using this:
?q \<in> fst ` prs \<Longrightarrow> tps ?q \<subseteq> {p1. \<exists>p2 d. (p1 @ p2, d) \<in> m_traversal_paths_with_witness M ?q repetition_sets m} \<and> fst ` m_traversal_paths_with_witness M ?q repetition_sets m \<subseteq> tps ?q

goal (1 subgoal):
 1. \<And>q. q \<in> fst ` prs \<Longrightarrow> tps q \<subseteq> {p1. \<exists>p2 d. (p1 @ p2, d) \<in> m_traversal_paths_with_witness M q repetition_sets m} \<and> fst ` m_traversal_paths_with_witness M q repetition_sets m \<subseteq> tps q
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
?q \<in> fst ` prs \<Longrightarrow> tps ?q \<subseteq> {p1. \<exists>p2 d. (p1 @ p2, d) \<in> m_traversal_paths_with_witness M ?q repetition_sets m} \<and> fst ` m_traversal_paths_with_witness M ?q repetition_sets m \<subseteq> tps ?q

goal (1 subgoal):
 1. pass_io_set M' (test_suite_to_io M T) = passes_test_suite M T M'
[PROOF STEP]
have t7: "\<And> d. d \<in> set repetition_sets \<Longrightarrow> fst d \<subseteq> FSM.states M"
  and  t8: "\<And> d. d \<in> set repetition_sets \<Longrightarrow> snd d \<subseteq> fst d"
  and  t8':  "\<And> d. d \<in> set repetition_sets \<Longrightarrow> snd d = fst d \<inter> fst ` prs"
  and  t9: "\<And> d q1 q2. d \<in> set repetition_sets \<Longrightarrow> q1 \<in> fst d \<Longrightarrow> q2 \<in> fst d \<Longrightarrow> q1 \<noteq> q2 \<Longrightarrow> atcs (q1, q2) \<noteq> {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<And>d. d \<in> set repetition_sets \<Longrightarrow> fst d \<subseteq> FSM.states M) &&& (\<And>d. d \<in> set repetition_sets \<Longrightarrow> snd d \<subseteq> fst d)) &&& (\<And>d. d \<in> set repetition_sets \<Longrightarrow> snd d = fst d \<inter> fst ` prs) &&& (\<And>d q1 q2. \<lbrakk>d \<in> set repetition_sets; q1 \<in> fst d; q2 \<in> fst d; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> atcs (q1, q2) \<noteq> {})
[PROOF STEP]
using implies_completeness_for_repetition_sets_simps(5,6)[OF repetition_sets_def]
[PROOF STATE]
proof (prove)
using this:
?d \<in> set repetition_sets \<Longrightarrow> fst ?d \<subseteq> FSM.states M \<and> snd ?d = fst ?d \<inter> fst ` prs
\<lbrakk>?d \<in> set repetition_sets; ?q1.0 \<in> fst ?d; ?q2.0 \<in> fst ?d; ?q1.0 \<noteq> ?q2.0\<rbrakk> \<Longrightarrow> atcs (?q1.0, ?q2.0) \<noteq> {}

goal (1 subgoal):
 1. ((\<And>d. d \<in> set repetition_sets \<Longrightarrow> fst d \<subseteq> FSM.states M) &&& (\<And>d. d \<in> set repetition_sets \<Longrightarrow> snd d \<subseteq> fst d)) &&& (\<And>d. d \<in> set repetition_sets \<Longrightarrow> snd d = fst d \<inter> fst ` prs) &&& (\<And>d q1 q2. \<lbrakk>d \<in> set repetition_sets; q1 \<in> fst d; q2 \<in> fst d; q1 \<noteq> q2\<rbrakk> \<Longrightarrow> atcs (q1, q2) \<noteq> {})
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
?d \<in> set repetition_sets \<Longrightarrow> fst ?d \<subseteq> FSM.states M
?d \<in> set repetition_sets \<Longrightarrow> snd ?d \<subseteq> fst ?d
?d \<in> set repetition_sets \<Longrightarrow> snd ?d = fst ?d \<inter> fst ` prs
\<lbrakk>?d \<in> set repetition_sets; ?q1.0 \<in> fst ?d; ?q2.0 \<in> fst ?d; ?q1.0 \<noteq> ?q2.0\<rbrakk> \<Longrightarrow> atcs (?q1.0, ?q2.0) \<noteq> {}

goal (1 subgoal):
 1. pass_io_set M' (test_suite_to_io M T) = passes_test_suite M T M'
[PROOF STEP]
have "pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs)) \<Longrightarrow> passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs)) \<Longrightarrow> passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs)) \<Longrightarrow> passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'
[PROOF STEP]
assume "pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))"
[PROOF STATE]
proof (state)
this:
pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))

goal (1 subgoal):
 1. pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs)) \<Longrightarrow> passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))
[PROOF STEP]
have pass_io_prop: "\<And> io x y y' . io @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs) \<Longrightarrow> io @ [(x, y')] \<in> L M' \<Longrightarrow> io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)"
[PROOF STATE]
proof (prove)
using this:
pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs); io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
unfolding pass_io_set_def
[PROOF STATE]
proof (prove)
using this:
\<forall>io x y. io @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs) \<longrightarrow> (\<forall>y'. io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs))

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs); io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>?io @ [(?x, ?y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs); ?io @ [(?x, ?y')] \<in> L M'\<rbrakk> \<Longrightarrow> ?io @ [(?x, ?y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs)) \<Longrightarrow> passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'
[PROOF STEP]
show "passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'
[PROOF STEP]
proof (rule ccontr)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> passes_test_suite M (Test_Suite prs tps rd_targets atcs) M' \<Longrightarrow> False
[PROOF STEP]
assume "\<not> passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'"
[PROOF STATE]
proof (state)
this:
\<not> passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'

goal (1 subgoal):
 1. \<not> passes_test_suite M (Test_Suite prs tps rd_targets atcs) M' \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'
[PROOF STEP]
consider (a) "\<not> (\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P)" |
                    (b) "\<not> ((\<forall>q P pP ioT pT x y y'.
                              (q, P) \<in> prs \<longrightarrow>
                              path P (FSM.initial P) pP \<longrightarrow>
                              target (FSM.initial P) pP = q \<longrightarrow>
                              pT \<in> tps q \<longrightarrow>
                              ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow>
                              p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))))" |
                    (c) "\<not> ((\<forall>q P pP pT.
                              (q, P) \<in> prs \<longrightarrow>
                              path P (FSM.initial P) pP \<longrightarrow>
                              target (FSM.initial P) pP = q \<longrightarrow>
                              pT \<in> tps q \<longrightarrow>
                              p_io pP @ p_io pT \<in> L M' \<longrightarrow>
                              (\<forall>q' A d1 d2 qT.
                                  q' \<in> rd_targets (q, pT) \<longrightarrow>
                                  (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)))"
[PROOF STATE]
proof (prove)
using this:
\<not> passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'

goal (1 subgoal):
 1. \<lbrakk>\<not> (\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P) \<Longrightarrow> thesis; \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> thesis; \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
unfolding passes_test_suite.simps
[PROOF STATE]
proof (prove)
using this:
\<not> ((\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P) \<and> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<and> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)))

goal (1 subgoal):
 1. \<lbrakk>\<not> (\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P) \<Longrightarrow> thesis; \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> thesis; \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<not> (\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P) \<Longrightarrow> ?thesis; \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> ?thesis; \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. \<not> passes_test_suite M (Test_Suite prs tps rd_targets atcs) M' \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>\<not> (\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P) \<Longrightarrow> ?thesis; \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> ?thesis; \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<not> (\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P) \<Longrightarrow> ?thesis; \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> ?thesis; \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. False
[PROOF STEP]
proof cases
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<not> (\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 3. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
case a
[PROOF STATE]
proof (state)
this:
\<not> (\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P)

goal (3 subgoals):
 1. \<not> (\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 3. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> (\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P)
[PROOF STEP]
obtain q P io x y y' where "(q, P) \<in> prs"
                                    and "io @ [(x, y)] \<in> L P"
                                    and "io @ [(x, y')] \<in> L M'"
                                    and "io @ [(x, y')] \<notin> L P"
[PROOF STATE]
proof (prove)
using this:
\<not> (\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P)

goal (1 subgoal):
 1. (\<And>q P io x y y'. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'; io @ [(x, y')] \<notin> L P\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(q, P) \<in> prs
io @ [(x, y)] \<in> L P
io @ [(x, y')] \<in> L M'
io @ [(x, y')] \<notin> L P

goal (3 subgoals):
 1. \<not> (\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 3. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "is_preamble P M q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_preamble P M q
[PROOF STEP]
using t2[OF \<open>(q, P) \<in> prs\<close>]
[PROOF STATE]
proof (prove)
using this:
is_preamble P M q

goal (1 subgoal):
 1. is_preamble P M q
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
is_preamble P M q

goal (3 subgoals):
 1. \<not> (\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 3. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "io @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. io @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
unfolding test_suite_to_io.simps
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. io @ [(x, y)] \<in> (\<Union>(q, P)\<in>prs. L P) \<union> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q} \<union> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')}
[PROOF STEP]
using \<open>(q, P) \<in> prs\<close> \<open>io @ [(x, y)] \<in> L P\<close>
[PROOF STATE]
proof (prove)
using this:
(q, P) \<in> prs
io @ [(x, y)] \<in> L P

goal (1 subgoal):
 1. io @ [(x, y)] \<in> (\<Union>(q, P)\<in>prs. L P) \<union> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q} \<union> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')}
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
io @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (3 subgoals):
 1. \<not> (\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 3. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
using pass_io_prop[OF \<open>io @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)\<close> \<open>io @ [(x, y')] \<in> L M'\<close>]
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (3 subgoals):
 1. \<not> (\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 3. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
have "io @ [(x, y')] \<in> L M"
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. io @ [(x, y')] \<in> L M
[PROOF STEP]
using test_suite_language_prop
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
test_suite_to_io M (Test_Suite prs tps rd_targets atcs) \<subseteq> L M

goal (1 subgoal):
 1. io @ [(x, y')] \<in> L M
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
io @ [(x, y')] \<in> L M

goal (3 subgoals):
 1. \<not> (\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 3. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "io @ [(x, y')] \<in> L P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. io @ [(x, y')] \<in> L P
[PROOF STEP]
using passes_test_suite_soundness_helper_1[OF \<open>is_preamble P M q\<close> \<open>observable M\<close> \<open>io @ [(x, y)] \<in> L P\<close> \<open>io @ [(x, y')] \<in> L M\<close>]
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> L P

goal (1 subgoal):
 1. io @ [(x, y')] \<in> L P
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
io @ [(x, y')] \<in> L P

goal (3 subgoals):
 1. \<not> (\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 3. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
io @ [(x, y')] \<in> L P
[PROOF STEP]
show "False"
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> L P

goal (1 subgoal):
 1. False
[PROOF STEP]
using \<open>io @ [(x, y')] \<notin> L P\<close>
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> L P
io @ [(x, y')] \<notin> L P

goal (1 subgoal):
 1. False
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
False

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
case b
[PROOF STATE]
proof (state)
this:
\<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT'))))

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT'))))
[PROOF STEP]
obtain q P pP ioT pT x y y' where "(q, P) \<in> prs"
                                           and "path P (FSM.initial P) pP"
                                           and "target (FSM.initial P) pP = q"
                                           and "pT \<in> tps q"
                                           and "ioT @ [(x, y)] \<in> set (prefixes (p_io pT))"
                                           and "p_io pP @ ioT @ [(x, y')] \<in> L M'"
                                           and "\<not> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))"
[PROOF STATE]
proof (prove)
using this:
\<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT'))))

goal (1 subgoal):
 1. (\<And>q P pP pT ioT x y y'. \<lbrakk>(q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pT \<in> tps q; ioT @ [(x, y)] \<in> set (prefixes (p_io pT)); p_io pP @ ioT @ [(x, y')] \<in> L M'; \<nexists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT'))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(q, P) \<in> prs
path P (FSM.initial P) pP
target (FSM.initial P) pP = q
pT \<in> tps q
ioT @ [(x, y)] \<in> set (prefixes (p_io pT))
p_io pP @ ioT @ [(x, y')] \<in> L M'
\<nexists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT'))

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "\<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) pP \<and> target (FSM.initial P) pP = q \<and> pT \<in> tps q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) pP \<and> target (FSM.initial P) pP = q \<and> pT \<in> tps q
[PROOF STEP]
using \<open>(q, P) \<in> prs\<close> \<open>path P (FSM.initial P) pP\<close> \<open>target (FSM.initial P) pP = q\<close> \<open>pT \<in> tps q\<close>
[PROOF STATE]
proof (prove)
using this:
(q, P) \<in> prs
path P (FSM.initial P) pP
target (FSM.initial P) pP = q
pT \<in> tps q

goal (1 subgoal):
 1. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) pP \<and> target (FSM.initial P) pP = q \<and> pT \<in> tps q
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) pP \<and> target (FSM.initial P) pP = q \<and> pT \<in> tps q

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) pP \<and> target (FSM.initial P) pP = q \<and> pT \<in> tps q

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "p_io pP @ ioT @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pT))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p_io pP @ ioT @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pT))
[PROOF STEP]
using \<open>ioT @ [(x, y)] \<in> set (prefixes (p_io pT))\<close>
[PROOF STATE]
proof (prove)
using this:
ioT @ [(x, y)] \<in> set (prefixes (p_io pT))

goal (1 subgoal):
 1. p_io pP @ ioT @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pT))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
p_io pP @ ioT @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pT))

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) pP \<and> target (FSM.initial P) pP = q \<and> pT \<in> tps q
p_io pP @ ioT @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pT))
[PROOF STEP]
have "p_io pP @ ioT @ [(x, y)] \<in> (\<Union>{(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q})"
[PROOF STATE]
proof (prove)
using this:
\<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) pP \<and> target (FSM.initial P) pP = q \<and> pT \<in> tps q
p_io pP @ ioT @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pT))

goal (1 subgoal):
 1. p_io pP @ ioT @ [(x, y)] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
p_io pP @ ioT @ [(x, y)] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q}

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
p_io pP @ ioT @ [(x, y)] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q}
[PROOF STEP]
have "p_io pP @ ioT @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)"
[PROOF STATE]
proof (prove)
using this:
p_io pP @ ioT @ [(x, y)] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q}

goal (1 subgoal):
 1. p_io pP @ ioT @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
unfolding test_suite_to_io.simps
[PROOF STATE]
proof (prove)
using this:
p_io pP @ ioT @ [(x, y)] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q}

goal (1 subgoal):
 1. p_io pP @ ioT @ [(x, y)] \<in> (\<Union>(q, P)\<in>prs. L P) \<union> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q} \<union> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
p_io pP @ ioT @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
p_io pP @ ioT @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
have *: "(p_io pP @ ioT) @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)"
[PROOF STATE]
proof (prove)
using this:
p_io pP @ ioT @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. (p_io pP @ ioT) @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(p_io pP @ ioT) @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have **: "(p_io pP @ ioT) @ [(x, y')] \<in> L M'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (p_io pP @ ioT) @ [(x, y')] \<in> L M'
[PROOF STEP]
using \<open>p_io pP @ ioT @ [(x, y')] \<in> L M'\<close>
[PROOF STATE]
proof (prove)
using this:
p_io pP @ ioT @ [(x, y')] \<in> L M'

goal (1 subgoal):
 1. (p_io pP @ ioT) @ [(x, y')] \<in> L M'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(p_io pP @ ioT) @ [(x, y')] \<in> L M'

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "(p_io pP @ ioT) @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (p_io pP @ ioT) @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
using pass_io_prop[OF * ** ]
[PROOF STATE]
proof (prove)
using this:
(p_io pP @ ioT) @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. (p_io pP @ ioT) @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
(p_io pP @ ioT) @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(p_io pP @ ioT) @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
have "(p_io pP @ ioT) @ [(x, y')] \<in> L M"
[PROOF STATE]
proof (prove)
using this:
(p_io pP @ ioT) @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. (p_io pP @ ioT) @ [(x, y')] \<in> L M
[PROOF STEP]
using test_suite_language_prop
[PROOF STATE]
proof (prove)
using this:
(p_io pP @ ioT) @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
test_suite_to_io M (Test_Suite prs tps rd_targets atcs) \<subseteq> L M

goal (1 subgoal):
 1. (p_io pP @ ioT) @ [(x, y')] \<in> L M
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(p_io pP @ ioT) @ [(x, y')] \<in> L M

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "q \<in> states M"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. q \<in> FSM.states M
[PROOF STEP]
using is_preamble_is_state[OF t2[OF \<open>(q, P) \<in> prs\<close>]]
[PROOF STATE]
proof (prove)
using this:
q \<in> FSM.states M

goal (1 subgoal):
 1. q \<in> FSM.states M
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
q \<in> FSM.states M

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "q \<in> fst ` prs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. q \<in> fst ` prs
[PROOF STEP]
using \<open>(q, P) \<in> prs\<close>
[PROOF STATE]
proof (prove)
using this:
(q, P) \<in> prs

goal (1 subgoal):
 1. q \<in> fst ` prs
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
q \<in> fst ` prs

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
obtain pT' d' where "(pT @ pT', d') \<in> m_traversal_paths_with_witness M q repetition_sets m"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>pT' d'. (pT @ pT', d') \<in> m_traversal_paths_with_witness M q repetition_sets m \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using t6[OF \<open>q \<in> fst ` prs\<close>] \<open>pT \<in> tps q\<close>
[PROOF STATE]
proof (prove)
using this:
tps q \<subseteq> {p1. \<exists>p2 d. (p1 @ p2, d) \<in> m_traversal_paths_with_witness M q repetition_sets m} \<and> fst ` m_traversal_paths_with_witness M q repetition_sets m \<subseteq> tps q
pT \<in> tps q

goal (1 subgoal):
 1. (\<And>pT' d'. (pT @ pT', d') \<in> m_traversal_paths_with_witness M q repetition_sets m \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(pT @ pT', d') \<in> m_traversal_paths_with_witness M q repetition_sets m

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(pT @ pT', d') \<in> m_traversal_paths_with_witness M q repetition_sets m
[PROOF STEP]
have "path M q (pT @ pT')"
             and  "find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pT @ pT'))) repetition_sets = Some d'"
             and  "\<And> p' p''. (pT @ pT') = p' @ p'' \<Longrightarrow> p'' \<noteq> [] \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None"
[PROOF STATE]
proof (prove)
using this:
(pT @ pT', d') \<in> m_traversal_paths_with_witness M q repetition_sets m

goal (1 subgoal):
 1. path M q (pT @ pT') &&& find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pT @ pT'))) repetition_sets = Some d' &&& (\<And>p' p''. \<lbrakk>pT @ pT' = p' @ p''; p'' \<noteq> []\<rbrakk> \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None)
[PROOF STEP]
using m_traversal_paths_with_witness_set[OF t5 t8 \<open>q \<in> states M\<close>, of m]
[PROOF STATE]
proof (prove)
using this:
(pT @ pT', d') \<in> m_traversal_paths_with_witness M q repetition_sets m
\<lbrakk>\<And>q. q \<in> FSM.states M \<Longrightarrow> q \<in> FSM.states M; \<And>d. d \<in> set repetition_sets \<Longrightarrow> d \<in> set repetition_sets\<rbrakk> \<Longrightarrow> m_traversal_paths_with_witness M q repetition_sets m = {(p, d) |p d. path M q p \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p)) repetition_sets = Some d \<and> (\<forall>p' p''. p = p' @ p'' \<and> p'' \<noteq> [] \<longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None)}

goal (1 subgoal):
 1. path M q (pT @ pT') &&& find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pT @ pT'))) repetition_sets = Some d' &&& (\<And>p' p''. \<lbrakk>pT @ pT' = p' @ p''; p'' \<noteq> []\<rbrakk> \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None)
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
path M q (pT @ pT')
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pT @ pT'))) repetition_sets = Some d'
\<lbrakk>pT @ pT' = ?p' @ ?p''; ?p'' \<noteq> []\<rbrakk> \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) ?p')) repetition_sets = None

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
obtain ioT' where "p_io pT = ioT @ [(x,y)] @ ioT'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>ioT'. p_io pT = ioT @ [(x, y)] @ ioT' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using prefixes_set_ob[OF \<open>ioT @ [(x, y)] \<in> set (prefixes (p_io pT))\<close>]
[PROOF STATE]
proof (prove)
using this:
(\<And>xs'. p_io pT = (ioT @ [(x, y)]) @ xs' \<Longrightarrow> ?thesis) \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. (\<And>ioT'. p_io pT = ioT @ [(x, y)] @ ioT' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding prefixes_set append.assoc[symmetric]
[PROOF STATE]
proof (prove)
using this:
(\<And>xs'. p_io pT = (ioT @ [(x, y)]) @ xs' \<Longrightarrow> ?thesis) \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. (\<And>ioT'. p_io pT = (ioT @ [(x, y)]) @ ioT' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
p_io pT = ioT @ [(x, y)] @ ioT'

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
let ?pt = "take (length (ioT @ [(x,y)])) pT"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
let ?p  = "butlast ?pt"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
let ?t  = "last ?pt"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "length ?pt > 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < length (take (length (ioT @ [(x, y)])) pT)
[PROOF STEP]
using \<open>p_io pT = ioT @ [(x,y)] @ ioT'\<close>
[PROOF STATE]
proof (prove)
using this:
p_io pT = ioT @ [(x, y)] @ ioT'

goal (1 subgoal):
 1. 0 < length (take (length (ioT @ [(x, y)])) pT)
[PROOF STEP]
unfolding length_map[of "(\<lambda> t . (t_input t, t_output t))", symmetric]
[PROOF STATE]
proof (prove)
using this:
p_io pT = ioT @ [(x, y)] @ ioT'

goal (1 subgoal):
 1. 0 < length (p_io (take (length (ioT @ [(x, y)])) pT))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
0 < length (take (length (ioT @ [(x, y)])) pT)

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
0 < length (take (length (ioT @ [(x, y)])) pT)
[PROOF STEP]
have "?pt = ?p @ [?t]"
[PROOF STATE]
proof (prove)
using this:
0 < length (take (length (ioT @ [(x, y)])) pT)

goal (1 subgoal):
 1. take (length (ioT @ [(x, y)])) pT = butlast (take (length (ioT @ [(x, y)])) pT) @ [last (take (length (ioT @ [(x, y)])) pT)]
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
take (length (ioT @ [(x, y)])) pT = butlast (take (length (ioT @ [(x, y)])) pT) @ [last (take (length (ioT @ [(x, y)])) pT)]

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
take (length (ioT @ [(x, y)])) pT = butlast (take (length (ioT @ [(x, y)])) pT) @ [last (take (length (ioT @ [(x, y)])) pT)]

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "path M q ?pt"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. path M q (take (length (ioT @ [(x, y)])) pT)
[PROOF STEP]
using \<open>path M q (pT @ pT')\<close>
[PROOF STATE]
proof (prove)
using this:
path M q (pT @ pT')

goal (1 subgoal):
 1. path M q (take (length (ioT @ [(x, y)])) pT)
[PROOF STEP]
by (meson path_prefix path_prefix_take)
[PROOF STATE]
proof (state)
this:
path M q (take (length (ioT @ [(x, y)])) pT)

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
take (length (ioT @ [(x, y)])) pT = butlast (take (length (ioT @ [(x, y)])) pT) @ [last (take (length (ioT @ [(x, y)])) pT)]
path M q (take (length (ioT @ [(x, y)])) pT)
[PROOF STEP]
have "path M q (?p@[?t])"
[PROOF STATE]
proof (prove)
using this:
take (length (ioT @ [(x, y)])) pT = butlast (take (length (ioT @ [(x, y)])) pT) @ [last (take (length (ioT @ [(x, y)])) pT)]
path M q (take (length (ioT @ [(x, y)])) pT)

goal (1 subgoal):
 1. path M q (butlast (take (length (ioT @ [(x, y)])) pT) @ [last (take (length (ioT @ [(x, y)])) pT)])
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
path M q (butlast (take (length (ioT @ [(x, y)])) pT) @ [last (take (length (ioT @ [(x, y)])) pT)])

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "p_io ?p = ioT"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p_io (butlast (take (length (ioT @ [(x, y)])) pT)) = ioT
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. p_io (butlast (take (length (ioT @ [(x, y)])) pT)) = ioT
[PROOF STEP]
have "p_io ?pt = take (length (ioT @ [(x,y)])) (p_io pT)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p_io (take (length (ioT @ [(x, y)])) pT) = take (length (ioT @ [(x, y)])) (p_io pT)
[PROOF STEP]
by (simp add: take_map)
[PROOF STATE]
proof (state)
this:
p_io (take (length (ioT @ [(x, y)])) pT) = take (length (ioT @ [(x, y)])) (p_io pT)

goal (1 subgoal):
 1. p_io (butlast (take (length (ioT @ [(x, y)])) pT)) = ioT
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
p_io (take (length (ioT @ [(x, y)])) pT) = take (length (ioT @ [(x, y)])) (p_io pT)
[PROOF STEP]
have "p_io ?pt = ioT @ [(x,y)]"
[PROOF STATE]
proof (prove)
using this:
p_io (take (length (ioT @ [(x, y)])) pT) = take (length (ioT @ [(x, y)])) (p_io pT)

goal (1 subgoal):
 1. p_io (take (length (ioT @ [(x, y)])) pT) = ioT @ [(x, y)]
[PROOF STEP]
using \<open>p_io pT = ioT @ [(x,y)] @ ioT'\<close>
[PROOF STATE]
proof (prove)
using this:
p_io (take (length (ioT @ [(x, y)])) pT) = take (length (ioT @ [(x, y)])) (p_io pT)
p_io pT = ioT @ [(x, y)] @ ioT'

goal (1 subgoal):
 1. p_io (take (length (ioT @ [(x, y)])) pT) = ioT @ [(x, y)]
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
p_io (take (length (ioT @ [(x, y)])) pT) = ioT @ [(x, y)]

goal (1 subgoal):
 1. p_io (butlast (take (length (ioT @ [(x, y)])) pT)) = ioT
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
p_io (take (length (ioT @ [(x, y)])) pT) = ioT @ [(x, y)]
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
p_io (take (length (ioT @ [(x, y)])) pT) = ioT @ [(x, y)]

goal (1 subgoal):
 1. p_io (butlast (take (length (ioT @ [(x, y)])) pT)) = ioT
[PROOF STEP]
by (simp add: map_butlast)
[PROOF STATE]
proof (state)
this:
p_io (butlast (take (length (ioT @ [(x, y)])) pT)) = ioT

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
p_io (butlast (take (length (ioT @ [(x, y)])) pT)) = ioT

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "path M q ?p"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. path M q (butlast (take (length (ioT @ [(x, y)])) pT))
[PROOF STEP]
using path_append_transition_elim[OF \<open>path M q (?p@[?t])\<close>]
[PROOF STATE]
proof (prove)
using this:
path M q (butlast (take (length (ioT @ [(x, y)])) pT))
last (take (length (ioT @ [(x, y)])) pT) \<in> FSM.transitions M
t_source (last (take (length (ioT @ [(x, y)])) pT)) = target q (butlast (take (length (ioT @ [(x, y)])) pT))

goal (1 subgoal):
 1. path M q (butlast (take (length (ioT @ [(x, y)])) pT))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
path M q (butlast (take (length (ioT @ [(x, y)])) pT))

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "is_submachine P M"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_submachine P M
[PROOF STEP]
using t2[OF \<open>(q, P) \<in> prs\<close>]
[PROOF STATE]
proof (prove)
using this:
is_preamble P M q

goal (1 subgoal):
 1. is_submachine P M
[PROOF STEP]
unfolding is_preamble_def
[PROOF STATE]
proof (prove)
using this:
FSM.acyclic P \<and> single_input P \<and> is_submachine P M \<and> q \<in> reachable_states P \<and> deadlock_state P q \<and> (\<forall>q'\<in>reachable_states P. (q = q' \<or> \<not> deadlock_state P q') \<and> (\<forall>x\<in>FSM.inputs M. (\<exists>t\<in>FSM.transitions P. t_source t = q' \<and> t_input t = x) \<longrightarrow> (\<forall>t'\<in>FSM.transitions M. t_source t' = q' \<and> t_input t' = x \<longrightarrow> t' \<in> FSM.transitions P)))

goal (1 subgoal):
 1. is_submachine P M
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
is_submachine P M

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
is_submachine P M
[PROOF STEP]
have "initial P = initial M"
[PROOF STATE]
proof (prove)
using this:
is_submachine P M

goal (1 subgoal):
 1. FSM.initial P = FSM.initial M
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
FSM.initial P = FSM.initial M

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "path M (initial M) pP"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. path M (FSM.initial M) pP
[PROOF STEP]
using submachine_path[OF \<open>is_submachine P M\<close> \<open>path P (initial P) pP\<close>]
[PROOF STATE]
proof (prove)
using this:
path M (FSM.initial P) pP

goal (1 subgoal):
 1. path M (FSM.initial M) pP
[PROOF STEP]
unfolding \<open>initial P = initial M\<close>
[PROOF STATE]
proof (prove)
using this:
path M (FSM.initial M) pP

goal (1 subgoal):
 1. path M (FSM.initial M) pP
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
path M (FSM.initial M) pP

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
path M (FSM.initial M) pP

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "target (initial M) pP = q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. target (FSM.initial M) pP = q
[PROOF STEP]
using \<open>target (initial P) pP = q\<close>
[PROOF STATE]
proof (prove)
using this:
target (FSM.initial P) pP = q

goal (1 subgoal):
 1. target (FSM.initial M) pP = q
[PROOF STEP]
unfolding \<open>initial P = initial M\<close>
[PROOF STATE]
proof (prove)
using this:
target (FSM.initial M) pP = q

goal (1 subgoal):
 1. target (FSM.initial M) pP = q
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
target (FSM.initial M) pP = q

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
path M (FSM.initial M) pP
target (FSM.initial M) pP = q
[PROOF STEP]
have "path M (initial M) (pP@?p)"
[PROOF STATE]
proof (prove)
using this:
path M (FSM.initial M) pP
target (FSM.initial M) pP = q

goal (1 subgoal):
 1. path M (FSM.initial M) (pP @ butlast (take (length (ioT @ [(x, y)])) pT))
[PROOF STEP]
using \<open>path M q ?p\<close>
[PROOF STATE]
proof (prove)
using this:
path M (FSM.initial M) pP
target (FSM.initial M) pP = q
path M q (butlast (take (length (ioT @ [(x, y)])) pT))

goal (1 subgoal):
 1. path M (FSM.initial M) (pP @ butlast (take (length (ioT @ [(x, y)])) pT))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
path M (FSM.initial M) (pP @ butlast (take (length (ioT @ [(x, y)])) pT))

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) ?p)) repetition_sets = None"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (butlast (take (length (ioT @ [(x, y)])) pT)))) repetition_sets = None
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (butlast (take (length (ioT @ [(x, y)])) pT)))) repetition_sets = None
[PROOF STEP]
have *: "(pT @ pT') = ?p @ ([?t] @ (drop (length (ioT @ [(x,y)])) pT) @ pT')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pT @ pT' = butlast (take (length (ioT @ [(x, y)])) pT) @ [last (take (length (ioT @ [(x, y)])) pT)] @ drop (length (ioT @ [(x, y)])) pT @ pT'
[PROOF STEP]
using \<open>?pt = ?p @ [?t]\<close>
[PROOF STATE]
proof (prove)
using this:
take (length (ioT @ [(x, y)])) pT = butlast (take (length (ioT @ [(x, y)])) pT) @ [last (take (length (ioT @ [(x, y)])) pT)]

goal (1 subgoal):
 1. pT @ pT' = butlast (take (length (ioT @ [(x, y)])) pT) @ [last (take (length (ioT @ [(x, y)])) pT)] @ drop (length (ioT @ [(x, y)])) pT @ pT'
[PROOF STEP]
by (metis append_assoc append_take_drop_id)
[PROOF STATE]
proof (state)
this:
pT @ pT' = butlast (take (length (ioT @ [(x, y)])) pT) @ [last (take (length (ioT @ [(x, y)])) pT)] @ drop (length (ioT @ [(x, y)])) pT @ pT'

goal (1 subgoal):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (butlast (take (length (ioT @ [(x, y)])) pT)))) repetition_sets = None
[PROOF STEP]
have **: "([?t] @ (drop (length (ioT @ [(x,y)])) pT) @ pT') \<noteq> []"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. [last (take (length (ioT @ [(x, y)])) pT)] @ drop (length (ioT @ [(x, y)])) pT @ pT' \<noteq> []
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
[last (take (length (ioT @ [(x, y)])) pT)] @ drop (length (ioT @ [(x, y)])) pT @ pT' \<noteq> []

goal (1 subgoal):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (butlast (take (length (ioT @ [(x, y)])) pT)))) repetition_sets = None
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (butlast (take (length (ioT @ [(x, y)])) pT)))) repetition_sets = None
[PROOF STEP]
using \<open>\<And> p' p''. (pT @ pT') = p' @ p'' \<Longrightarrow> p'' \<noteq> [] \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None\<close>[OF * **]
[PROOF STATE]
proof (prove)
using this:
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (butlast (take (length (ioT @ [(x, y)])) pT)))) repetition_sets = None

goal (1 subgoal):
 1. find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (butlast (take (length (ioT @ [(x, y)])) pT)))) repetition_sets = None
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (butlast (take (length (ioT @ [(x, y)])) pT)))) repetition_sets = None

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (butlast (take (length (ioT @ [(x, y)])) pT)))) repetition_sets = None

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
(* obtain paths from the transition ending in y' to get a transition from ?p *)
[PROOF STATE]
proof (state)
this:
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (butlast (take (length (ioT @ [(x, y)])) pT)))) repetition_sets = None

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
obtain p' t' where "path M (FSM.initial M) (p' @ [t'])" and "p_io p' = p_io pP @ ioT" and "t_input t' = x" and "t_output t' = y'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>p' t'. \<lbrakk>path M (FSM.initial M) (p' @ [t']); p_io p' = p_io pP @ ioT; t_input t' = x; t_output t' = y'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using language_append_path_ob[OF \<open>(p_io pP @ ioT) @ [(x, y')] \<in> L M\<close>]
[PROOF STATE]
proof (prove)
using this:
(\<And>p t. \<lbrakk>path M (FSM.initial M) (p @ [t]); p_io p = p_io pP @ ioT; t_input t = x; t_output t = y'\<rbrakk> \<Longrightarrow> ?thesis) \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. (\<And>p' t'. \<lbrakk>path M (FSM.initial M) (p' @ [t']); p_io p' = p_io pP @ ioT; t_input t' = x; t_output t' = y'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
path M (FSM.initial M) (p' @ [t'])
p_io p' = p_io pP @ ioT
t_input t' = x
t_output t' = y'

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
path M (FSM.initial M) (p' @ [t'])
p_io p' = p_io pP @ ioT
t_input t' = x
t_output t' = y'
[PROOF STEP]
have "path M (FSM.initial M) p'" and "t_source t' = target (initial M) p'" and "t' \<in> transitions M"
[PROOF STATE]
proof (prove)
using this:
path M (FSM.initial M) (p' @ [t'])
p_io p' = p_io pP @ ioT
t_input t' = x
t_output t' = y'

goal (1 subgoal):
 1. path M (FSM.initial M) p' &&& t_source t' = target (FSM.initial M) p' &&& t' \<in> FSM.transitions M
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
path M (FSM.initial M) p'
t_source t' = target (FSM.initial M) p'
t' \<in> FSM.transitions M

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "p' = pP @ ?p"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p' = pP @ butlast (take (length (ioT @ [(x, y)])) pT)
[PROOF STEP]
using observable_path_unique[OF \<open>observable M\<close> \<open>path M (FSM.initial M) p'\<close> \<open>path M (initial M) (pP@?p)\<close>]
                \<open>p_io ?p = ioT\<close>
[PROOF STATE]
proof (prove)
using this:
p_io p' = p_io (pP @ butlast (take (length (ioT @ [(x, y)])) pT)) \<Longrightarrow> p' = pP @ butlast (take (length (ioT @ [(x, y)])) pT)
p_io (butlast (take (length (ioT @ [(x, y)])) pT)) = ioT

goal (1 subgoal):
 1. p' = pP @ butlast (take (length (ioT @ [(x, y)])) pT)
[PROOF STEP]
unfolding \<open>p_io p' = p_io pP @ ioT\<close>
[PROOF STATE]
proof (prove)
using this:
p_io pP @ ioT = p_io (pP @ butlast (take (length (ioT @ [(x, y)])) pT)) \<Longrightarrow> p' = pP @ butlast (take (length (ioT @ [(x, y)])) pT)
p_io (butlast (take (length (ioT @ [(x, y)])) pT)) = ioT

goal (1 subgoal):
 1. p' = pP @ butlast (take (length (ioT @ [(x, y)])) pT)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
p' = pP @ butlast (take (length (ioT @ [(x, y)])) pT)

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
p' = pP @ butlast (take (length (ioT @ [(x, y)])) pT)
[PROOF STEP]
have "t_source t' = target q ?p"
[PROOF STATE]
proof (prove)
using this:
p' = pP @ butlast (take (length (ioT @ [(x, y)])) pT)

goal (1 subgoal):
 1. t_source t' = target q (butlast (take (length (ioT @ [(x, y)])) pT))
[PROOF STEP]
unfolding \<open>t_source t' = target (initial M) p'\<close>
[PROOF STATE]
proof (prove)
using this:
p' = pP @ butlast (take (length (ioT @ [(x, y)])) pT)

goal (1 subgoal):
 1. target (FSM.initial M) p' = target q (butlast (take (length (ioT @ [(x, y)])) pT))
[PROOF STEP]
using \<open>target (initial M) pP = q\<close>
[PROOF STATE]
proof (prove)
using this:
p' = pP @ butlast (take (length (ioT @ [(x, y)])) pT)
target (FSM.initial M) pP = q

goal (1 subgoal):
 1. target (FSM.initial M) p' = target q (butlast (take (length (ioT @ [(x, y)])) pT))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
t_source t' = target q (butlast (take (length (ioT @ [(x, y)])) pT))

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
obtain pTt' dt' where "(?p @ [t'] @ pTt', dt') \<in> m_traversal_paths_with_witness M q repetition_sets m"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>pTt' dt'. (butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt', dt') \<in> m_traversal_paths_with_witness M q repetition_sets m \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using m_traversal_path_extension_exist_for_transition[OF \<open>completely_specified M\<close> \<open>q \<in> states M\<close> \<open>FSM.inputs M \<noteq> {}\<close>
                                                                   t5 t8 \<open>path M q ?p\<close> \<open>find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) ?p)) repetition_sets = None\<close>
                                                                   \<open>t' \<in> transitions M\<close> \<open>t_source t' = target q ?p\<close>]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>q. q \<in> FSM.states M \<Longrightarrow> q \<in> FSM.states M; \<And>d. d \<in> set repetition_sets \<Longrightarrow> d \<in> set repetition_sets\<rbrakk> \<Longrightarrow> \<exists>p2 d'. (butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ p2, d') \<in> m_traversal_paths_with_witness M q repetition_sets m

goal (1 subgoal):
 1. (\<And>pTt' dt'. (butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt', dt') \<in> m_traversal_paths_with_witness M q repetition_sets m \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt', dt') \<in> m_traversal_paths_with_witness M q repetition_sets m

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "?p @ [t'] @ pTt' \<in> tps q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt' \<in> tps q
[PROOF STEP]
using t6[OF \<open>q \<in> fst ` prs\<close> ] \<open>(?p @ [t'] @ pTt', dt') \<in> m_traversal_paths_with_witness M q repetition_sets m\<close>
[PROOF STATE]
proof (prove)
using this:
tps q \<subseteq> {p1. \<exists>p2 d. (p1 @ p2, d) \<in> m_traversal_paths_with_witness M q repetition_sets m} \<and> fst ` m_traversal_paths_with_witness M q repetition_sets m \<subseteq> tps q
(butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt', dt') \<in> m_traversal_paths_with_witness M q repetition_sets m

goal (1 subgoal):
 1. butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt' \<in> tps q
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt' \<in> tps q

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt' \<in> tps q

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "ioT @ [(x, y')] \<in> set (prefixes (p_io (?p @ [t'] @ pTt')))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ioT @ [(x, y')] \<in> set (prefixes (p_io (butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt')))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. ioT @ [(x, y')] \<in> set (prefixes (p_io (butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt')))
[PROOF STEP]
have "p_io (?p @ [t'] @ pTt') = ioT @ [(x,y')] @ p_io pTt'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p_io (butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt') = ioT @ [(x, y')] @ p_io pTt'
[PROOF STEP]
using \<open>p_io ?p = ioT\<close>
[PROOF STATE]
proof (prove)
using this:
p_io (butlast (take (length (ioT @ [(x, y)])) pT)) = ioT

goal (1 subgoal):
 1. p_io (butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt') = ioT @ [(x, y')] @ p_io pTt'
[PROOF STEP]
using \<open>t_input t' = x\<close> \<open>t_output t' = y'\<close>
[PROOF STATE]
proof (prove)
using this:
p_io (butlast (take (length (ioT @ [(x, y)])) pT)) = ioT
t_input t' = x
t_output t' = y'

goal (1 subgoal):
 1. p_io (butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt') = ioT @ [(x, y')] @ p_io pTt'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
p_io (butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt') = ioT @ [(x, y')] @ p_io pTt'

goal (1 subgoal):
 1. ioT @ [(x, y')] \<in> set (prefixes (p_io (butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt')))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
p_io (butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt') = ioT @ [(x, y')] @ p_io pTt'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
p_io (butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt') = ioT @ [(x, y')] @ p_io pTt'

goal (1 subgoal):
 1. ioT @ [(x, y')] \<in> set (prefixes (p_io (butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt')))
[PROOF STEP]
unfolding prefixes_set
[PROOF STATE]
proof (prove)
using this:
p_io (butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt') = ioT @ [(x, y')] @ p_io pTt'

goal (1 subgoal):
 1. ioT @ [(x, y')] \<in> {xs'. \<exists>xs''. xs' @ xs'' = p_io (butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt')}
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
ioT @ [(x, y')] \<in> set (prefixes (p_io (butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt')))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
ioT @ [(x, y')] \<in> set (prefixes (p_io (butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt')))

goal (2 subgoals):
 1. \<not> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<Longrightarrow> False
 2. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt' \<in> tps q
ioT @ [(x, y')] \<in> set (prefixes (p_io (butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt')))
[PROOF STEP]
show "False"
[PROOF STATE]
proof (prove)
using this:
butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt' \<in> tps q
ioT @ [(x, y')] \<in> set (prefixes (p_io (butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt')))

goal (1 subgoal):
 1. False
[PROOF STEP]
using \<open>\<not> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))\<close>
[PROOF STATE]
proof (prove)
using this:
butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt' \<in> tps q
ioT @ [(x, y')] \<in> set (prefixes (p_io (butlast (take (length (ioT @ [(x, y)])) pT) @ [t'] @ pTt')))
\<nexists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT'))

goal (1 subgoal):
 1. False
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
case c
[PROOF STATE]
proof (state)
this:
\<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2))

goal (1 subgoal):
 1. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2))
[PROOF STEP]
obtain q P pP pT q' A d1 d2 qT  where "(q, P) \<in> prs"
                                             and   "path P (FSM.initial P) pP"
                                             and   "target (FSM.initial P) pP = q"
                                             and   "pT \<in> tps q"
                                             and   "p_io pP @ p_io pT \<in> L M'"
                                             and   "q' \<in> rd_targets (q, pT)"
                                             and   "(A, d1, d2) \<in> atcs (target q pT, q')"
                                             and   "qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M')"
                                             and   "\<not>pass_separator_ATC M' A qT d2"
[PROOF STATE]
proof (prove)
using this:
\<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2))

goal (1 subgoal):
 1. (\<And>q P pP pT q' A d1 d2 qT. \<lbrakk>(q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pT \<in> tps q; p_io pP @ p_io pT \<in> L M'; q' \<in> rd_targets (q, pT); (A, d1, d2) \<in> atcs (target q pT, q'); qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M'); \<not> pass_separator_ATC M' A qT d2\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(q, P) \<in> prs
path P (FSM.initial P) pP
target (FSM.initial P) pP = q
pT \<in> tps q
p_io pP @ p_io pT \<in> L M'
q' \<in> rd_targets (q, pT)
(A, d1, d2) \<in> atcs (target q pT, q')
qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M')
\<not> pass_separator_ATC M' A qT d2

goal (1 subgoal):
 1. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "is_submachine P M"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_submachine P M
[PROOF STEP]
using t2[OF \<open>(q, P) \<in> prs\<close>]
[PROOF STATE]
proof (prove)
using this:
is_preamble P M q

goal (1 subgoal):
 1. is_submachine P M
[PROOF STEP]
unfolding is_preamble_def
[PROOF STATE]
proof (prove)
using this:
FSM.acyclic P \<and> single_input P \<and> is_submachine P M \<and> q \<in> reachable_states P \<and> deadlock_state P q \<and> (\<forall>q'\<in>reachable_states P. (q = q' \<or> \<not> deadlock_state P q') \<and> (\<forall>x\<in>FSM.inputs M. (\<exists>t\<in>FSM.transitions P. t_source t = q' \<and> t_input t = x) \<longrightarrow> (\<forall>t'\<in>FSM.transitions M. t_source t' = q' \<and> t_input t' = x \<longrightarrow> t' \<in> FSM.transitions P)))

goal (1 subgoal):
 1. is_submachine P M
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
is_submachine P M

goal (1 subgoal):
 1. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
is_submachine P M
[PROOF STEP]
have "initial P = initial M"
[PROOF STATE]
proof (prove)
using this:
is_submachine P M

goal (1 subgoal):
 1. FSM.initial P = FSM.initial M
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
FSM.initial P = FSM.initial M

goal (1 subgoal):
 1. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "path M (initial M) pP"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. path M (FSM.initial M) pP
[PROOF STEP]
using submachine_path[OF \<open>is_submachine P M\<close> \<open>path P (initial P) pP\<close>]
[PROOF STATE]
proof (prove)
using this:
path M (FSM.initial P) pP

goal (1 subgoal):
 1. path M (FSM.initial M) pP
[PROOF STEP]
unfolding \<open>initial P = initial M\<close>
[PROOF STATE]
proof (prove)
using this:
path M (FSM.initial M) pP

goal (1 subgoal):
 1. path M (FSM.initial M) pP
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
path M (FSM.initial M) pP

goal (1 subgoal):
 1. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "target (initial M) pP = q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. target (FSM.initial M) pP = q
[PROOF STEP]
using \<open>target (initial P) pP = q\<close>
[PROOF STATE]
proof (prove)
using this:
target (FSM.initial P) pP = q

goal (1 subgoal):
 1. target (FSM.initial M) pP = q
[PROOF STEP]
unfolding \<open>initial P = initial M\<close>
[PROOF STATE]
proof (prove)
using this:
target (FSM.initial M) pP = q

goal (1 subgoal):
 1. target (FSM.initial M) pP = q
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
target (FSM.initial M) pP = q

goal (1 subgoal):
 1. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "q \<in> states M"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. q \<in> FSM.states M
[PROOF STEP]
using is_preamble_is_state[OF t2[OF \<open>(q, P) \<in> prs\<close>]]
[PROOF STATE]
proof (prove)
using this:
q \<in> FSM.states M

goal (1 subgoal):
 1. q \<in> FSM.states M
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
q \<in> FSM.states M

goal (1 subgoal):
 1. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "q \<in> fst ` prs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. q \<in> fst ` prs
[PROOF STEP]
using \<open>(q, P) \<in> prs\<close>
[PROOF STATE]
proof (prove)
using this:
(q, P) \<in> prs

goal (1 subgoal):
 1. q \<in> fst ` prs
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
q \<in> fst ` prs

goal (1 subgoal):
 1. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
obtain pT' d' where "(pT @ pT', d') \<in> m_traversal_paths_with_witness M q repetition_sets m"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>pT' d'. (pT @ pT', d') \<in> m_traversal_paths_with_witness M q repetition_sets m \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using t6[OF \<open>q \<in> fst ` prs\<close>] \<open>pT \<in> tps q\<close>
[PROOF STATE]
proof (prove)
using this:
tps q \<subseteq> {p1. \<exists>p2 d. (p1 @ p2, d) \<in> m_traversal_paths_with_witness M q repetition_sets m} \<and> fst ` m_traversal_paths_with_witness M q repetition_sets m \<subseteq> tps q
pT \<in> tps q

goal (1 subgoal):
 1. (\<And>pT' d'. (pT @ pT', d') \<in> m_traversal_paths_with_witness M q repetition_sets m \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(pT @ pT', d') \<in> m_traversal_paths_with_witness M q repetition_sets m

goal (1 subgoal):
 1. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(pT @ pT', d') \<in> m_traversal_paths_with_witness M q repetition_sets m
[PROOF STEP]
have "path M q (pT @ pT')"
             and  "find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pT @ pT'))) repetition_sets = Some d'"
             and  "\<And> p' p''. (pT @ pT') = p' @ p'' \<Longrightarrow> p'' \<noteq> [] \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None"
[PROOF STATE]
proof (prove)
using this:
(pT @ pT', d') \<in> m_traversal_paths_with_witness M q repetition_sets m

goal (1 subgoal):
 1. path M q (pT @ pT') &&& find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pT @ pT'))) repetition_sets = Some d' &&& (\<And>p' p''. \<lbrakk>pT @ pT' = p' @ p''; p'' \<noteq> []\<rbrakk> \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None)
[PROOF STEP]
using m_traversal_paths_with_witness_set[OF t5 t8 \<open>q \<in> states M\<close>, of m]
[PROOF STATE]
proof (prove)
using this:
(pT @ pT', d') \<in> m_traversal_paths_with_witness M q repetition_sets m
\<lbrakk>\<And>q. q \<in> FSM.states M \<Longrightarrow> q \<in> FSM.states M; \<And>d. d \<in> set repetition_sets \<Longrightarrow> d \<in> set repetition_sets\<rbrakk> \<Longrightarrow> m_traversal_paths_with_witness M q repetition_sets m = {(p, d) |p d. path M q p \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p)) repetition_sets = Some d \<and> (\<forall>p' p''. p = p' @ p'' \<and> p'' \<noteq> [] \<longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None)}

goal (1 subgoal):
 1. path M q (pT @ pT') &&& find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pT @ pT'))) repetition_sets = Some d' &&& (\<And>p' p''. \<lbrakk>pT @ pT' = p' @ p''; p'' \<noteq> []\<rbrakk> \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None)
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
path M q (pT @ pT')
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pT @ pT'))) repetition_sets = Some d'
\<lbrakk>pT @ pT' = ?p' @ ?p''; ?p'' \<noteq> []\<rbrakk> \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) ?p')) repetition_sets = None

goal (1 subgoal):
 1. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
path M q (pT @ pT')
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pT @ pT'))) repetition_sets = Some d'
\<lbrakk>pT @ pT' = ?p' @ ?p''; ?p'' \<noteq> []\<rbrakk> \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) ?p')) repetition_sets = None
[PROOF STEP]
have "path M q pT"
[PROOF STATE]
proof (prove)
using this:
path M q (pT @ pT')
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pT @ pT'))) repetition_sets = Some d'
\<lbrakk>pT @ pT' = ?p' @ ?p''; ?p'' \<noteq> []\<rbrakk> \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) ?p')) repetition_sets = None

goal (1 subgoal):
 1. path M q pT
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
path M q pT

goal (1 subgoal):
 1. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "qT \<in> states M'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. qT \<in> FSM.states M'
[PROOF STEP]
using \<open>qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M')\<close> io_targets_states subset_iff
[PROOF STATE]
proof (prove)
using this:
qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M')
io_targets ?M ?io ?q \<subseteq> FSM.states ?M
(?A \<subseteq> ?B) = (\<forall>t. t \<in> ?A \<longrightarrow> t \<in> ?B)

goal (1 subgoal):
 1. qT \<in> FSM.states M'
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
qT \<in> FSM.states M'

goal (1 subgoal):
 1. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "is_separator M (target q pT) q' A d1 d2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_separator M (target q pT) q' A d1 d2
[PROOF STEP]
using  t3[OF \<open>(A, d1, d2) \<in> atcs (target q pT, q')\<close>]
[PROOF STATE]
proof (prove)
using this:
(A, d2, d1) \<in> atcs (q', target q pT) \<and> is_separator M (target q pT) q' A d1 d2

goal (1 subgoal):
 1. is_separator M (target q pT) q' A d1 d2
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
is_separator M (target q pT) q' A d1 d2

goal (1 subgoal):
 1. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "\<not> pass_io_set (FSM.from_FSM M' qT) (atc_to_io_set (FSM.from_FSM M (target q pT)) A)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> pass_io_set (from_FSM M' qT) (atc_to_io_set (from_FSM M (target q pT)) A)
[PROOF STEP]
using \<open>\<not>pass_separator_ATC M' A qT d2\<close>
                pass_separator_pass_io_set_iff[OF \<open>is_separator M (target q pT) q' A d1 d2\<close> \<open>observable M\<close>
                                                  \<open>observable M'\<close> path_target_is_state[OF \<open>path M q pT\<close>]
                                                  \<open>qT \<in> states M'\<close> \<open>inputs M' = inputs M\<close> \<open>completely_specified M\<close>]
[PROOF STATE]
proof (prove)
using this:
\<not> pass_separator_ATC M' A qT d2
pass_separator_ATC M' A qT d2 = pass_io_set (from_FSM M' qT) (atc_to_io_set (from_FSM M (target q pT)) A)

goal (1 subgoal):
 1. \<not> pass_io_set (from_FSM M' qT) (atc_to_io_set (from_FSM M (target q pT)) A)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<not> pass_io_set (from_FSM M' qT) (atc_to_io_set (from_FSM M (target q pT)) A)

goal (1 subgoal):
 1. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
have "pass_io_set (FSM.from_FSM M' qT) (atc_to_io_set (FSM.from_FSM M (target q pT)) A)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pass_io_set (from_FSM M' qT) (atc_to_io_set (from_FSM M (target q pT)) A)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. pass_io_set (from_FSM M' qT) (atc_to_io_set (from_FSM M (target q pT)) A)
[PROOF STEP]
have "\<And> io x y y' . io @ [(x, y)] \<in> atc_to_io_set (FSM.from_FSM M (target q pT)) A \<Longrightarrow>
                               io @ [(x, y')] \<in> L (FSM.from_FSM M' qT) \<Longrightarrow>
                                io @ [(x, y')] \<in> atc_to_io_set (FSM.from_FSM M (target q pT)) A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
fix io x y y'
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
assume "io @ [(x, y)] \<in> atc_to_io_set (FSM.from_FSM M (target q pT)) A"
                          and    "io @ [(x, y')] \<in> L (FSM.from_FSM M' qT)"
[PROOF STATE]
proof (state)
this:
io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A
io @ [(x, y')] \<in> L (from_FSM M' qT)

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
(* subsets of test_suite_to_io *)
[PROOF STATE]
proof (state)
this:
io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A
io @ [(x, y')] \<in> L (from_FSM M' qT)

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
define tmp where tmp_def : "tmp = (\<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (FSM.from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')})"
[PROOF STATE]
proof (state)
this:
tmp = \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')}

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
define tmp2 where tmp2_def : "tmp2 = \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q}"
[PROOF STATE]
proof (state)
this:
tmp2 = \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q}

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
have "\<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) pP \<and> target (FSM.initial P) pP = q \<and> pT \<in> tps q \<and> q' \<in> rd_targets (q, pT) \<and> (A, t1, t2) \<in> atcs (target q pT, q')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) pP \<and> target (FSM.initial P) pP = q \<and> pT \<in> tps q \<and> q' \<in> rd_targets (q, pT) \<and> (A, t1, t2) \<in> atcs (target q pT, q')
[PROOF STEP]
using \<open>(q, P) \<in> prs\<close> \<open>path P (FSM.initial P) pP\<close> \<open>target (FSM.initial P) pP = q\<close> \<open>pT \<in> tps q\<close> \<open>q' \<in> rd_targets (q, pT)\<close> \<open>(A, d1, d2) \<in> atcs (target q pT, q')\<close>
[PROOF STATE]
proof (prove)
using this:
(q, P) \<in> prs
path P (FSM.initial P) pP
target (FSM.initial P) pP = q
pT \<in> tps q
q' \<in> rd_targets (q, pT)
(A, d1, d2) \<in> atcs (target q pT, q')

goal (1 subgoal):
 1. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) pP \<and> target (FSM.initial P) pP = q \<and> pT \<in> tps q \<and> q' \<in> rd_targets (q, pT) \<and> (A, t1, t2) \<in> atcs (target q pT, q')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) pP \<and> target (FSM.initial P) pP = q \<and> pT \<in> tps q \<and> q' \<in> rd_targets (q, pT) \<and> (A, t1, t2) \<in> atcs (target q pT, q')

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) pP \<and> target (FSM.initial P) pP = q \<and> pT \<in> tps q \<and> q' \<in> rd_targets (q, pT) \<and> (A, t1, t2) \<in> atcs (target q pT, q')
[PROOF STEP]
have "(\<lambda>io_atc. p_io pP @ p_io pT @ io_atc) ` atc_to_io_set (FSM.from_FSM M (target q pT)) A \<subseteq> tmp"
[PROOF STATE]
proof (prove)
using this:
\<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) pP \<and> target (FSM.initial P) pP = q \<and> pT \<in> tps q \<and> q' \<in> rd_targets (q, pT) \<and> (A, t1, t2) \<in> atcs (target q pT, q')

goal (1 subgoal):
 1. (\<lambda>io_atc. p_io pP @ p_io pT @ io_atc) ` atc_to_io_set (from_FSM M (target q pT)) A \<subseteq> tmp
[PROOF STEP]
unfolding tmp_def
[PROOF STATE]
proof (prove)
using this:
\<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) pP \<and> target (FSM.initial P) pP = q \<and> pT \<in> tps q \<and> q' \<in> rd_targets (q, pT) \<and> (A, t1, t2) \<in> atcs (target q pT, q')

goal (1 subgoal):
 1. (\<lambda>io_atc. p_io pP @ p_io pT @ io_atc) ` atc_to_io_set (from_FSM M (target q pT)) A \<subseteq> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<lambda>io_atc. p_io pP @ p_io pT @ io_atc) ` atc_to_io_set (from_FSM M (target q pT)) A \<subseteq> tmp

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(\<lambda>io_atc. p_io pP @ p_io pT @ io_atc) ` atc_to_io_set (from_FSM M (target q pT)) A \<subseteq> tmp
[PROOF STEP]
have "(\<lambda>io_atc. p_io pP @ p_io pT @ io_atc) ` atc_to_io_set (FSM.from_FSM M (target q pT)) A \<subseteq> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)"
[PROOF STATE]
proof (prove)
using this:
(\<lambda>io_atc. p_io pP @ p_io pT @ io_atc) ` atc_to_io_set (from_FSM M (target q pT)) A \<subseteq> tmp

goal (1 subgoal):
 1. (\<lambda>io_atc. p_io pP @ p_io pT @ io_atc) ` atc_to_io_set (from_FSM M (target q pT)) A \<subseteq> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
unfolding test_suite_to_io.simps tmp_def[symmetric] tmp2_def[symmetric]
[PROOF STATE]
proof (prove)
using this:
(\<lambda>io_atc. p_io pP @ p_io pT @ io_atc) ` atc_to_io_set (from_FSM M (target q pT)) A \<subseteq> tmp

goal (1 subgoal):
 1. (\<lambda>io_atc. p_io pP @ p_io pT @ io_atc) ` atc_to_io_set (from_FSM M (target q pT)) A \<subseteq> (\<Union>(q, P)\<in>prs. L P) \<union> tmp2 \<union> tmp
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<lambda>io_atc. p_io pP @ p_io pT @ io_atc) ` atc_to_io_set (from_FSM M (target q pT)) A \<subseteq> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<lambda>io_atc. p_io pP @ p_io pT @ io_atc) ` atc_to_io_set (from_FSM M (target q pT)) A \<subseteq> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
have "(p_io pP @ p_io pT @ (io @ [(x, y)])) \<in> (\<lambda>io_atc. p_io pP @ p_io pT @ io_atc) ` atc_to_io_set (FSM.from_FSM M (target q pT)) A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p_io pP @ p_io pT @ io @ [(x, y)] \<in> (\<lambda>io_atc. p_io pP @ p_io pT @ io_atc) ` atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
using \<open>io @ [(x, y)] \<in> atc_to_io_set (FSM.from_FSM M (target q pT)) A\<close>
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A

goal (1 subgoal):
 1. p_io pP @ p_io pT @ io @ [(x, y)] \<in> (\<lambda>io_atc. p_io pP @ p_io pT @ io_atc) ` atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
p_io pP @ p_io pT @ io @ [(x, y)] \<in> (\<lambda>io_atc. p_io pP @ p_io pT @ io_atc) ` atc_to_io_set (from_FSM M (target q pT)) A

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<lambda>io_atc. p_io pP @ p_io pT @ io_atc) ` atc_to_io_set (from_FSM M (target q pT)) A \<subseteq> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
p_io pP @ p_io pT @ io @ [(x, y)] \<in> (\<lambda>io_atc. p_io pP @ p_io pT @ io_atc) ` atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
have "(p_io pP @ p_io pT @ (io @ [(x, y)])) \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)"
[PROOF STATE]
proof (prove)
using this:
(\<lambda>io_atc. p_io pP @ p_io pT @ io_atc) ` atc_to_io_set (from_FSM M (target q pT)) A \<subseteq> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
p_io pP @ p_io pT @ io @ [(x, y)] \<in> (\<lambda>io_atc. p_io pP @ p_io pT @ io_atc) ` atc_to_io_set (from_FSM M (target q pT)) A

goal (1 subgoal):
 1. p_io pP @ p_io pT @ io @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
p_io pP @ p_io pT @ io @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
p_io pP @ p_io pT @ io @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
have *: "(p_io pP @ p_io pT @ io) @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)"
[PROOF STATE]
proof (prove)
using this:
p_io pP @ p_io pT @ io @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. (p_io pP @ p_io pT @ io) @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(p_io pP @ p_io pT @ io) @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
have "io @ [(x, y')] \<in> LS M' qT"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. io @ [(x, y')] \<in> LS M' qT
[PROOF STEP]
using \<open>io @ [(x, y')] \<in> L (FSM.from_FSM M' qT)\<close> \<open>qT \<in> states M'\<close>
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> L (from_FSM M' qT)
qT \<in> FSM.states M'

goal (1 subgoal):
 1. io @ [(x, y')] \<in> LS M' qT
[PROOF STEP]
by (metis from_FSM_language)
[PROOF STATE]
proof (state)
this:
io @ [(x, y')] \<in> LS M' qT

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
have **: "(p_io pP @ p_io pT @ io) @ [(x, y')] \<in> L M'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (p_io pP @ p_io pT @ io) @ [(x, y')] \<in> L M'
[PROOF STEP]
using io_targets_language_append[OF \<open>qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M')\<close> \<open>io @ [(x, y')] \<in> LS M' qT\<close>]
[PROOF STATE]
proof (prove)
using this:
(p_io pP @ p_io pT) @ io @ [(x, y')] \<in> L M'

goal (1 subgoal):
 1. (p_io pP @ p_io pT @ io) @ [(x, y')] \<in> L M'
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(p_io pP @ p_io pT @ io) @ [(x, y')] \<in> L M'

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
have "(p_io pP @ p_io pT) @ (io @ [(x, y')]) \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (p_io pP @ p_io pT) @ io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
using pass_io_prop[OF * ** ]
[PROOF STATE]
proof (prove)
using this:
(p_io pP @ p_io pT @ io) @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. (p_io pP @ p_io pT) @ io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(p_io pP @ p_io pT) @ io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(p_io pP @ p_io pT) @ io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
have "(p_io pP @ p_io pT) @ (io @ [(x, y')]) \<in> L M"
[PROOF STATE]
proof (prove)
using this:
(p_io pP @ p_io pT) @ io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. (p_io pP @ p_io pT) @ io @ [(x, y')] \<in> L M
[PROOF STEP]
using test_suite_language_prop
[PROOF STATE]
proof (prove)
using this:
(p_io pP @ p_io pT) @ io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
test_suite_to_io M (Test_Suite prs tps rd_targets atcs) \<subseteq> L M

goal (1 subgoal):
 1. (p_io pP @ p_io pT) @ io @ [(x, y')] \<in> L M
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(p_io pP @ p_io pT) @ io @ [(x, y')] \<in> L M

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(p_io pP @ p_io pT) @ io @ [(x, y')] \<in> L M

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
have "target q pT \<in> io_targets M (p_io pP @ p_io pT) (initial M)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. target q pT \<in> io_targets M (p_io pP @ p_io pT) (FSM.initial M)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. target q pT \<in> io_targets M (p_io pP @ p_io pT) (FSM.initial M)
[PROOF STEP]
have "target (initial M) (pP@pT) = target q pT"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. target (FSM.initial M) (pP @ pT) = target q pT
[PROOF STEP]
unfolding \<open>target (initial M) pP = q\<close>[symmetric]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. target (FSM.initial M) (pP @ pT) = target (target (FSM.initial M) pP) pT
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
target (FSM.initial M) (pP @ pT) = target q pT

goal (1 subgoal):
 1. target q pT \<in> io_targets M (p_io pP @ p_io pT) (FSM.initial M)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
target (FSM.initial M) (pP @ pT) = target q pT

goal (1 subgoal):
 1. target q pT \<in> io_targets M (p_io pP @ p_io pT) (FSM.initial M)
[PROOF STEP]
have "path M (initial M) (pP@pT)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. path M (FSM.initial M) (pP @ pT)
[PROOF STEP]
using \<open>path M (initial M) pP\<close> \<open>path M q pT\<close>
[PROOF STATE]
proof (prove)
using this:
path M (FSM.initial M) pP
path M q pT

goal (1 subgoal):
 1. path M (FSM.initial M) (pP @ pT)
[PROOF STEP]
unfolding \<open>target (initial M) pP = q\<close>[symmetric]
[PROOF STATE]
proof (prove)
using this:
path M (FSM.initial M) pP
path M (target (FSM.initial M) pP) pT

goal (1 subgoal):
 1. path M (FSM.initial M) (pP @ pT)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
path M (FSM.initial M) (pP @ pT)

goal (1 subgoal):
 1. target q pT \<in> io_targets M (p_io pP @ p_io pT) (FSM.initial M)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
path M (FSM.initial M) (pP @ pT)

goal (1 subgoal):
 1. target q pT \<in> io_targets M (p_io pP @ p_io pT) (FSM.initial M)
[PROOF STEP]
have "p_io (pP@pT) = (p_io pP @ p_io pT)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p_io (pP @ pT) = p_io pP @ p_io pT
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
p_io (pP @ pT) = p_io pP @ p_io pT

goal (1 subgoal):
 1. target q pT \<in> io_targets M (p_io pP @ p_io pT) (FSM.initial M)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
target (FSM.initial M) (pP @ pT) = target q pT
path M (FSM.initial M) (pP @ pT)
p_io (pP @ pT) = p_io pP @ p_io pT
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
target (FSM.initial M) (pP @ pT) = target q pT
path M (FSM.initial M) (pP @ pT)
p_io (pP @ pT) = p_io pP @ p_io pT

goal (1 subgoal):
 1. target q pT \<in> io_targets M (p_io pP @ p_io pT) (FSM.initial M)
[PROOF STEP]
unfolding io_targets.simps
[PROOF STATE]
proof (prove)
using this:
target (FSM.initial M) (pP @ pT) = target q pT
path M (FSM.initial M) (pP @ pT)
p_io (pP @ pT) = p_io pP @ p_io pT

goal (1 subgoal):
 1. target q pT \<in> {target (FSM.initial M) p |p. path M (FSM.initial M) p \<and> p_io p = p_io pP @ p_io pT}
[PROOF STEP]
by (metis (mono_tags, lifting) mem_Collect_eq)
[PROOF STATE]
proof (state)
this:
target q pT \<in> io_targets M (p_io pP @ p_io pT) (FSM.initial M)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
target q pT \<in> io_targets M (p_io pP @ p_io pT) (FSM.initial M)

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(p_io pP @ p_io pT) @ io @ [(x, y')] \<in> L M
target q pT \<in> io_targets M (p_io pP @ p_io pT) (FSM.initial M)
[PROOF STEP]
have "io @ [(x, y')] \<in> LS M (target q pT)"
[PROOF STATE]
proof (prove)
using this:
(p_io pP @ p_io pT) @ io @ [(x, y')] \<in> L M
target q pT \<in> io_targets M (p_io pP @ p_io pT) (FSM.initial M)

goal (1 subgoal):
 1. io @ [(x, y')] \<in> LS M (target q pT)
[PROOF STEP]
using observable_io_targets_language[OF _ \<open>observable M\<close>, of "(p_io pP @ p_io pT)" "(io @ [(x, y')])" "initial M" "target q pT"]
[PROOF STATE]
proof (prove)
using this:
(p_io pP @ p_io pT) @ io @ [(x, y')] \<in> L M
target q pT \<in> io_targets M (p_io pP @ p_io pT) (FSM.initial M)
\<lbrakk>(p_io pP @ p_io pT) @ io @ [(x, y')] \<in> L M; target q pT \<in> io_targets M (p_io pP @ p_io pT) (FSM.initial M)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> LS M (target q pT)

goal (1 subgoal):
 1. io @ [(x, y')] \<in> LS M (target q pT)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
io @ [(x, y')] \<in> LS M (target q pT)

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
io @ [(x, y')] \<in> LS M (target q pT)
[PROOF STEP]
have "io @ [(x, y')] \<in> L (FSM.from_FSM M (target q pT))"
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> LS M (target q pT)

goal (1 subgoal):
 1. io @ [(x, y')] \<in> L (from_FSM M (target q pT))
[PROOF STEP]
unfolding from_FSM_language[OF path_target_is_state[OF \<open>path M q pT\<close>]]
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> LS M (target q pT)

goal (1 subgoal):
 1. io @ [(x, y')] \<in> LS M (target q pT)
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
io @ [(x, y')] \<in> L (from_FSM M (target q pT))

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
io @ [(x, y')] \<in> L (from_FSM M (target q pT))

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
have "io @ [(x, y')] \<in> L A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. io @ [(x, y')] \<in> L A
[PROOF STEP]
by (metis Int_iff \<open>io @ [(x, y')] \<in> LS M (target q pT)\<close> \<open>io @ [(x, y)] \<in> atc_to_io_set (FSM.from_FSM M (target q pT)) A\<close>
                      \<open>is_separator M (target q pT) q' A d1 d2\<close> atc_to_io_set.simps is_separator_simps(9))
[PROOF STATE]
proof (state)
this:
io @ [(x, y')] \<in> L A

goal (1 subgoal):
 1. \<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; io @ [(x, y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
io @ [(x, y')] \<in> L (from_FSM M (target q pT))
io @ [(x, y')] \<in> L A
[PROOF STEP]
show "io @ [(x, y')] \<in> atc_to_io_set (FSM.from_FSM M (target q pT)) A"
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> L (from_FSM M (target q pT))
io @ [(x, y')] \<in> L A

goal (1 subgoal):
 1. io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
unfolding atc_to_io_set.simps
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> L (from_FSM M (target q pT))
io @ [(x, y')] \<in> L A

goal (1 subgoal):
 1. io @ [(x, y')] \<in> L (from_FSM M (target q pT)) \<inter> L A
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>?io @ [(?x, ?y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; ?io @ [(?x, ?y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> ?io @ [(?x, ?y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A

goal (1 subgoal):
 1. pass_io_set (from_FSM M' qT) (atc_to_io_set (from_FSM M (target q pT)) A)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>?io @ [(?x, ?y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; ?io @ [(?x, ?y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> ?io @ [(?x, ?y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?io @ [(?x, ?y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; ?io @ [(?x, ?y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> ?io @ [(?x, ?y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A

goal (1 subgoal):
 1. pass_io_set (from_FSM M' qT) (atc_to_io_set (from_FSM M (target q pT)) A)
[PROOF STEP]
unfolding pass_io_set_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?io @ [(?x, ?y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A; ?io @ [(?x, ?y')] \<in> L (from_FSM M' qT)\<rbrakk> \<Longrightarrow> ?io @ [(?x, ?y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A

goal (1 subgoal):
 1. \<forall>io x y. io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pT)) A \<longrightarrow> (\<forall>y'. io @ [(x, y')] \<in> L (from_FSM M' qT) \<longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pT)) A)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
pass_io_set (from_FSM M' qT) (atc_to_io_set (from_FSM M (target q pT)) A)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
pass_io_set (from_FSM M' qT) (atc_to_io_set (from_FSM M (target q pT)) A)

goal (1 subgoal):
 1. \<not> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2)) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
pass_io_set (from_FSM M' qT) (atc_to_io_set (from_FSM M (target q pT)) A)
[PROOF STEP]
show "False"
[PROOF STATE]
proof (prove)
using this:
pass_io_set (from_FSM M' qT) (atc_to_io_set (from_FSM M (target q pT)) A)

goal (1 subgoal):
 1. False
[PROOF STEP]
using pass_separator_from_pass_io_set[OF \<open>is_separator M (target q pT) q' A d1 d2\<close> _ \<open>observable M\<close>
                                                   \<open>observable M'\<close> path_target_is_state[OF \<open>path M q pT\<close>]
                                                   \<open>qT \<in> states M'\<close> \<open>inputs M' = inputs M\<close> \<open>completely_specified M\<close>]
                \<open>\<not>pass_separator_ATC M' A qT d2\<close>
[PROOF STATE]
proof (prove)
using this:
pass_io_set (from_FSM M' qT) (atc_to_io_set (from_FSM M (target q pT)) A)
pass_io_set (from_FSM M' qT) (atc_to_io_set (from_FSM M (target q pT)) A) \<Longrightarrow> pass_separator_ATC M' A qT d2
\<not> pass_separator_ATC M' A qT d2

goal (1 subgoal):
 1. False
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs)) \<Longrightarrow> passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'

goal (1 subgoal):
 1. pass_io_set M' (test_suite_to_io M T) = passes_test_suite M T M'
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs)) \<Longrightarrow> passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'

goal (1 subgoal):
 1. pass_io_set M' (test_suite_to_io M T) = passes_test_suite M T M'
[PROOF STEP]
have "passes_test_suite M (Test_Suite prs tps rd_targets atcs) M' \<Longrightarrow> pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. passes_test_suite M (Test_Suite prs tps rd_targets atcs) M' \<Longrightarrow> pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. passes_test_suite M (Test_Suite prs tps rd_targets atcs) M' \<Longrightarrow> pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))
[PROOF STEP]
assume "passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'"
[PROOF STATE]
proof (state)
this:
passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'

goal (1 subgoal):
 1. passes_test_suite M (Test_Suite prs tps rd_targets atcs) M' \<Longrightarrow> pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))
[PROOF STEP]
(* pass properties *)
[PROOF STATE]
proof (state)
this:
passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'

goal (1 subgoal):
 1. passes_test_suite M (Test_Suite prs tps rd_targets atcs) M' \<Longrightarrow> pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))
[PROOF STEP]
have pass1: "\<And> q P io x y y' . (q,P) \<in> prs \<Longrightarrow> io@[(x,y)] \<in> L P \<Longrightarrow> io@[(x,y')] \<in> L M' \<Longrightarrow> io@[(x,y')] \<in> L P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q P io x y y'. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> L P
[PROOF STEP]
using \<open>passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'\<close>
[PROOF STATE]
proof (prove)
using this:
passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'

goal (1 subgoal):
 1. \<And>q P io x y y'. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> L P
[PROOF STEP]
unfolding passes_test_suite.simps
[PROOF STATE]
proof (prove)
using this:
(\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P) \<and> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<and> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2))

goal (1 subgoal):
 1. \<And>q P io x y y'. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P; io @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> io @ [(x, y')] \<in> L P
[PROOF STEP]
by meson
[PROOF STATE]
proof (state)
this:
\<lbrakk>(?q, ?P) \<in> prs; ?io @ [(?x, ?y)] \<in> L ?P; ?io @ [(?x, ?y')] \<in> L M'\<rbrakk> \<Longrightarrow> ?io @ [(?x, ?y')] \<in> L ?P

goal (1 subgoal):
 1. passes_test_suite M (Test_Suite prs tps rd_targets atcs) M' \<Longrightarrow> pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))
[PROOF STEP]
have pass2: "\<And> q P pP ioT pT x y y' . (q,P) \<in> prs \<Longrightarrow> path P (initial P) pP \<Longrightarrow> target (initial P) pP = q \<Longrightarrow> pT \<in> tps q \<Longrightarrow> ioT@[(x,y)] \<in> set (prefixes (p_io pT)) \<Longrightarrow> (p_io pP)@ioT@[(x,y')] \<in> L M' \<Longrightarrow> (\<exists> pT' . pT' \<in> tps q \<and> ioT@[(x,y')] \<in> set (prefixes (p_io pT')))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q P pP ioT pT x y y'. \<lbrakk>(q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pT \<in> tps q; ioT @ [(x, y)] \<in> set (prefixes (p_io pT)); p_io pP @ ioT @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> \<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT'))
[PROOF STEP]
using \<open>passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'\<close>
[PROOF STATE]
proof (prove)
using this:
passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'

goal (1 subgoal):
 1. \<And>q P pP ioT pT x y y'. \<lbrakk>(q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pT \<in> tps q; ioT @ [(x, y)] \<in> set (prefixes (p_io pT)); p_io pP @ ioT @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> \<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT'))
[PROOF STEP]
unfolding passes_test_suite.simps
[PROOF STATE]
proof (prove)
using this:
(\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P) \<and> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<and> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2))

goal (1 subgoal):
 1. \<And>q P pP ioT pT x y y'. \<lbrakk>(q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pT \<in> tps q; ioT @ [(x, y)] \<in> set (prefixes (p_io pT)); p_io pP @ ioT @ [(x, y')] \<in> L M'\<rbrakk> \<Longrightarrow> \<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT'))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>(?q, ?P) \<in> prs; path ?P (FSM.initial ?P) ?pP; target (FSM.initial ?P) ?pP = ?q; ?pT \<in> tps ?q; ?ioT @ [(?x, ?y)] \<in> set (prefixes (p_io ?pT)); p_io ?pP @ ?ioT @ [(?x, ?y')] \<in> L M'\<rbrakk> \<Longrightarrow> \<exists>pT'. pT' \<in> tps ?q \<and> ?ioT @ [(?x, ?y')] \<in> set (prefixes (p_io pT'))

goal (1 subgoal):
 1. passes_test_suite M (Test_Suite prs tps rd_targets atcs) M' \<Longrightarrow> pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))
[PROOF STEP]
have pass3: "\<And> q P pP pT q' A d1 d2 qT . (q,P) \<in> prs \<Longrightarrow> path P (initial P) pP \<Longrightarrow> target (initial P) pP = q \<Longrightarrow> pT \<in> tps q \<Longrightarrow> (p_io pP)@(p_io pT) \<in> L M' \<Longrightarrow> q' \<in> rd_targets (q,pT) \<Longrightarrow> (A,d1,d2) \<in> atcs (target q pT, q') \<Longrightarrow> qT \<in> io_targets M' ((p_io pP)@(p_io pT)) (initial M') \<Longrightarrow> pass_separator_ATC M' A qT d2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q P pP pT q' A d1 d2 qT. \<lbrakk>(q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pT \<in> tps q; p_io pP @ p_io pT \<in> L M'; q' \<in> rd_targets (q, pT); (A, d1, d2) \<in> atcs (target q pT, q'); qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M')\<rbrakk> \<Longrightarrow> pass_separator_ATC M' A qT d2
[PROOF STEP]
using \<open>passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'\<close>
[PROOF STATE]
proof (prove)
using this:
passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'

goal (1 subgoal):
 1. \<And>q P pP pT q' A d1 d2 qT. \<lbrakk>(q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pT \<in> tps q; p_io pP @ p_io pT \<in> L M'; q' \<in> rd_targets (q, pT); (A, d1, d2) \<in> atcs (target q pT, q'); qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M')\<rbrakk> \<Longrightarrow> pass_separator_ATC M' A qT d2
[PROOF STEP]
unfolding passes_test_suite.simps
[PROOF STATE]
proof (prove)
using this:
(\<forall>q P io x y y'. (q, P) \<in> prs \<longrightarrow> io @ [(x, y)] \<in> L P \<longrightarrow> io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> L P) \<and> (\<forall>q P pP ioT pT x y y'. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> ioT @ [(x, y)] \<in> set (prefixes (p_io pT)) \<longrightarrow> p_io pP @ ioT @ [(x, y')] \<in> L M' \<longrightarrow> (\<exists>pT'. pT' \<in> tps q \<and> ioT @ [(x, y')] \<in> set (prefixes (p_io pT')))) \<and> (\<forall>q P pP pT. (q, P) \<in> prs \<longrightarrow> path P (FSM.initial P) pP \<longrightarrow> target (FSM.initial P) pP = q \<longrightarrow> pT \<in> tps q \<longrightarrow> p_io pP @ p_io pT \<in> L M' \<longrightarrow> (\<forall>q' A d1 d2 qT. q' \<in> rd_targets (q, pT) \<longrightarrow> (A, d1, d2) \<in> atcs (target q pT, q') \<longrightarrow> qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M') \<longrightarrow> pass_separator_ATC M' A qT d2))

goal (1 subgoal):
 1. \<And>q P pP pT q' A d1 d2 qT. \<lbrakk>(q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pT \<in> tps q; p_io pP @ p_io pT \<in> L M'; q' \<in> rd_targets (q, pT); (A, d1, d2) \<in> atcs (target q pT, q'); qT \<in> io_targets M' (p_io pP @ p_io pT) (FSM.initial M')\<rbrakk> \<Longrightarrow> pass_separator_ATC M' A qT d2
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>(?q, ?P) \<in> prs; path ?P (FSM.initial ?P) ?pP; target (FSM.initial ?P) ?pP = ?q; ?pT \<in> tps ?q; p_io ?pP @ p_io ?pT \<in> L M'; ?q' \<in> rd_targets (?q, ?pT); (?A, ?d1.0, ?d2.0) \<in> atcs (target ?q ?pT, ?q'); ?qT \<in> io_targets M' (p_io ?pP @ p_io ?pT) (FSM.initial M')\<rbrakk> \<Longrightarrow> pass_separator_ATC M' ?A ?qT ?d2.0

goal (1 subgoal):
 1. passes_test_suite M (Test_Suite prs tps rd_targets atcs) M' \<Longrightarrow> pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))
[PROOF STEP]
show "pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))
[PROOF STEP]
proof (rule ccontr)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs)) \<Longrightarrow> False
[PROOF STEP]
assume "\<not> pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))"
[PROOF STATE]
proof (state)
this:
\<not> pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))

goal (1 subgoal):
 1. \<not> pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs)) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))
[PROOF STEP]
obtain io x y y' where "io @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)"
                            and   "io @ [(x, y')] \<in> L M'"
                            and   "io @ [(x, y')] \<notin> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)"
[PROOF STATE]
proof (prove)
using this:
\<not> pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))

goal (1 subgoal):
 1. (\<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs); io @ [(x, y')] \<in> L M'; io @ [(x, y')] \<notin> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding pass_io_set_def
[PROOF STATE]
proof (prove)
using this:
\<not> (\<forall>io x y. io @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs) \<longrightarrow> (\<forall>y'. io @ [(x, y')] \<in> L M' \<longrightarrow> io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)))

goal (1 subgoal):
 1. (\<And>io x y y'. \<lbrakk>io @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs); io @ [(x, y')] \<in> L M'; io @ [(x, y')] \<notin> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
io @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
io @ [(x, y')] \<in> L M'
io @ [(x, y')] \<notin> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. \<not> pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs)) \<Longrightarrow> False
[PROOF STEP]
have preamble_prop: "\<And> q P . (q, P) \<in> prs \<Longrightarrow> io @ [(x, y)] \<in> L P \<Longrightarrow> False"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q P. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>q P. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
fix q P
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>q P. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume "(q, P)\<in>prs" and "io @ [(x, y)] \<in> L P"
[PROOF STATE]
proof (state)
this:
(q, P) \<in> prs
io @ [(x, y)] \<in> L P

goal (1 subgoal):
 1. \<And>q P. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
have "io @ [(x, y')] \<in> L P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. io @ [(x, y')] \<in> L P
[PROOF STEP]
using pass1[OF \<open>(q, P)\<in>prs\<close> \<open>io @ [(x, y)] \<in> L P\<close> \<open>io @ [(x, y')] \<in> L M'\<close> ]
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> L P

goal (1 subgoal):
 1. io @ [(x, y')] \<in> L P
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
io @ [(x, y')] \<in> L P

goal (1 subgoal):
 1. \<And>q P. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
io @ [(x, y')] \<in> L P
[PROOF STEP]
have "io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)"
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> L P

goal (1 subgoal):
 1. io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
unfolding test_suite_to_io.simps
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> L P

goal (1 subgoal):
 1. io @ [(x, y')] \<in> (\<Union>(q, P)\<in>prs. L P) \<union> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q} \<union> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')}
[PROOF STEP]
using \<open>(q, P)\<in>prs\<close>
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> L P
(q, P) \<in> prs

goal (1 subgoal):
 1. io @ [(x, y')] \<in> (\<Union>(q, P)\<in>prs. L P) \<union> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q} \<union> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. \<And>q P. \<lbrakk>(q, P) \<in> prs; io @ [(x, y)] \<in> L P\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
show "False"
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. False
[PROOF STEP]
using \<open>io @ [(x, y')] \<notin> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)\<close>
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
io @ [(x, y')] \<notin> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. False
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>(?q, ?P) \<in> prs; io @ [(x, y)] \<in> L ?P\<rbrakk> \<Longrightarrow> False

goal (1 subgoal):
 1. \<not> pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs)) \<Longrightarrow> False
[PROOF STEP]
have traversal_path_prop : "\<And> pP pt q P .  io @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pt)) \<Longrightarrow> (q, P) \<in> prs \<Longrightarrow> path P (FSM.initial P) pP \<Longrightarrow> target (FSM.initial P) pP = q \<Longrightarrow> pt \<in> tps q \<Longrightarrow> False"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>pP pt q P. \<lbrakk>io @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pt)); (q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pt \<in> tps q\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>pP pt q P. \<lbrakk>io @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pt)); (q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pt \<in> tps q\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
fix pP pt q P
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>pP pt q P. \<lbrakk>io @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pt)); (q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pt \<in> tps q\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume "io @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pt))"
                       and   "(q, P) \<in> prs"
                       and   "path P (FSM.initial P) pP"
                       and   "target (FSM.initial P) pP = q"
                       and   "pt \<in> tps q"
[PROOF STATE]
proof (state)
this:
io @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pt))
(q, P) \<in> prs
path P (FSM.initial P) pP
target (FSM.initial P) pP = q
pt \<in> tps q

goal (1 subgoal):
 1. \<And>pP pt q P. \<lbrakk>io @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pt)); (q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pt \<in> tps q\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
obtain io' io'' where "io @ [(x, y)] = (p_io pP) @ io'" and "io'@io'' = p_io pt"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>io' io''. \<lbrakk>io @ [(x, y)] = p_io pP @ io'; io' @ io'' = p_io pt\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<open>io @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pt))\<close>
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pt))

goal (1 subgoal):
 1. (\<And>io' io''. \<lbrakk>io @ [(x, y)] = p_io pP @ io'; io' @ io'' = p_io pt\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding prefixes_set
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y)] \<in> (@) (p_io pP) ` {xs'. \<exists>xs''. xs' @ xs'' = p_io pt}

goal (1 subgoal):
 1. (\<And>io' io''. \<lbrakk>io @ [(x, y)] = p_io pP @ io'; io' @ io'' = p_io pt\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
io @ [(x, y)] = p_io pP @ io'
io' @ io'' = p_io pt

goal (1 subgoal):
 1. \<And>pP pt q P. \<lbrakk>io @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pt)); (q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pt \<in> tps q\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
have "is_submachine P M"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_submachine P M
[PROOF STEP]
using t2[OF \<open>(q, P) \<in> prs\<close>]
[PROOF STATE]
proof (prove)
using this:
is_preamble P M q

goal (1 subgoal):
 1. is_submachine P M
[PROOF STEP]
unfolding is_preamble_def
[PROOF STATE]
proof (prove)
using this:
FSM.acyclic P \<and> single_input P \<and> is_submachine P M \<and> q \<in> reachable_states P \<and> deadlock_state P q \<and> (\<forall>q'\<in>reachable_states P. (q = q' \<or> \<not> deadlock_state P q') \<and> (\<forall>x\<in>FSM.inputs M. (\<exists>t\<in>FSM.transitions P. t_source t = q' \<and> t_input t = x) \<longrightarrow> (\<forall>t'\<in>FSM.transitions M. t_source t' = q' \<and> t_input t' = x \<longrightarrow> t' \<in> FSM.transitions P)))

goal (1 subgoal):
 1. is_submachine P M
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
is_submachine P M

goal (1 subgoal):
 1. \<And>pP pt q P. \<lbrakk>io @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pt)); (q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pt \<in> tps q\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
is_submachine P M
[PROOF STEP]
have "initial P = initial M"
[PROOF STATE]
proof (prove)
using this:
is_submachine P M

goal (1 subgoal):
 1. FSM.initial P = FSM.initial M
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
FSM.initial P = FSM.initial M

goal (1 subgoal):
 1. \<And>pP pt q P. \<lbrakk>io @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pt)); (q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pt \<in> tps q\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
have "path M (initial M) pP"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. path M (FSM.initial M) pP
[PROOF STEP]
using submachine_path[OF \<open>is_submachine P M\<close> \<open>path P (initial P) pP\<close>]
[PROOF STATE]
proof (prove)
using this:
path M (FSM.initial P) pP

goal (1 subgoal):
 1. path M (FSM.initial M) pP
[PROOF STEP]
unfolding \<open>initial P = initial M\<close>
[PROOF STATE]
proof (prove)
using this:
path M (FSM.initial M) pP

goal (1 subgoal):
 1. path M (FSM.initial M) pP
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
path M (FSM.initial M) pP

goal (1 subgoal):
 1. \<And>pP pt q P. \<lbrakk>io @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pt)); (q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pt \<in> tps q\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
have "target (initial M) pP = q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. target (FSM.initial M) pP = q
[PROOF STEP]
using \<open>target (initial P) pP = q\<close>
[PROOF STATE]
proof (prove)
using this:
target (FSM.initial P) pP = q

goal (1 subgoal):
 1. target (FSM.initial M) pP = q
[PROOF STEP]
unfolding \<open>initial P = initial M\<close>
[PROOF STATE]
proof (prove)
using this:
target (FSM.initial M) pP = q

goal (1 subgoal):
 1. target (FSM.initial M) pP = q
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
target (FSM.initial M) pP = q

goal (1 subgoal):
 1. \<And>pP pt q P. \<lbrakk>io @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pt)); (q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pt \<in> tps q\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
have "q \<in> states M"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. q \<in> FSM.states M
[PROOF STEP]
using is_preamble_is_state[OF t2[OF \<open>(q, P) \<in> prs\<close>]]
[PROOF STATE]
proof (prove)
using this:
q \<in> FSM.states M

goal (1 subgoal):
 1. q \<in> FSM.states M
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
q \<in> FSM.states M

goal (1 subgoal):
 1. \<And>pP pt q P. \<lbrakk>io @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pt)); (q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pt \<in> tps q\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
have "q \<in> fst ` prs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. q \<in> fst ` prs
[PROOF STEP]
using \<open>(q, P) \<in> prs\<close>
[PROOF STATE]
proof (prove)
using this:
(q, P) \<in> prs

goal (1 subgoal):
 1. q \<in> fst ` prs
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
q \<in> fst ` prs

goal (1 subgoal):
 1. \<And>pP pt q P. \<lbrakk>io @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pt)); (q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pt \<in> tps q\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
show "False"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. False
[PROOF STEP]
proof (cases io' rule: rev_cases)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. io' = [] \<Longrightarrow> False
 2. \<And>ys y. io' = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
io' = []

goal (2 subgoals):
 1. io' = [] \<Longrightarrow> False
 2. \<And>ys y. io' = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
io' = []
[PROOF STEP]
have "p_io pP = io @ [(x, y)]"
[PROOF STATE]
proof (prove)
using this:
io' = []

goal (1 subgoal):
 1. p_io pP = io @ [(x, y)]
[PROOF STEP]
using \<open>io @ [(x, y)] = (p_io pP) @ io'\<close>
[PROOF STATE]
proof (prove)
using this:
io' = []
io @ [(x, y)] = p_io pP @ io'

goal (1 subgoal):
 1. p_io pP = io @ [(x, y)]
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
p_io pP = io @ [(x, y)]

goal (2 subgoals):
 1. io' = [] \<Longrightarrow> False
 2. \<And>ys y. io' = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. False
[PROOF STEP]
using preamble_prop[OF \<open>(q,P) \<in> prs\<close> language_state_containment[OF \<open>path P (FSM.initial P) pP\<close> \<open>p_io pP = io @ [(x, y)]\<close>]]
[PROOF STATE]
proof (prove)
using this:
False

goal (1 subgoal):
 1. False
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. \<And>ys y. io' = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>ys y. io' = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
case (snoc ioI xy)
[PROOF STATE]
proof (state)
this:
io' = ioI @ [xy]

goal (1 subgoal):
 1. \<And>ys y. io' = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
io' = ioI @ [xy]
[PROOF STEP]
have "xy = (x,y)" and "io = (p_io pP) @ ioI"
[PROOF STATE]
proof (prove)
using this:
io' = ioI @ [xy]

goal (1 subgoal):
 1. xy = (x, y) &&& io = p_io pP @ ioI
[PROOF STEP]
using \<open>io @ [(x, y)] = (p_io pP) @ io'\<close>
[PROOF STATE]
proof (prove)
using this:
io' = ioI @ [xy]
io @ [(x, y)] = p_io pP @ io'

goal (1 subgoal):
 1. xy = (x, y) &&& io = p_io pP @ ioI
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
xy = (x, y)
io = p_io pP @ ioI

goal (1 subgoal):
 1. \<And>ys y. io' = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
xy = (x, y)
io = p_io pP @ ioI
[PROOF STEP]
have "p_io pP @ ioI @ [(x, y')] \<in> L M'"
[PROOF STATE]
proof (prove)
using this:
xy = (x, y)
io = p_io pP @ ioI

goal (1 subgoal):
 1. p_io pP @ ioI @ [(x, y')] \<in> L M'
[PROOF STEP]
using \<open>io @ [(x, y')] \<in> L M'\<close>
[PROOF STATE]
proof (prove)
using this:
xy = (x, y)
io = p_io pP @ ioI
io @ [(x, y')] \<in> L M'

goal (1 subgoal):
 1. p_io pP @ ioI @ [(x, y')] \<in> L M'
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
p_io pP @ ioI @ [(x, y')] \<in> L M'

goal (1 subgoal):
 1. \<And>ys y. io' = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
have "ioI @ [(x, y)] \<in> set (prefixes (p_io pt))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ioI @ [(x, y)] \<in> set (prefixes (p_io pt))
[PROOF STEP]
unfolding prefixes_set
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ioI @ [(x, y)] \<in> {xs'. \<exists>xs''. xs' @ xs'' = p_io pt}
[PROOF STEP]
using \<open>io' @ io'' = p_io pt\<close> \<open>xy = (x, y)\<close> snoc
[PROOF STATE]
proof (prove)
using this:
io' @ io'' = p_io pt
xy = (x, y)
io' = ioI @ [xy]

goal (1 subgoal):
 1. ioI @ [(x, y)] \<in> {xs'. \<exists>xs''. xs' @ xs'' = p_io pt}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
ioI @ [(x, y)] \<in> set (prefixes (p_io pt))

goal (1 subgoal):
 1. \<And>ys y. io' = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
obtain pT' where "pT' \<in> tps q" and "ioI @ [(x, y')] \<in> set (prefixes (p_io pT'))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>pT'. \<lbrakk>pT' \<in> tps q; ioI @ [(x, y')] \<in> set (prefixes (p_io pT'))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using pass2[OF \<open>(q, P) \<in> prs\<close> \<open>path P (FSM.initial P) pP\<close> \<open>target (FSM.initial P) pP = q\<close> \<open>pt \<in> tps q\<close>
                           \<open>ioI @ [(x, y)] \<in> set (prefixes (p_io pt))\<close> \<open>p_io pP @ ioI @ [(x, y')] \<in> L M'\<close>]
[PROOF STATE]
proof (prove)
using this:
\<exists>pT'. pT' \<in> tps q \<and> ioI @ [(x, y')] \<in> set (prefixes (p_io pT'))

goal (1 subgoal):
 1. (\<And>pT'. \<lbrakk>pT' \<in> tps q; ioI @ [(x, y')] \<in> set (prefixes (p_io pT'))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
pT' \<in> tps q
ioI @ [(x, y')] \<in> set (prefixes (p_io pT'))

goal (1 subgoal):
 1. \<And>ys y. io' = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
have "io @ [(x, y')] \<in> (@) (p_io pP) ` set (prefixes (p_io pT'))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. io @ [(x, y')] \<in> (@) (p_io pP) ` set (prefixes (p_io pT'))
[PROOF STEP]
using \<open>ioI @ [(x, y')] \<in> set (prefixes (p_io pT'))\<close>
[PROOF STATE]
proof (prove)
using this:
ioI @ [(x, y')] \<in> set (prefixes (p_io pT'))

goal (1 subgoal):
 1. io @ [(x, y')] \<in> (@) (p_io pP) ` set (prefixes (p_io pT'))
[PROOF STEP]
unfolding \<open>io = (p_io pP) @ ioI\<close>
[PROOF STATE]
proof (prove)
using this:
ioI @ [(x, y')] \<in> set (prefixes (p_io pT'))

goal (1 subgoal):
 1. (p_io pP @ ioI) @ [(x, y')] \<in> (@) (p_io pP) ` set (prefixes (p_io pT'))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
io @ [(x, y')] \<in> (@) (p_io pP) ` set (prefixes (p_io pT'))

goal (1 subgoal):
 1. \<And>ys y. io' = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
have "io @ [(x, y')] \<in> (\<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. io @ [(x, y')] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q}
[PROOF STEP]
using \<open>(q, P) \<in> prs\<close> \<open>path P (FSM.initial P) pP\<close> \<open>target (FSM.initial P) pP = q\<close>
                  \<open>pT' \<in> tps q\<close> \<open>io @ [(x, y')] \<in> (@) (p_io pP) ` set (prefixes (p_io pT'))\<close>
[PROOF STATE]
proof (prove)
using this:
(q, P) \<in> prs
path P (FSM.initial P) pP
target (FSM.initial P) pP = q
pT' \<in> tps q
io @ [(x, y')] \<in> (@) (p_io pP) ` set (prefixes (p_io pT'))

goal (1 subgoal):
 1. io @ [(x, y')] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
io @ [(x, y')] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q}

goal (1 subgoal):
 1. \<And>ys y. io' = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
io @ [(x, y')] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q}
[PROOF STEP]
have "io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)"
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q}

goal (1 subgoal):
 1. io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
unfolding test_suite_to_io.simps
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q}

goal (1 subgoal):
 1. io @ [(x, y')] \<in> (\<Union>(q, P)\<in>prs. L P) \<union> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q} \<union> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. \<And>ys y. io' = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
show "False"
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. False
[PROOF STEP]
using \<open>io @ [(x, y')] \<notin> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)\<close>
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
io @ [(x, y')] \<notin> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. False
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>io @ [(x, y)] \<in> (@) (p_io ?pP) ` set (prefixes (p_io ?pt)); (?q, ?P) \<in> prs; path ?P (FSM.initial ?P) ?pP; target (FSM.initial ?P) ?pP = ?q; ?pt \<in> tps ?q\<rbrakk> \<Longrightarrow> False

goal (1 subgoal):
 1. \<not> pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs)) \<Longrightarrow> False
[PROOF STEP]
consider (a) "io @ [(x, y)] \<in> (\<Union>(q, P)\<in>prs. L P)" |
               (b) "io @ [(x, y)] \<in> (\<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q})" |
               (c) "io @ [(x, y)] \<in> (\<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (FSM.from_FSM M (target q pt)) A |p pt q A.
                                           \<exists>P q' t1 t2.
                                              (q, P) \<in> prs \<and>
                                              path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>io @ [(x, y)] \<in> (\<Union>(q, P)\<in>prs. L P) \<Longrightarrow> thesis; io @ [(x, y)] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q} \<Longrightarrow> thesis; io @ [(x, y)] \<in> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')} \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
using \<open>io @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)\<close>
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y)] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. \<lbrakk>io @ [(x, y)] \<in> (\<Union>(q, P)\<in>prs. L P) \<Longrightarrow> thesis; io @ [(x, y)] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q} \<Longrightarrow> thesis; io @ [(x, y)] \<in> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')} \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
unfolding test_suite_to_io.simps
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y)] \<in> (\<Union>(q, P)\<in>prs. L P) \<union> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q} \<union> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')}

goal (1 subgoal):
 1. \<lbrakk>io @ [(x, y)] \<in> (\<Union>(q, P)\<in>prs. L P) \<Longrightarrow> thesis; io @ [(x, y)] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q} \<Longrightarrow> thesis; io @ [(x, y)] \<in> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')} \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>io @ [(x, y)] \<in> (\<Union>(q, P)\<in>prs. L P) \<Longrightarrow> ?thesis; io @ [(x, y)] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q} \<Longrightarrow> ?thesis; io @ [(x, y)] \<in> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')} \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. \<not> pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs)) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>io @ [(x, y)] \<in> (\<Union>(q, P)\<in>prs. L P) \<Longrightarrow> ?thesis; io @ [(x, y)] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q} \<Longrightarrow> ?thesis; io @ [(x, y)] \<in> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')} \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
[PROOF STEP]
show "False"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>io @ [(x, y)] \<in> (\<Union>(q, P)\<in>prs. L P) \<Longrightarrow> ?thesis; io @ [(x, y)] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q} \<Longrightarrow> ?thesis; io @ [(x, y)] \<in> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')} \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. False
[PROOF STEP]
proof cases
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. io @ [(x, y)] \<in> (\<Union>(q, P)\<in>prs. L P) \<Longrightarrow> False
 2. io @ [(x, y)] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q} \<Longrightarrow> False
 3. io @ [(x, y)] \<in> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')} \<Longrightarrow> False
[PROOF STEP]
case a
[PROOF STATE]
proof (state)
this:
io @ [(x, y)] \<in> (\<Union>(q, P)\<in>prs. L P)

goal (3 subgoals):
 1. io @ [(x, y)] \<in> (\<Union>(q, P)\<in>prs. L P) \<Longrightarrow> False
 2. io @ [(x, y)] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q} \<Longrightarrow> False
 3. io @ [(x, y)] \<in> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')} \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
io @ [(x, y)] \<in> (\<Union>(q, P)\<in>prs. L P)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y)] \<in> (\<Union>(q, P)\<in>prs. L P)

goal (1 subgoal):
 1. False
[PROOF STEP]
using preamble_prop
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y)] \<in> (\<Union>(q, P)\<in>prs. L P)
\<lbrakk>(?q, ?P) \<in> prs; io @ [(x, y)] \<in> L ?P\<rbrakk> \<Longrightarrow> False

goal (1 subgoal):
 1. False
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
False

goal (2 subgoals):
 1. io @ [(x, y)] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q} \<Longrightarrow> False
 2. io @ [(x, y)] \<in> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')} \<Longrightarrow> False
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. io @ [(x, y)] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q} \<Longrightarrow> False
 2. io @ [(x, y)] \<in> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')} \<Longrightarrow> False
[PROOF STEP]
case b
[PROOF STATE]
proof (state)
this:
io @ [(x, y)] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q}

goal (2 subgoals):
 1. io @ [(x, y)] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q} \<Longrightarrow> False
 2. io @ [(x, y)] \<in> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')} \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
io @ [(x, y)] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y)] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q}

goal (1 subgoal):
 1. False
[PROOF STEP]
using traversal_path_prop
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y)] \<in> \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q}
\<lbrakk>io @ [(x, y)] \<in> (@) (p_io ?pP) ` set (prefixes (p_io ?pt)); (?q, ?P) \<in> prs; path ?P (FSM.initial ?P) ?pP; target (FSM.initial ?P) ?pP = ?q; ?pt \<in> tps ?q\<rbrakk> \<Longrightarrow> False

goal (1 subgoal):
 1. False
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. io @ [(x, y)] \<in> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')} \<Longrightarrow> False
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. io @ [(x, y)] \<in> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')} \<Longrightarrow> False
[PROOF STEP]
case c
[PROOF STATE]
proof (state)
this:
io @ [(x, y)] \<in> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')}

goal (1 subgoal):
 1. io @ [(x, y)] \<in> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')} \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
io @ [(x, y)] \<in> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')}
[PROOF STEP]
obtain pP pt q A P q' t1 t2 where "io @ [(x, y)] \<in> (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (FSM.from_FSM M (target q pt)) A"
                                          and "(q, P) \<in> prs"
                                          and "path P (FSM.initial P) pP"
                                          and "target (FSM.initial P) pP = q"
                                          and "pt \<in> tps q"
                                          and "q' \<in> rd_targets (q, pt)"
                                          and "(A, t1, t2) \<in> atcs (target q pt, q')"
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y)] \<in> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')}

goal (1 subgoal):
 1. (\<And>pP pt q A P q' t1 t2. \<lbrakk>io @ [(x, y)] \<in> (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A; (q, P) \<in> prs; path P (FSM.initial P) pP; target (FSM.initial P) pP = q; pt \<in> tps q; q' \<in> rd_targets (q, pt); (A, t1, t2) \<in> atcs (target q pt, q')\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
io @ [(x, y)] \<in> (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A
(q, P) \<in> prs
path P (FSM.initial P) pP
target (FSM.initial P) pP = q
pt \<in> tps q
q' \<in> rd_targets (q, pt)
(A, t1, t2) \<in> atcs (target q pt, q')

goal (1 subgoal):
 1. io @ [(x, y)] \<in> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')} \<Longrightarrow> False
[PROOF STEP]
obtain ioA where "io @ [(x, y)] = p_io pP @ p_io pt @ ioA"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>ioA. io @ [(x, y)] = p_io pP @ p_io pt @ ioA \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<open>io @ [(x, y)] \<in> (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (FSM.from_FSM M (target q pt)) A\<close>
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y)] \<in> (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A

goal (1 subgoal):
 1. (\<And>ioA. io @ [(x, y)] = p_io pP @ p_io pt @ ioA \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding prefixes_set
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y)] \<in> (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A

goal (1 subgoal):
 1. (\<And>ioA. io @ [(x, y)] = p_io pP @ p_io pt @ ioA \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
io @ [(x, y)] = p_io pP @ p_io pt @ ioA

goal (1 subgoal):
 1. io @ [(x, y)] \<in> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')} \<Longrightarrow> False
[PROOF STEP]
show "False"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. False
[PROOF STEP]
proof (cases ioA rule: rev_cases)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. ioA = [] \<Longrightarrow> False
 2. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
ioA = []

goal (2 subgoals):
 1. ioA = [] \<Longrightarrow> False
 2. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
ioA = []
[PROOF STEP]
have "io @ [(x, y)] = p_io pP @ p_io pt"
[PROOF STATE]
proof (prove)
using this:
ioA = []

goal (1 subgoal):
 1. io @ [(x, y)] = p_io pP @ p_io pt
[PROOF STEP]
using \<open>io @ [(x, y)] = p_io pP @ p_io pt @ ioA\<close>
[PROOF STATE]
proof (prove)
using this:
ioA = []
io @ [(x, y)] = p_io pP @ p_io pt @ ioA

goal (1 subgoal):
 1. io @ [(x, y)] = p_io pP @ p_io pt
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
io @ [(x, y)] = p_io pP @ p_io pt

goal (2 subgoals):
 1. ioA = [] \<Longrightarrow> False
 2. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
io @ [(x, y)] = p_io pP @ p_io pt
[PROOF STEP]
have "io @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pt))"
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y)] = p_io pP @ p_io pt

goal (1 subgoal):
 1. io @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pt))
[PROOF STEP]
unfolding prefixes_set
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y)] = p_io pP @ p_io pt

goal (1 subgoal):
 1. io @ [(x, y)] \<in> (@) (p_io pP) ` {xs'. \<exists>xs''. xs' @ xs'' = p_io pt}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
io @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pt))

goal (2 subgoals):
 1. ioA = [] \<Longrightarrow> False
 2. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. False
[PROOF STEP]
using traversal_path_prop[OF \<open>io @ [(x, y)] \<in> (@) (p_io pP) ` set (prefixes (p_io pt))\<close> \<open>(q, P) \<in> prs\<close>
                                         \<open>path P (FSM.initial P) pP\<close> \<open>target (FSM.initial P) pP = q\<close> \<open>pt \<in> tps q\<close>]
[PROOF STATE]
proof (prove)
using this:
False

goal (1 subgoal):
 1. False
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
case (snoc ioAI xy)
[PROOF STATE]
proof (state)
this:
ioA = ioAI @ [xy]

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
ioA = ioAI @ [xy]
[PROOF STEP]
have "xy = (x,y)" and "io = p_io pP @ p_io pt @ ioAI"
[PROOF STATE]
proof (prove)
using this:
ioA = ioAI @ [xy]

goal (1 subgoal):
 1. xy = (x, y) &&& io = p_io pP @ p_io pt @ ioAI
[PROOF STEP]
using \<open>io @ [(x, y)] = p_io pP @ p_io pt @ ioA\<close>
[PROOF STATE]
proof (prove)
using this:
ioA = ioAI @ [xy]
io @ [(x, y)] = p_io pP @ p_io pt @ ioA

goal (1 subgoal):
 1. xy = (x, y) &&& io = p_io pP @ p_io pt @ ioAI
[PROOF STEP]
by simp+
[PROOF STATE]
proof (state)
this:
xy = (x, y)
io = p_io pP @ p_io pt @ ioAI

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
xy = (x, y)
io = p_io pP @ p_io pt @ ioAI
[PROOF STEP]
have "p_io pP @ p_io pt @ ioAI @ [(x,y)] \<in> (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (FSM.from_FSM M (target q pt)) A"
[PROOF STATE]
proof (prove)
using this:
xy = (x, y)
io = p_io pP @ p_io pt @ ioAI

goal (1 subgoal):
 1. p_io pP @ p_io pt @ ioAI @ [(x, y)] \<in> (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A
[PROOF STEP]
using \<open>io @ [(x, y)] \<in> (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (FSM.from_FSM M (target q pt)) A\<close>
[PROOF STATE]
proof (prove)
using this:
xy = (x, y)
io = p_io pP @ p_io pt @ ioAI
io @ [(x, y)] \<in> (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A

goal (1 subgoal):
 1. p_io pP @ p_io pt @ ioAI @ [(x, y)] \<in> (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
p_io pP @ p_io pt @ ioAI @ [(x, y)] \<in> (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
p_io pP @ p_io pt @ ioAI @ [(x, y)] \<in> (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A
[PROOF STEP]
have "ioAI @ [(x,y)] \<in> atc_to_io_set (FSM.from_FSM M (target q pt)) A"
[PROOF STATE]
proof (prove)
using this:
p_io pP @ p_io pt @ ioAI @ [(x, y)] \<in> (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A

goal (1 subgoal):
 1. ioAI @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pt)) A
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
ioAI @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pt)) A

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
have "p_io pP @ p_io pt \<in> L M'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p_io pP @ p_io pt \<in> L M'
[PROOF STEP]
using \<open>io @ [(x,y')] \<in> L M'\<close> language_prefix[of "p_io pP @ p_io pt" "ioAI @ [(x, y')]" M' "initial M'"]
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> L M'
(p_io pP @ p_io pt) @ ioAI @ [(x, y')] \<in> L M' \<Longrightarrow> p_io pP @ p_io pt \<in> L M'

goal (1 subgoal):
 1. p_io pP @ p_io pt \<in> L M'
[PROOF STEP]
unfolding \<open>io = p_io pP @ p_io pt @ ioAI\<close>
[PROOF STATE]
proof (prove)
using this:
(p_io pP @ p_io pt @ ioAI) @ [(x, y')] \<in> L M'
(p_io pP @ p_io pt) @ ioAI @ [(x, y')] \<in> L M' \<Longrightarrow> p_io pP @ p_io pt \<in> L M'

goal (1 subgoal):
 1. p_io pP @ p_io pt \<in> L M'
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
p_io pP @ p_io pt \<in> L M'

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
p_io pP @ p_io pt \<in> L M'
[PROOF STEP]
obtain pt' where "path M' (initial M') pt'" and "p_io pt' = p_io pP @ p_io pt"
[PROOF STATE]
proof (prove)
using this:
p_io pP @ p_io pt \<in> L M'

goal (1 subgoal):
 1. (\<And>pt'. \<lbrakk>path M' (FSM.initial M') pt'; p_io pt' = p_io pP @ p_io pt\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
path M' (FSM.initial M') pt'
p_io pt' = p_io pP @ p_io pt

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
path M' (FSM.initial M') pt'
p_io pt' = p_io pP @ p_io pt
[PROOF STEP]
have  "target (initial M') pt' \<in> io_targets M' (p_io pP @ p_io pt) (FSM.initial M')"
[PROOF STATE]
proof (prove)
using this:
path M' (FSM.initial M') pt'
p_io pt' = p_io pP @ p_io pt

goal (1 subgoal):
 1. target (FSM.initial M') pt' \<in> io_targets M' (p_io pP @ p_io pt) (FSM.initial M')
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
target (FSM.initial M') pt' \<in> io_targets M' (p_io pP @ p_io pt) (FSM.initial M')

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
have "pass_separator_ATC M' A (target (FSM.initial M') pt') t2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pass_separator_ATC M' A (target (FSM.initial M') pt') t2
[PROOF STEP]
using pass3[OF \<open>(q, P) \<in> prs\<close> \<open>path P (FSM.initial P) pP\<close> \<open>target (FSM.initial P) pP = q\<close> \<open>pt \<in> tps q\<close>
                           \<open>p_io pP @ p_io pt \<in> L M'\<close> \<open>q' \<in> rd_targets (q, pt)\<close> \<open>(A, t1, t2) \<in> atcs (target q pt, q')\<close>
                           \<open>target (initial M') pt' \<in> io_targets M' (p_io pP @ p_io pt) (FSM.initial M')\<close>]
[PROOF STATE]
proof (prove)
using this:
pass_separator_ATC M' A (target (FSM.initial M') pt') t2

goal (1 subgoal):
 1. pass_separator_ATC M' A (target (FSM.initial M') pt') t2
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
pass_separator_ATC M' A (target (FSM.initial M') pt') t2

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
have "is_separator M (target q pt) q' A t1 t2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_separator M (target q pt) q' A t1 t2
[PROOF STEP]
using  t3[OF \<open>(A, t1, t2) \<in> atcs (target q pt, q')\<close>]
[PROOF STATE]
proof (prove)
using this:
(A, t2, t1) \<in> atcs (q', target q pt) \<and> is_separator M (target q pt) q' A t1 t2

goal (1 subgoal):
 1. is_separator M (target q pt) q' A t1 t2
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
is_separator M (target q pt) q' A t1 t2

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
have "is_submachine P M"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_submachine P M
[PROOF STEP]
using t2[OF \<open>(q, P) \<in> prs\<close>]
[PROOF STATE]
proof (prove)
using this:
is_preamble P M q

goal (1 subgoal):
 1. is_submachine P M
[PROOF STEP]
unfolding is_preamble_def
[PROOF STATE]
proof (prove)
using this:
FSM.acyclic P \<and> single_input P \<and> is_submachine P M \<and> q \<in> reachable_states P \<and> deadlock_state P q \<and> (\<forall>q'\<in>reachable_states P. (q = q' \<or> \<not> deadlock_state P q') \<and> (\<forall>x\<in>FSM.inputs M. (\<exists>t\<in>FSM.transitions P. t_source t = q' \<and> t_input t = x) \<longrightarrow> (\<forall>t'\<in>FSM.transitions M. t_source t' = q' \<and> t_input t' = x \<longrightarrow> t' \<in> FSM.transitions P)))

goal (1 subgoal):
 1. is_submachine P M
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
is_submachine P M

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
is_submachine P M
[PROOF STEP]
have "initial P = initial M"
[PROOF STATE]
proof (prove)
using this:
is_submachine P M

goal (1 subgoal):
 1. FSM.initial P = FSM.initial M
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
FSM.initial P = FSM.initial M

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
have "path M (initial M) pP"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. path M (FSM.initial M) pP
[PROOF STEP]
using submachine_path[OF \<open>is_submachine P M\<close> \<open>path P (initial P) pP\<close>]
[PROOF STATE]
proof (prove)
using this:
path M (FSM.initial P) pP

goal (1 subgoal):
 1. path M (FSM.initial M) pP
[PROOF STEP]
unfolding \<open>initial P = initial M\<close>
[PROOF STATE]
proof (prove)
using this:
path M (FSM.initial M) pP

goal (1 subgoal):
 1. path M (FSM.initial M) pP
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
path M (FSM.initial M) pP

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
have "target (initial M) pP = q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. target (FSM.initial M) pP = q
[PROOF STEP]
using \<open>target (initial P) pP = q\<close>
[PROOF STATE]
proof (prove)
using this:
target (FSM.initial P) pP = q

goal (1 subgoal):
 1. target (FSM.initial M) pP = q
[PROOF STEP]
unfolding \<open>initial P = initial M\<close>
[PROOF STATE]
proof (prove)
using this:
target (FSM.initial M) pP = q

goal (1 subgoal):
 1. target (FSM.initial M) pP = q
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
target (FSM.initial M) pP = q

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
have "q \<in> states M"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. q \<in> FSM.states M
[PROOF STEP]
using is_preamble_is_state[OF t2[OF \<open>(q, P) \<in> prs\<close>]]
[PROOF STATE]
proof (prove)
using this:
q \<in> FSM.states M

goal (1 subgoal):
 1. q \<in> FSM.states M
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
q \<in> FSM.states M

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
have "q \<in> fst ` prs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. q \<in> fst ` prs
[PROOF STEP]
using \<open>(q, P) \<in> prs\<close>
[PROOF STATE]
proof (prove)
using this:
(q, P) \<in> prs

goal (1 subgoal):
 1. q \<in> fst ` prs
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
q \<in> fst ` prs

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
obtain pT' d' where "(pt @ pT', d') \<in> m_traversal_paths_with_witness M q repetition_sets m"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>pT' d'. (pt @ pT', d') \<in> m_traversal_paths_with_witness M q repetition_sets m \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using t6[OF \<open>q \<in> fst ` prs\<close>] \<open>pt \<in> tps q\<close>
[PROOF STATE]
proof (prove)
using this:
tps q \<subseteq> {p1. \<exists>p2 d. (p1 @ p2, d) \<in> m_traversal_paths_with_witness M q repetition_sets m} \<and> fst ` m_traversal_paths_with_witness M q repetition_sets m \<subseteq> tps q
pt \<in> tps q

goal (1 subgoal):
 1. (\<And>pT' d'. (pt @ pT', d') \<in> m_traversal_paths_with_witness M q repetition_sets m \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(pt @ pT', d') \<in> m_traversal_paths_with_witness M q repetition_sets m

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(pt @ pT', d') \<in> m_traversal_paths_with_witness M q repetition_sets m
[PROOF STEP]
have "path M q (pt @ pT')"
               and  "find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pt @ pT'))) repetition_sets = Some d'"
               and  "\<And> p' p''. (pt @ pT') = p' @ p'' \<Longrightarrow> p'' \<noteq> [] \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None"
[PROOF STATE]
proof (prove)
using this:
(pt @ pT', d') \<in> m_traversal_paths_with_witness M q repetition_sets m

goal (1 subgoal):
 1. path M q (pt @ pT') &&& find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pt @ pT'))) repetition_sets = Some d' &&& (\<And>p' p''. \<lbrakk>pt @ pT' = p' @ p''; p'' \<noteq> []\<rbrakk> \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None)
[PROOF STEP]
using m_traversal_paths_with_witness_set[OF t5 t8 \<open>q \<in> states M\<close>, of m]
[PROOF STATE]
proof (prove)
using this:
(pt @ pT', d') \<in> m_traversal_paths_with_witness M q repetition_sets m
\<lbrakk>\<And>q. q \<in> FSM.states M \<Longrightarrow> q \<in> FSM.states M; \<And>d. d \<in> set repetition_sets \<Longrightarrow> d \<in> set repetition_sets\<rbrakk> \<Longrightarrow> m_traversal_paths_with_witness M q repetition_sets m = {(p, d) |p d. path M q p \<and> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p)) repetition_sets = Some d \<and> (\<forall>p' p''. p = p' @ p'' \<and> p'' \<noteq> [] \<longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None)}

goal (1 subgoal):
 1. path M q (pt @ pT') &&& find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pt @ pT'))) repetition_sets = Some d' &&& (\<And>p' p''. \<lbrakk>pt @ pT' = p' @ p''; p'' \<noteq> []\<rbrakk> \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) p')) repetition_sets = None)
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
path M q (pt @ pT')
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pt @ pT'))) repetition_sets = Some d'
\<lbrakk>pt @ pT' = ?p' @ ?p''; ?p'' \<noteq> []\<rbrakk> \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) ?p')) repetition_sets = None

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
path M q (pt @ pT')
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pt @ pT'))) repetition_sets = Some d'
\<lbrakk>pt @ pT' = ?p' @ ?p''; ?p'' \<noteq> []\<rbrakk> \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) ?p')) repetition_sets = None
[PROOF STEP]
have "path M q pt"
[PROOF STATE]
proof (prove)
using this:
path M q (pt @ pT')
find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) (pt @ pT'))) repetition_sets = Some d'
\<lbrakk>pt @ pT' = ?p' @ ?p''; ?p'' \<noteq> []\<rbrakk> \<Longrightarrow> find (\<lambda>d. Suc (m - card (snd d)) \<le> length (filter (\<lambda>t. t_target t \<in> fst d) ?p')) repetition_sets = None

goal (1 subgoal):
 1. path M q pt
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
path M q pt

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
have "target (initial M') pt' \<in> states M'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. target (FSM.initial M') pt' \<in> FSM.states M'
[PROOF STEP]
using \<open>target (initial M') pt' \<in> io_targets M' (p_io pP @ p_io pt) (FSM.initial M')\<close> io_targets_states
[PROOF STATE]
proof (prove)
using this:
target (FSM.initial M') pt' \<in> io_targets M' (p_io pP @ p_io pt) (FSM.initial M')
io_targets ?M ?io ?q \<subseteq> FSM.states ?M

goal (1 subgoal):
 1. target (FSM.initial M') pt' \<in> FSM.states M'
[PROOF STEP]
using subset_iff
[PROOF STATE]
proof (prove)
using this:
target (FSM.initial M') pt' \<in> io_targets M' (p_io pP @ p_io pt) (FSM.initial M')
io_targets ?M ?io ?q \<subseteq> FSM.states ?M
(?A \<subseteq> ?B) = (\<forall>t. t \<in> ?A \<longrightarrow> t \<in> ?B)

goal (1 subgoal):
 1. target (FSM.initial M') pt' \<in> FSM.states M'
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
target (FSM.initial M') pt' \<in> FSM.states M'

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
have "pass_io_set (FSM.from_FSM M' (target (FSM.initial M') pt')) (atc_to_io_set (FSM.from_FSM M (target q pt)) A)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pass_io_set (from_FSM M' (target (FSM.initial M') pt')) (atc_to_io_set (from_FSM M (target q pt)) A)
[PROOF STEP]
using  pass_io_set_from_pass_separator[OF \<open>is_separator M (target q pt) q' A t1 t2\<close>
                                                      \<open>pass_separator_ATC M' A (target (FSM.initial M') pt') t2\<close>
                                                      \<open>observable M\<close> \<open>observable M'\<close> path_target_is_state[OF \<open>path M q pt\<close>]
                                                      \<open>target (FSM.initial M') pt' \<in> FSM.states M'\<close> \<open>inputs M' = inputs M\<close>]
[PROOF STATE]
proof (prove)
using this:
pass_io_set (from_FSM M' (target (FSM.initial M') pt')) (atc_to_io_set (from_FSM M (target q pt)) A)

goal (1 subgoal):
 1. pass_io_set (from_FSM M' (target (FSM.initial M') pt')) (atc_to_io_set (from_FSM M (target q pt)) A)
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
pass_io_set (from_FSM M' (target (FSM.initial M') pt')) (atc_to_io_set (from_FSM M (target q pt)) A)

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
pass_io_set (from_FSM M' (target (FSM.initial M') pt')) (atc_to_io_set (from_FSM M (target q pt)) A)

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
note \<open>ioAI @ [(x,y)] \<in> atc_to_io_set (FSM.from_FSM M (target q pt)) A\<close>
[PROOF STATE]
proof (state)
this:
ioAI @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pt)) A

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ioAI @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pt)) A

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
have "ioAI @ [(x, y')] \<in> L (FSM.from_FSM M' (target (FSM.initial M') pt'))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ioAI @ [(x, y')] \<in> L (from_FSM M' (target (FSM.initial M') pt'))
[PROOF STEP]
using \<open>io @ [(x,y')] \<in> L M'\<close>
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> L M'

goal (1 subgoal):
 1. ioAI @ [(x, y')] \<in> L (from_FSM M' (target (FSM.initial M') pt'))
[PROOF STEP]
unfolding \<open>io = p_io pP @ p_io pt @ ioAI\<close>
[PROOF STATE]
proof (prove)
using this:
(p_io pP @ p_io pt @ ioAI) @ [(x, y')] \<in> L M'

goal (1 subgoal):
 1. ioAI @ [(x, y')] \<in> L (from_FSM M' (target (FSM.initial M') pt'))
[PROOF STEP]
by (metis (no_types, lifting) \<open>target (FSM.initial M') pt' \<in> FSM.states M'\<close>
                  \<open>target (FSM.initial M') pt' \<in> io_targets M' (p_io pP @ p_io pt) (FSM.initial M')\<close>
                  append_assoc assms(3) from_FSM_language observable_io_targets_language)
[PROOF STATE]
proof (state)
this:
ioAI @ [(x, y')] \<in> L (from_FSM M' (target (FSM.initial M') pt'))

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
pass_io_set (from_FSM M' (target (FSM.initial M') pt')) (atc_to_io_set (from_FSM M (target q pt)) A)
ioAI @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pt)) A
ioAI @ [(x, y')] \<in> L (from_FSM M' (target (FSM.initial M') pt'))
[PROOF STEP]
have "ioAI @ [(x,y')] \<in> atc_to_io_set (FSM.from_FSM M (target q pt)) A"
[PROOF STATE]
proof (prove)
using this:
pass_io_set (from_FSM M' (target (FSM.initial M') pt')) (atc_to_io_set (from_FSM M (target q pt)) A)
ioAI @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pt)) A
ioAI @ [(x, y')] \<in> L (from_FSM M' (target (FSM.initial M') pt'))

goal (1 subgoal):
 1. ioAI @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pt)) A
[PROOF STEP]
unfolding pass_io_set_def
[PROOF STATE]
proof (prove)
using this:
\<forall>io x y. io @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pt)) A \<longrightarrow> (\<forall>y'. io @ [(x, y')] \<in> L (from_FSM M' (target (FSM.initial M') pt')) \<longrightarrow> io @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pt)) A)
ioAI @ [(x, y)] \<in> atc_to_io_set (from_FSM M (target q pt)) A
ioAI @ [(x, y')] \<in> L (from_FSM M' (target (FSM.initial M') pt'))

goal (1 subgoal):
 1. ioAI @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pt)) A
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
ioAI @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pt)) A

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
(* subsets of test_suite_to_io *)
[PROOF STATE]
proof (state)
this:
ioAI @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pt)) A

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
define tmp where tmp_def : "tmp = (\<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (FSM.from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')})"
[PROOF STATE]
proof (state)
this:
tmp = \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')}

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
define tmp2 where tmp2_def : "tmp2 = \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q}"
[PROOF STATE]
proof (state)
this:
tmp2 = \<Union> {(@) (p_io p) ` set (prefixes (p_io pt)) |p pt. \<exists>q P. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q}

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
have "\<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) pP \<and> target (FSM.initial P) pP = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) pP \<and> target (FSM.initial P) pP = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')
[PROOF STEP]
using \<open>(q, P) \<in> prs\<close> \<open>path P (FSM.initial P) pP\<close> \<open>target (FSM.initial P) pP = q\<close> \<open>pt \<in> tps q\<close> \<open>q' \<in> rd_targets (q, pt)\<close> \<open>(A, t1, t2) \<in> atcs (target q pt, q')\<close>
[PROOF STATE]
proof (prove)
using this:
(q, P) \<in> prs
path P (FSM.initial P) pP
target (FSM.initial P) pP = q
pt \<in> tps q
q' \<in> rd_targets (q, pt)
(A, t1, t2) \<in> atcs (target q pt, q')

goal (1 subgoal):
 1. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) pP \<and> target (FSM.initial P) pP = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) pP \<and> target (FSM.initial P) pP = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) pP \<and> target (FSM.initial P) pP = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')
[PROOF STEP]
have "(\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (FSM.from_FSM M (target q pt)) A \<subseteq> tmp"
[PROOF STATE]
proof (prove)
using this:
\<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) pP \<and> target (FSM.initial P) pP = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')

goal (1 subgoal):
 1. (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A \<subseteq> tmp
[PROOF STEP]
unfolding tmp_def
[PROOF STATE]
proof (prove)
using this:
\<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) pP \<and> target (FSM.initial P) pP = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')

goal (1 subgoal):
 1. (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A \<subseteq> \<Union> {(\<lambda>io_atc. p_io p @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A |p pt q A. \<exists>P q' t1 t2. (q, P) \<in> prs \<and> path P (FSM.initial P) p \<and> target (FSM.initial P) p = q \<and> pt \<in> tps q \<and> q' \<in> rd_targets (q, pt) \<and> (A, t1, t2) \<in> atcs (target q pt, q')}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A \<subseteq> tmp

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A \<subseteq> tmp
[PROOF STEP]
have "(\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (FSM.from_FSM M (target q pt)) A \<subseteq> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)"
[PROOF STATE]
proof (prove)
using this:
(\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A \<subseteq> tmp

goal (1 subgoal):
 1. (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A \<subseteq> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
unfolding test_suite_to_io.simps tmp_def[symmetric] tmp2_def[symmetric]
[PROOF STATE]
proof (prove)
using this:
(\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A \<subseteq> tmp

goal (1 subgoal):
 1. (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A \<subseteq> (\<Union>(q, P)\<in>prs. L P) \<union> tmp2 \<union> tmp
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A \<subseteq> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A \<subseteq> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
have "(p_io pP @ p_io pt @ (ioAI @ [(x, y')])) \<in> (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (FSM.from_FSM M (target q pt)) A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p_io pP @ p_io pt @ ioAI @ [(x, y')] \<in> (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A
[PROOF STEP]
using \<open>ioAI @ [(x, y')] \<in> atc_to_io_set (FSM.from_FSM M (target q pt)) A\<close>
[PROOF STATE]
proof (prove)
using this:
ioAI @ [(x, y')] \<in> atc_to_io_set (from_FSM M (target q pt)) A

goal (1 subgoal):
 1. p_io pP @ p_io pt @ ioAI @ [(x, y')] \<in> (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
p_io pP @ p_io pt @ ioAI @ [(x, y')] \<in> (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A \<subseteq> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
p_io pP @ p_io pt @ ioAI @ [(x, y')] \<in> (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A
[PROOF STEP]
have "(p_io pP @ p_io pt @ (ioAI @ [(x, y')])) \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)"
[PROOF STATE]
proof (prove)
using this:
(\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A \<subseteq> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
p_io pP @ p_io pt @ ioAI @ [(x, y')] \<in> (\<lambda>io_atc. p_io pP @ p_io pt @ io_atc) ` atc_to_io_set (from_FSM M (target q pt)) A

goal (1 subgoal):
 1. p_io pP @ p_io pt @ ioAI @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
p_io pP @ p_io pt @ ioAI @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
p_io pP @ p_io pt @ ioAI @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
have "io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)"
[PROOF STATE]
proof (prove)
using this:
p_io pP @ p_io pt @ ioAI @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
unfolding \<open>io = p_io pP @ p_io pt @ ioAI\<close>
[PROOF STATE]
proof (prove)
using this:
p_io pP @ p_io pt @ ioAI @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. (p_io pP @ p_io pt @ ioAI) @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. \<And>ys y. ioA = ys @ [y] \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
[PROOF STEP]
show "False"
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. False
[PROOF STEP]
using \<open>io @ [(x, y')] \<notin> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)\<close>
[PROOF STATE]
proof (prove)
using this:
io @ [(x, y')] \<in> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)
io @ [(x, y')] \<notin> test_suite_to_io M (Test_Suite prs tps rd_targets atcs)

goal (1 subgoal):
 1. False
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
passes_test_suite M (Test_Suite prs tps rd_targets atcs) M' \<Longrightarrow> pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))

goal (1 subgoal):
 1. pass_io_set M' (test_suite_to_io M T) = passes_test_suite M T M'
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs)) \<Longrightarrow> passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'
passes_test_suite M (Test_Suite prs tps rd_targets atcs) M' \<Longrightarrow> pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs)) \<Longrightarrow> passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'
passes_test_suite M (Test_Suite prs tps rd_targets atcs) M' \<Longrightarrow> pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))

goal (1 subgoal):
 1. pass_io_set M' (test_suite_to_io M T) = passes_test_suite M T M'
[PROOF STEP]
unfolding \<open>T = Test_Suite prs tps rd_targets atcs\<close>
[PROOF STATE]
proof (prove)
using this:
pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs)) \<Longrightarrow> passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'
passes_test_suite M (Test_Suite prs tps rd_targets atcs) M' \<Longrightarrow> pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs))

goal (1 subgoal):
 1. pass_io_set M' (test_suite_to_io M (Test_Suite prs tps rd_targets atcs)) = passes_test_suite M (Test_Suite prs tps rd_targets atcs) M'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
pass_io_set M' (test_suite_to_io M T) = passes_test_suite M T M'

goal:
No subgoals!
[PROOF STEP]
qed