[STATEMENT]
lemma sub_from_counter:
  "evaluate_match ck env s v pes err_v r1 \<Longrightarrow>
   \<forall>count count' s' r'.
    (clock   s) = count + extra1 \<and>
    r1 = (s',r') \<and>
    (clock   s') = count' + extra1 \<and>
    ck = True \<longrightarrow>
    evaluate_match True env (s (| clock := count |)) v pes err_v ((s' (| clock := count' |) ),r')"
  "evaluate_list ck env s es r2 \<Longrightarrow>
   \<forall>count count' s' r'.
    (clock   s) = count + extra2 \<and>
    r2 = (s',r') \<and>
    (clock   s') = count' + extra2 \<and>
    ck = True \<longrightarrow>
    evaluate_list True env (s (| clock := count |)) es ((s' (| clock := count' |) ),r')"
  "evaluate ck env s e r3 \<Longrightarrow>
   \<forall>count count' s' r'.
    (clock   s) = count + extra3 \<and>
    r3 = (s',r') \<and>
    (clock   s') = count' + extra3 \<and>
    ck = True \<longrightarrow>
    evaluate True env (s (| clock := count |)) e ((s' (| clock := count' |) ),r')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (evaluate_match ck env s v pes err_v r1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra1 \<and> r1 = (s', r') \<and> clock s' = count' + extra1 \<and> ck = True \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s) v pes err_v (update_clock (\<lambda>_. count') s', r')) &&& (evaluate_list ck env s es r2 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra2 \<and> r2 = (s', r') \<and> clock s' = count' + extra2 \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) es (update_clock (\<lambda>_. count') s', r')) &&& (evaluate ck env s e r3 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> r3 = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) e (update_clock (\<lambda>_. count') s', r'))
[PROOF STEP]
proof (induction arbitrary:extra1 and extra2 and extra3 rule:evaluate_match_evaluate_list_evaluate.inducts)
[PROOF STATE]
proof (state)
goal (42 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes v1 bv extra3. (evaluate ck env s1 e (s2, Rerr (Rraise v1)) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r'))) \<and> evaluate_match ck env s2 v1 pes v1 bv \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> bv = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes v1 (update_clock (\<lambda>_. count') s', r')) \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> bv = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 7. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 8. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 9. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 10. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 42 subgoals...
[PROOF STEP]
case (handle2 ck s1 s2 env e pes v1 bv)
[PROOF STATE]
proof (state)
this:
(evaluate ck env s1 e (s2, Rerr (Rraise v1)) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r'))) \<and> evaluate_match ck env s2 v1 pes v1 bv \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> bv = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes v1 (update_clock (\<lambda>_. count') s', r'))

goal (42 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes v1 bv extra3. (evaluate ck env s1 e (s2, Rerr (Rraise v1)) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r'))) \<and> evaluate_match ck env s2 v1 pes v1 bv \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> bv = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes v1 (update_clock (\<lambda>_. count') s', r')) \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> bv = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 7. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 8. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 9. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 10. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 42 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(evaluate ck env s1 e (s2, Rerr (Rraise v1)) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r'))) \<and> evaluate_match ck env s2 v1 pes v1 bv \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> bv = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes v1 (update_clock (\<lambda>_. count') s', r'))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
(evaluate ck env s1 e (s2, Rerr (Rraise v1)) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r'))) \<and> evaluate_match ck env s2 v1 pes v1 bv \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> bv = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes v1 (update_clock (\<lambda>_. count') s', r'))

goal (1 subgoal):
 1. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> bv = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rerr (Rraise v1)); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rerr (Rraise v1)); evaluate_match True env s2 v1 pes v1 (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes v1 (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
[PROOF STEP]
apply (subgoal_tac "(clock   s2) \<ge> extra3")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rerr (Rraise v1)); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rerr (Rraise v1)); evaluate_match True env s2 v1 pes v1 (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes v1 (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rerr (Rraise v1)); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rerr (Rraise v1)); evaluate_match True env s2 v1 pes v1 (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes v1 (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rerr (Rraise v1)); evaluate_match True env s2 v1 pes v1 (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes v1 (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>counta count'a. count + extra3 = counta + ?x17 count count' s' r' \<and> clock s2 = count'a + ?x17 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count'a) s2, Rerr (Rraise v1))\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rerr (Rraise v1)); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rerr (Rraise v1)); evaluate_match True env s2 v1 pes v1 (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes v1 (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rerr (Rraise v1)); evaluate_match True env s2 v1 pes v1 (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>counta count'a. count + extra3 = counta + ?x17 count count' s' r' \<and> clock s2 = count'a + ?x17 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count'a) s2, Rerr (Rraise v1)); \<forall>counta count'a. clock s2 = counta + ?x19 count count' s' r' \<and> count' + extra3 = count'a + ?x19 count count' s' r' \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. counta) s2) v1 pes v1 (update_clock (\<lambda>_. count'a) s', r')\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rerr (Rraise v1)); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rerr (Rraise v1)); evaluate_match True env s2 v1 pes v1 (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes v1 (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rerr (Rraise v1)); evaluate_match True env s2 v1 pes v1 (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>counta count'a. clock s2 = counta + ?x19 count count' s' r' \<and> count' + extra3 = count'a + ?x19 count count' s' r' \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. counta) s2) v1 pes v1 (update_clock (\<lambda>_. count'a) s', r'); \<forall>count'a. count + extra3 = ?count21 count count' s' r' + ?x17 count count' s' r' \<and> clock s2 = count'a + ?x17 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. ?count21 count count' s' r') s1) e (update_clock (\<lambda>_. count'a) s2, Rerr (Rraise v1))\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rerr (Rraise v1)); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rerr (Rraise v1)); evaluate_match True env s2 v1 pes v1 (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes v1 (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply (drule_tac x="(clock   s2)-extra3" in spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rerr (Rraise v1)); evaluate_match True env s2 v1 pes v1 (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>count'a. count + extra3 = ?count21 count count' s' r' + ?x17 count count' s' r' \<and> clock s2 = count'a + ?x17 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. ?count21 count count' s' r') s1) e (update_clock (\<lambda>_. count'a) s2, Rerr (Rraise v1)); \<forall>count'a. clock s2 = clock s2 - extra3 + ?x19 count count' s' r' \<and> count' + extra3 = count'a + ?x19 count count' s' r' \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. clock s2 - extra3) s2) v1 pes v1 (update_clock (\<lambda>_. count'a) s', r')\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rerr (Rraise v1)); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rerr (Rraise v1)); evaluate_match True env s2 v1 pes v1 (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes v1 (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply rule
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rerr (Rraise v1)); evaluate_match True env s2 v1 pes v1 (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>count'a. count + extra3 = ?count21 count count' s' r' + ?x17 count count' s' r' \<and> clock s2 = count'a + ?x17 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. ?count21 count count' s' r') s1) e (update_clock (\<lambda>_. count'a) s2, Rerr (Rraise v1)); \<forall>count'a. clock s2 = clock s2 - extra3 + ?x19 count count' s' r' \<and> count' + extra3 = count'a + ?x19 count count' s' r' \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. clock s2 - extra3) s2) v1 pes v1 (update_clock (\<lambda>_. count'a) s', r')\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (?s2.25 count count' s' r', Rerr (Rraise (?v1.25 count count' s' r'))) \<and> evaluate_match True env (?s2.25 count count' s' r') (?v1.25 count count' s' r') pes (?v1.25 count count' s' r') (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rerr (Rraise v1)); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rerr (Rraise v1)); evaluate_match True env s2 v1 pes v1 (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes v1 (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply force
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rerr (Rraise v1)); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rerr (Rraise v1)); evaluate_match True env s2 v1 pes v1 (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes v1 (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
by (auto dest:clock_monotone(1))
[PROOF STATE]
proof (state)
this:
\<forall>count count' s' r'. clock s1 = count + extra3 \<and> bv = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')

goal (41 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 7. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 8. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 9. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
 10. \<And>ck env n s extra3. nsLookup (sem_env.v env) n = None \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 41 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (41 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 7. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 8. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 9. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
 10. \<And>ck env n s extra3. nsLookup (sem_env.v env) n = None \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 41 subgoals...
[PROOF STEP]
case (app1 ck env es vs env' e bv s1 s2)
[PROOF STATE]
proof (state)
this:
(evaluate_list ck env s1 (rev es) (s2, Rval vs) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rval vs) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s1) (rev es) (update_clock (\<lambda>_. count') s', r'))) \<and> do_opapp (rev vs) = Some (env', e) \<and> (ck \<longrightarrow> clock s2 \<noteq> 0) \<and> evaluate ck env' (if ck then update_clock (\<lambda>_. clock s2 - 1) s2 else s2) e bv \<and> (\<forall>x count count' s' r'. clock (if ck then update_clock (\<lambda>_. clock s2 - 1) s2 else s2) = count + x \<and> bv = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env' (update_clock (\<lambda>_. count) (if ck then update_clock (\<lambda>_. clock s2 - 1) s2 else s2)) e (update_clock (\<lambda>_. count') s', r'))

goal (41 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 7. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 8. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 9. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
 10. \<And>ck env n s extra3. nsLookup (sem_env.v env) n = None \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 41 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(evaluate_list ck env s1 (rev es) (s2, Rval vs) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rval vs) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s1) (rev es) (update_clock (\<lambda>_. count') s', r'))) \<and> do_opapp (rev vs) = Some (env', e) \<and> (ck \<longrightarrow> clock s2 \<noteq> 0) \<and> evaluate ck env' (if ck then update_clock (\<lambda>_. clock s2 - 1) s2 else s2) e bv \<and> (\<forall>x count count' s' r'. clock (if ck then update_clock (\<lambda>_. clock s2 - 1) s2 else s2) = count + x \<and> bv = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env' (update_clock (\<lambda>_. count) (if ck then update_clock (\<lambda>_. clock s2 - 1) s2 else s2)) e (update_clock (\<lambda>_. count') s', r'))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
(evaluate_list ck env s1 (rev es) (s2, Rval vs) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rval vs) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s1) (rev es) (update_clock (\<lambda>_. count') s', r'))) \<and> do_opapp (rev vs) = Some (env', e) \<and> (ck \<longrightarrow> clock s2 \<noteq> 0) \<and> evaluate ck env' (if ck then update_clock (\<lambda>_. clock s2 - 1) s2 else s2) e bv \<and> (\<forall>x count count' s' r'. clock (if ck then update_clock (\<lambda>_. clock s2 - 1) s2 else s2) = count + x \<and> bv = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env' (update_clock (\<lambda>_. count) (if ck then update_clock (\<lambda>_. clock s2 - 1) s2 else s2)) e (update_clock (\<lambda>_. count') s', r'))

goal (1 subgoal):
 1. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> bv = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (App Opapp es) (update_clock (\<lambda>_. count') s', r')
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>count count' s' r'. \<lbrakk>evaluate_list True env s1 (rev es) (s2, Rval vs); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. counta) s1) (rev es) (update_clock (\<lambda>_. count') s2, Rval vs); do_opapp (rev vs) = Some (env', e); evaluate True env' (update_clock (\<lambda>_. clock s2 - Suc 0) s2) e (s', r'); \<forall>x count count'a. clock s2 - Suc 0 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env' (update_clock (\<lambda>a. count) s2) e (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; 0 < clock s2\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (App Opapp es) (update_clock (\<lambda>_. count') s', r')
[PROOF STEP]
apply (subgoal_tac "(clock   s2)-1\<ge>extra3")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate_list True env s1 (rev es) (s2, Rval vs); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. counta) s1) (rev es) (update_clock (\<lambda>_. count') s2, Rval vs); do_opapp (rev vs) = Some (env', e); evaluate True env' (update_clock (\<lambda>_. clock s2 - Suc 0) s2) e (s', r'); \<forall>x count count'a. clock s2 - Suc 0 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env' (update_clock (\<lambda>a. count) s2) e (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; 0 < clock s2; extra3 \<le> clock s2 - 1\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (App Opapp es) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate_list True env s1 (rev es) (s2, Rval vs); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. counta) s1) (rev es) (update_clock (\<lambda>_. count') s2, Rval vs); do_opapp (rev vs) = Some (env', e); evaluate True env' (update_clock (\<lambda>_. clock s2 - Suc 0) s2) e (s', r'); \<forall>x count count'a. clock s2 - Suc 0 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env' (update_clock (\<lambda>a. count) s2) e (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; 0 < clock s2\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2 - 1
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate_list True env s1 (rev es) (s2, Rval vs); do_opapp (rev vs) = Some (env', e); evaluate True env' (update_clock (\<lambda>_. clock s2 - Suc 0) s2) e (s', r'); \<forall>x count count'a. clock s2 - Suc 0 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env' (update_clock (\<lambda>a. count) s2) e (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; 0 < clock s2; extra3 \<le> clock s2 - 1; \<forall>counta count'a. count + extra3 = counta + ?x24 count count' s' r' \<and> clock s2 = count'a + ?x24 count count' s' r' \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. counta) s1) (rev es) (update_clock (\<lambda>_. count'a) s2, Rval vs)\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (App Opapp es) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate_list True env s1 (rev es) (s2, Rval vs); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. counta) s1) (rev es) (update_clock (\<lambda>_. count') s2, Rval vs); do_opapp (rev vs) = Some (env', e); evaluate True env' (update_clock (\<lambda>_. clock s2 - Suc 0) s2) e (s', r'); \<forall>x count count'a. clock s2 - Suc 0 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env' (update_clock (\<lambda>a. count) s2) e (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; 0 < clock s2\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2 - 1
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate_list True env s1 (rev es) (s2, Rval vs); do_opapp (rev vs) = Some (env', e); evaluate True env' (update_clock (\<lambda>_. clock s2 - Suc 0) s2) e (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; 0 < clock s2; extra3 \<le> clock s2 - 1; \<forall>counta count'a. count + extra3 = counta + ?x24 count count' s' r' \<and> clock s2 = count'a + ?x24 count count' s' r' \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. counta) s1) (rev es) (update_clock (\<lambda>_. count'a) s2, Rval vs); \<forall>counta count'a. clock s2 - Suc 0 = counta + ?x26 count count' s' r' \<and> count' + extra3 = count'a + ?x26 count count' s' r' \<longrightarrow> evaluate True env' (update_clock (\<lambda>a. counta) s2) e (update_clock (\<lambda>_. count'a) s', r')\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (App Opapp es) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate_list True env s1 (rev es) (s2, Rval vs); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. counta) s1) (rev es) (update_clock (\<lambda>_. count') s2, Rval vs); do_opapp (rev vs) = Some (env', e); evaluate True env' (update_clock (\<lambda>_. clock s2 - Suc 0) s2) e (s', r'); \<forall>x count count'a. clock s2 - Suc 0 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env' (update_clock (\<lambda>a. count) s2) e (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; 0 < clock s2\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2 - 1
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate_list True env s1 (rev es) (s2, Rval vs); do_opapp (rev vs) = Some (env', e); evaluate True env' (update_clock (\<lambda>_. clock s2 - Suc 0) s2) e (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; 0 < clock s2; extra3 \<le> clock s2 - 1; \<forall>counta count'a. clock s2 - Suc 0 = counta + ?x26 count count' s' r' \<and> count' + extra3 = count'a + ?x26 count count' s' r' \<longrightarrow> evaluate True env' (update_clock (\<lambda>a. counta) s2) e (update_clock (\<lambda>_. count'a) s', r'); \<forall>count'a. count + extra3 = ?count28 count count' s' r' + ?x24 count count' s' r' \<and> clock s2 = count'a + ?x24 count count' s' r' \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. ?count28 count count' s' r') s1) (rev es) (update_clock (\<lambda>_. count'a) s2, Rval vs)\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (App Opapp es) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate_list True env s1 (rev es) (s2, Rval vs); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. counta) s1) (rev es) (update_clock (\<lambda>_. count') s2, Rval vs); do_opapp (rev vs) = Some (env', e); evaluate True env' (update_clock (\<lambda>_. clock s2 - Suc 0) s2) e (s', r'); \<forall>x count count'a. clock s2 - Suc 0 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env' (update_clock (\<lambda>a. count) s2) e (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; 0 < clock s2\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2 - 1
[PROOF STEP]
apply (drule_tac x="(clock   s2)-extra3-1" in spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate_list True env s1 (rev es) (s2, Rval vs); do_opapp (rev vs) = Some (env', e); evaluate True env' (update_clock (\<lambda>_. clock s2 - Suc 0) s2) e (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; 0 < clock s2; extra3 \<le> clock s2 - 1; \<forall>count'a. count + extra3 = ?count28 count count' s' r' + ?x24 count count' s' r' \<and> clock s2 = count'a + ?x24 count count' s' r' \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. ?count28 count count' s' r') s1) (rev es) (update_clock (\<lambda>_. count'a) s2, Rval vs); \<forall>count'a. clock s2 - Suc 0 = clock s2 - extra3 - 1 + ?x26 count count' s' r' \<and> count' + extra3 = count'a + ?x26 count count' s' r' \<longrightarrow> evaluate True env' (update_clock (\<lambda>a. clock s2 - extra3 - 1) s2) e (update_clock (\<lambda>_. count'a) s', r')\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (App Opapp es) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate_list True env s1 (rev es) (s2, Rval vs); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. counta) s1) (rev es) (update_clock (\<lambda>_. count') s2, Rval vs); do_opapp (rev vs) = Some (env', e); evaluate True env' (update_clock (\<lambda>_. clock s2 - Suc 0) s2) e (s', r'); \<forall>x count count'a. clock s2 - Suc 0 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env' (update_clock (\<lambda>a. count) s2) e (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; 0 < clock s2\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2 - 1
[PROOF STEP]
apply rule
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate_list True env s1 (rev es) (s2, Rval vs); do_opapp (rev vs) = Some (env', e); evaluate True env' (update_clock (\<lambda>_. clock s2 - Suc 0) s2) e (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; 0 < clock s2; extra3 \<le> clock s2 - 1; \<forall>count'a. count + extra3 = ?count28 count count' s' r' + ?x24 count count' s' r' \<and> clock s2 = count'a + ?x24 count count' s' r' \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. ?count28 count count' s' r') s1) (rev es) (update_clock (\<lambda>_. count'a) s2, Rval vs); \<forall>count'a. clock s2 - Suc 0 = clock s2 - extra3 - 1 + ?x26 count count' s' r' \<and> count' + extra3 = count'a + ?x26 count count' s' r' \<longrightarrow> evaluate True env' (update_clock (\<lambda>a. clock s2 - extra3 - 1) s2) e (update_clock (\<lambda>_. count'a) s', r')\<rbrakk> \<Longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s1) (rev es) (?s2.32 count count' s' r', Rval (?vs32 count count' s' r')) \<and> do_opapp (rev (?vs32 count count' s' r')) = Some (?env'32 count count' s' r', ?e32 count count' s' r') \<and> (True \<longrightarrow> clock (?s2.32 count count' s' r') \<noteq> 0) \<and> evaluate True (?env'32 count count' s' r') (if True then update_clock (\<lambda>_. clock (?s2.32 count count' s' r') - 1) (?s2.32 count count' s' r') else ?s2.32 count count' s' r') (?e32 count count' s' r') (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate_list True env s1 (rev es) (s2, Rval vs); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. counta) s1) (rev es) (update_clock (\<lambda>_. count') s2, Rval vs); do_opapp (rev vs) = Some (env', e); evaluate True env' (update_clock (\<lambda>_. clock s2 - Suc 0) s2) e (s', r'); \<forall>x count count'a. clock s2 - Suc 0 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env' (update_clock (\<lambda>a. count) s2) e (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; 0 < clock s2\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2 - 1
[PROOF STEP]
apply force
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>count count' s' r'. \<lbrakk>evaluate_list True env s1 (rev es) (s2, Rval vs); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. counta) s1) (rev es) (update_clock (\<lambda>_. count') s2, Rval vs); do_opapp (rev vs) = Some (env', e); evaluate True env' (update_clock (\<lambda>_. clock s2 - Suc 0) s2) e (s', r'); \<forall>x count count'a. clock s2 - Suc 0 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env' (update_clock (\<lambda>a. count) s2) e (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; 0 < clock s2\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2 - 1
[PROOF STEP]
by (auto dest:clock_monotone(3))
[PROOF STATE]
proof (state)
this:
\<forall>count count' s' r'. clock s1 = count + extra3 \<and> bv = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (App Opapp es) (update_clock (\<lambda>_. count') s', r')

goal (40 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 7. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 8. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 9. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
 10. \<And>ck env n s extra3. nsLookup (sem_env.v env) n = None \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 40 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (40 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 7. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 8. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 9. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
 10. \<And>ck env n s extra3. nsLookup (sem_env.v env) n = None \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 40 subgoals...
[PROOF STEP]
case (log1 ck env op0 e1 e2 v1 e' bv s1 s2)
[PROOF STATE]
proof (state)
this:
(evaluate ck env s1 e1 (s2, Rval v1) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e1 (update_clock (\<lambda>_. count') s', r'))) \<and> do_log op0 v1 e2 = Some (Exp e') \<and> evaluate ck env s2 e' bv \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> bv = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count') s', r'))

goal (40 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 7. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 8. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 9. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
 10. \<And>ck env n s extra3. nsLookup (sem_env.v env) n = None \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 40 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(evaluate ck env s1 e1 (s2, Rval v1) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e1 (update_clock (\<lambda>_. count') s', r'))) \<and> do_log op0 v1 e2 = Some (Exp e') \<and> evaluate ck env s2 e' bv \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> bv = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count') s', r'))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
(evaluate ck env s1 e1 (s2, Rval v1) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e1 (update_clock (\<lambda>_. count') s', r'))) \<and> do_log op0 v1 e2 = Some (Exp e') \<and> evaluate ck env s2 e' bv \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> bv = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count') s', r'))

goal (1 subgoal):
 1. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> bv = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Log op0 e1 e2) (update_clock (\<lambda>_. count') s', r')
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); do_log op0 v1 e2 = Some (Exp e'); evaluate True env s2 e' (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Log op0 e1 e2) (update_clock (\<lambda>_. count') s', r')
[PROOF STEP]
apply (subgoal_tac "(clock   s2)\<ge>extra3")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); do_log op0 v1 e2 = Some (Exp e'); evaluate True env s2 e' (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Log op0 e1 e2) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); do_log op0 v1 e2 = Some (Exp e'); evaluate True env s2 e' (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); do_log op0 v1 e2 = Some (Exp e'); evaluate True env s2 e' (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>counta count'a. count + extra3 = counta + ?x18 count count' s' r' \<and> clock s2 = count'a + ?x18 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count'a) s2, Rval v1)\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Log op0 e1 e2) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); do_log op0 v1 e2 = Some (Exp e'); evaluate True env s2 e' (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); do_log op0 v1 e2 = Some (Exp e'); evaluate True env s2 e' (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>counta count'a. count + extra3 = counta + ?x18 count count' s' r' \<and> clock s2 = count'a + ?x18 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count'a) s2, Rval v1); \<forall>counta count'a. clock s2 = counta + ?x20 count count' s' r' \<and> count' + extra3 = count'a + ?x20 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s2) e' (update_clock (\<lambda>_. count'a) s', r')\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Log op0 e1 e2) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); do_log op0 v1 e2 = Some (Exp e'); evaluate True env s2 e' (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); do_log op0 v1 e2 = Some (Exp e'); evaluate True env s2 e' (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>counta count'a. clock s2 = counta + ?x20 count count' s' r' \<and> count' + extra3 = count'a + ?x20 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s2) e' (update_clock (\<lambda>_. count'a) s', r'); \<forall>count'a. count + extra3 = ?count22 count count' s' r' + ?x18 count count' s' r' \<and> clock s2 = count'a + ?x18 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. ?count22 count count' s' r') s1) e1 (update_clock (\<lambda>_. count'a) s2, Rval v1)\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Log op0 e1 e2) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); do_log op0 v1 e2 = Some (Exp e'); evaluate True env s2 e' (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply (drule_tac x="(clock   s2)-extra3" in spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); do_log op0 v1 e2 = Some (Exp e'); evaluate True env s2 e' (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>count'a. count + extra3 = ?count22 count count' s' r' + ?x18 count count' s' r' \<and> clock s2 = count'a + ?x18 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. ?count22 count count' s' r') s1) e1 (update_clock (\<lambda>_. count'a) s2, Rval v1); \<forall>count'a. clock s2 = clock s2 - extra3 + ?x20 count count' s' r' \<and> count' + extra3 = count'a + ?x20 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. clock s2 - extra3) s2) e' (update_clock (\<lambda>_. count'a) s', r')\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Log op0 e1 e2) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); do_log op0 v1 e2 = Some (Exp e'); evaluate True env s2 e' (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply rule
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); do_log op0 v1 e2 = Some (Exp e'); evaluate True env s2 e' (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>count'a. count + extra3 = ?count22 count count' s' r' + ?x18 count count' s' r' \<and> clock s2 = count'a + ?x18 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. ?count22 count count' s' r') s1) e1 (update_clock (\<lambda>_. count'a) s2, Rval v1); \<forall>count'a. clock s2 = clock s2 - extra3 + ?x20 count count' s' r' \<and> count' + extra3 = count'a + ?x20 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. clock s2 - extra3) s2) e' (update_clock (\<lambda>_. count'a) s', r')\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e1 (?s2.26 count count' s' r', Rval (?v1.26 count count' s' r')) \<and> do_log op0 (?v1.26 count count' s' r') e2 = Some (Exp (?e'26 count count' s' r')) \<and> evaluate True env (?s2.26 count count' s' r') (?e'26 count count' s' r') (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); do_log op0 v1 e2 = Some (Exp e'); evaluate True env s2 e' (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply force
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); do_log op0 v1 e2 = Some (Exp e'); evaluate True env s2 e' (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
by (auto dest:clock_monotone(3))
[PROOF STATE]
proof (state)
this:
\<forall>count count' s' r'. clock s1 = count + extra3 \<and> bv = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Log op0 e1 e2) (update_clock (\<lambda>_. count') s', r')

goal (39 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 7. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 8. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 9. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
 10. \<And>ck env n s extra3. nsLookup (sem_env.v env) n = None \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 39 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (39 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 7. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 8. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 9. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
 10. \<And>ck env n s extra3. nsLookup (sem_env.v env) n = None \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 39 subgoals...
[PROOF STEP]
case (if1 ck env e1 e2 e3 v1 e' bv s1 s2)
[PROOF STATE]
proof (state)
this:
(evaluate ck env s1 e1 (s2, Rval v1) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e1 (update_clock (\<lambda>_. count') s', r'))) \<and> do_if v1 e2 e3 = Some e' \<and> evaluate ck env s2 e' bv \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> bv = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count') s', r'))

goal (39 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 7. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 8. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 9. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
 10. \<And>ck env n s extra3. nsLookup (sem_env.v env) n = None \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 39 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(evaluate ck env s1 e1 (s2, Rval v1) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e1 (update_clock (\<lambda>_. count') s', r'))) \<and> do_if v1 e2 e3 = Some e' \<and> evaluate ck env s2 e' bv \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> bv = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count') s', r'))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
(evaluate ck env s1 e1 (s2, Rval v1) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e1 (update_clock (\<lambda>_. count') s', r'))) \<and> do_if v1 e2 e3 = Some e' \<and> evaluate ck env s2 e' bv \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> bv = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count') s', r'))

goal (1 subgoal):
 1. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> bv = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (exp0.If e1 e2 e3) (update_clock (\<lambda>_. count') s', r')
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); do_if v1 e2 e3 = Some e'; evaluate True env s2 e' (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (exp0.If e1 e2 e3) (update_clock (\<lambda>_. count') s', r')
[PROOF STEP]
apply (subgoal_tac "(clock   s2)\<ge>extra3")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); do_if v1 e2 e3 = Some e'; evaluate True env s2 e' (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (exp0.If e1 e2 e3) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); do_if v1 e2 e3 = Some e'; evaluate True env s2 e' (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); do_if v1 e2 e3 = Some e'; evaluate True env s2 e' (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>counta count'a. count + extra3 = counta + ?x18 count count' s' r' \<and> clock s2 = count'a + ?x18 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count'a) s2, Rval v1)\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (exp0.If e1 e2 e3) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); do_if v1 e2 e3 = Some e'; evaluate True env s2 e' (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); do_if v1 e2 e3 = Some e'; evaluate True env s2 e' (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>counta count'a. count + extra3 = counta + ?x18 count count' s' r' \<and> clock s2 = count'a + ?x18 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count'a) s2, Rval v1); \<forall>counta count'a. clock s2 = counta + ?x20 count count' s' r' \<and> count' + extra3 = count'a + ?x20 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s2) e' (update_clock (\<lambda>_. count'a) s', r')\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (exp0.If e1 e2 e3) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); do_if v1 e2 e3 = Some e'; evaluate True env s2 e' (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); do_if v1 e2 e3 = Some e'; evaluate True env s2 e' (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>counta count'a. clock s2 = counta + ?x20 count count' s' r' \<and> count' + extra3 = count'a + ?x20 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s2) e' (update_clock (\<lambda>_. count'a) s', r'); \<forall>count'a. count + extra3 = ?count22 count count' s' r' + ?x18 count count' s' r' \<and> clock s2 = count'a + ?x18 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. ?count22 count count' s' r') s1) e1 (update_clock (\<lambda>_. count'a) s2, Rval v1)\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (exp0.If e1 e2 e3) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); do_if v1 e2 e3 = Some e'; evaluate True env s2 e' (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply (drule_tac x="(clock   s2)-extra3" in spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); do_if v1 e2 e3 = Some e'; evaluate True env s2 e' (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>count'a. count + extra3 = ?count22 count count' s' r' + ?x18 count count' s' r' \<and> clock s2 = count'a + ?x18 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. ?count22 count count' s' r') s1) e1 (update_clock (\<lambda>_. count'a) s2, Rval v1); \<forall>count'a. clock s2 = clock s2 - extra3 + ?x20 count count' s' r' \<and> count' + extra3 = count'a + ?x20 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. clock s2 - extra3) s2) e' (update_clock (\<lambda>_. count'a) s', r')\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (exp0.If e1 e2 e3) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); do_if v1 e2 e3 = Some e'; evaluate True env s2 e' (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply rule
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); do_if v1 e2 e3 = Some e'; evaluate True env s2 e' (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>count'a. count + extra3 = ?count22 count count' s' r' + ?x18 count count' s' r' \<and> clock s2 = count'a + ?x18 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. ?count22 count count' s' r') s1) e1 (update_clock (\<lambda>_. count'a) s2, Rval v1); \<forall>count'a. clock s2 = clock s2 - extra3 + ?x20 count count' s' r' \<and> count' + extra3 = count'a + ?x20 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. clock s2 - extra3) s2) e' (update_clock (\<lambda>_. count'a) s', r')\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e1 (?s2.26 count count' s' r', Rval (?v1.26 count count' s' r')) \<and> do_if (?v1.26 count count' s' r') e2 e3 = Some (?e'26 count count' s' r') \<and> evaluate True env (?s2.26 count count' s' r') (?e'26 count count' s' r') (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); do_if v1 e2 e3 = Some e'; evaluate True env s2 e' (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply force
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); do_if v1 e2 e3 = Some e'; evaluate True env s2 e' (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s2) e' (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
by (auto intro: evaluate_match_evaluate_list_evaluate.intros dest:clock_monotone(3))
[PROOF STATE]
proof (state)
this:
\<forall>count count' s' r'. clock s1 = count + extra3 \<and> bv = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (exp0.If e1 e2 e3) (update_clock (\<lambda>_. count') s', r')

goal (38 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 7. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 8. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 9. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
 10. \<And>ck env n s extra3. nsLookup (sem_env.v env) n = None \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 38 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (38 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 7. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 8. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 9. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
 10. \<And>ck env n s extra3. nsLookup (sem_env.v env) n = None \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 38 subgoals...
[PROOF STEP]
case (mat1 ck env e pes v1 bv s1 s2)
[PROOF STATE]
proof (state)
this:
(evaluate ck env s1 e (s2, Rval v1) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r'))) \<and> evaluate_match ck env s2 v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) bv \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> bv = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (update_clock (\<lambda>_. count') s', r'))

goal (38 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 7. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 8. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 9. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
 10. \<And>ck env n s extra3. nsLookup (sem_env.v env) n = None \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 38 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(evaluate ck env s1 e (s2, Rval v1) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r'))) \<and> evaluate_match ck env s2 v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) bv \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> bv = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (update_clock (\<lambda>_. count') s', r'))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
(evaluate ck env s1 e (s2, Rval v1) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r'))) \<and> evaluate_match ck env s2 v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) bv \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> bv = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (update_clock (\<lambda>_. count') s', r'))

goal (1 subgoal):
 1. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> bv = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Mat e pes) (update_clock (\<lambda>_. count') s', r')
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_match True env s2 v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Mat e pes) (update_clock (\<lambda>_. count') s', r')
[PROOF STEP]
apply (subgoal_tac "(clock   s2)\<ge>extra3")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_match True env s2 v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Mat e pes) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_match True env s2 v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); evaluate_match True env s2 v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>counta count'a. count + extra3 = counta + ?x17 count count' s' r' \<and> clock s2 = count'a + ?x17 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count'a) s2, Rval v1)\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Mat e pes) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_match True env s2 v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); evaluate_match True env s2 v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>counta count'a. count + extra3 = counta + ?x17 count count' s' r' \<and> clock s2 = count'a + ?x17 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count'a) s2, Rval v1); \<forall>counta count'a. clock s2 = counta + ?x19 count count' s' r' \<and> count' + extra3 = count'a + ?x19 count count' s' r' \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. counta) s2) v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (update_clock (\<lambda>_. count'a) s', r')\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Mat e pes) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_match True env s2 v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); evaluate_match True env s2 v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>counta count'a. clock s2 = counta + ?x19 count count' s' r' \<and> count' + extra3 = count'a + ?x19 count count' s' r' \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. counta) s2) v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (update_clock (\<lambda>_. count'a) s', r'); \<forall>count'a. count + extra3 = ?count21 count count' s' r' + ?x17 count count' s' r' \<and> clock s2 = count'a + ?x17 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. ?count21 count count' s' r') s1) e (update_clock (\<lambda>_. count'a) s2, Rval v1)\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Mat e pes) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_match True env s2 v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply (drule_tac x="(clock   s2)-extra3" in spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); evaluate_match True env s2 v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>count'a. count + extra3 = ?count21 count count' s' r' + ?x17 count count' s' r' \<and> clock s2 = count'a + ?x17 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. ?count21 count count' s' r') s1) e (update_clock (\<lambda>_. count'a) s2, Rval v1); \<forall>count'a. clock s2 = clock s2 - extra3 + ?x19 count count' s' r' \<and> count' + extra3 = count'a + ?x19 count count' s' r' \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. clock s2 - extra3) s2) v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (update_clock (\<lambda>_. count'a) s', r')\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Mat e pes) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_match True env s2 v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply rule
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); evaluate_match True env s2 v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>count'a. count + extra3 = ?count21 count count' s' r' + ?x17 count count' s' r' \<and> clock s2 = count'a + ?x17 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. ?count21 count count' s' r') s1) e (update_clock (\<lambda>_. count'a) s2, Rval v1); \<forall>count'a. clock s2 = clock s2 - extra3 + ?x19 count count' s' r' \<and> count' + extra3 = count'a + ?x19 count count' s' r' \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. clock s2 - extra3) s2) v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (update_clock (\<lambda>_. count'a) s', r')\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (?s2.25 count count' s' r', Rval (?v1.25 count count' s' r')) \<and> evaluate_match True env (?s2.25 count count' s' r') (?v1.25 count count' s' r') pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_match True env s2 v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply force
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_match True env s2 v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate_match True env (update_clock (\<lambda>_. count) s2) v1 pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
by (auto dest:clock_monotone(1))
[PROOF STATE]
proof (state)
this:
\<forall>count count' s' r'. clock s1 = count + extra3 \<and> bv = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Mat e pes) (update_clock (\<lambda>_. count') s', r')

goal (37 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 7. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 8. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 9. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
 10. \<And>ck env n s extra3. nsLookup (sem_env.v env) n = None \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 37 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (37 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 7. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 8. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 9. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
 10. \<And>ck env n s extra3. nsLookup (sem_env.v env) n = None \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 37 subgoals...
[PROOF STEP]
case (let1 ck env n e1 e2 v1 bv s1 s2)
[PROOF STATE]
proof (state)
this:
(evaluate ck env s1 e1 (s2, Rval v1) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e1 (update_clock (\<lambda>_. count') s', r'))) \<and> evaluate ck (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) s2 e2 bv \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> bv = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) (update_clock (\<lambda>_. count) s2) e2 (update_clock (\<lambda>_. count') s', r'))

goal (37 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 7. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 8. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 9. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
 10. \<And>ck env n s extra3. nsLookup (sem_env.v env) n = None \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 37 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(evaluate ck env s1 e1 (s2, Rval v1) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e1 (update_clock (\<lambda>_. count') s', r'))) \<and> evaluate ck (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) s2 e2 bv \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> bv = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) (update_clock (\<lambda>_. count) s2) e2 (update_clock (\<lambda>_. count') s', r'))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
(evaluate ck env s1 e1 (s2, Rval v1) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e1 (update_clock (\<lambda>_. count') s', r'))) \<and> evaluate ck (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) s2 e2 bv \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> bv = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) (update_clock (\<lambda>_. count) s2) e2 (update_clock (\<lambda>_. count') s', r'))

goal (1 subgoal):
 1. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> bv = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (exp0.Let n e1 e2) (update_clock (\<lambda>_. count') s', r')
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) s2 e2 (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) (update_clock (\<lambda>_. count) s2) e2 (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (exp0.Let n e1 e2) (update_clock (\<lambda>_. count') s', r')
[PROOF STEP]
apply (subgoal_tac "(clock   s2)\<ge>extra3")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) s2 e2 (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) (update_clock (\<lambda>_. count) s2) e2 (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (exp0.Let n e1 e2) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) s2 e2 (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) (update_clock (\<lambda>_. count) s2) e2 (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) s2 e2 (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) (update_clock (\<lambda>_. count) s2) e2 (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>counta count'a. count + extra3 = counta + ?x17 count count' s' r' \<and> clock s2 = count'a + ?x17 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count'a) s2, Rval v1)\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (exp0.Let n e1 e2) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) s2 e2 (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) (update_clock (\<lambda>_. count) s2) e2 (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) s2 e2 (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>counta count'a. count + extra3 = counta + ?x17 count count' s' r' \<and> clock s2 = count'a + ?x17 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count'a) s2, Rval v1); \<forall>counta count'a. clock s2 = counta + ?x19 count count' s' r' \<and> count' + extra3 = count'a + ?x19 count count' s' r' \<longrightarrow> evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) (update_clock (\<lambda>_. counta) s2) e2 (update_clock (\<lambda>_. count'a) s', r')\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (exp0.Let n e1 e2) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) s2 e2 (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) (update_clock (\<lambda>_. count) s2) e2 (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) s2 e2 (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>counta count'a. clock s2 = counta + ?x19 count count' s' r' \<and> count' + extra3 = count'a + ?x19 count count' s' r' \<longrightarrow> evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) (update_clock (\<lambda>_. counta) s2) e2 (update_clock (\<lambda>_. count'a) s', r'); \<forall>count'a. count + extra3 = ?count21 count count' s' r' + ?x17 count count' s' r' \<and> clock s2 = count'a + ?x17 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. ?count21 count count' s' r') s1) e1 (update_clock (\<lambda>_. count'a) s2, Rval v1)\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (exp0.Let n e1 e2) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) s2 e2 (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) (update_clock (\<lambda>_. count) s2) e2 (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply (drule_tac x="(clock   s2)-extra3" in spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) s2 e2 (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>count'a. count + extra3 = ?count21 count count' s' r' + ?x17 count count' s' r' \<and> clock s2 = count'a + ?x17 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. ?count21 count count' s' r') s1) e1 (update_clock (\<lambda>_. count'a) s2, Rval v1); \<forall>count'a. clock s2 = clock s2 - extra3 + ?x19 count count' s' r' \<and> count' + extra3 = count'a + ?x19 count count' s' r' \<longrightarrow> evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) (update_clock (\<lambda>_. clock s2 - extra3) s2) e2 (update_clock (\<lambda>_. count'a) s', r')\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (exp0.Let n e1 e2) (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) s2 e2 (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) (update_clock (\<lambda>_. count) s2) e2 (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply rule
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) s2 e2 (s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck; extra3 \<le> clock s2; \<forall>count'a. count + extra3 = ?count21 count count' s' r' + ?x17 count count' s' r' \<and> clock s2 = count'a + ?x17 count count' s' r' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. ?count21 count count' s' r') s1) e1 (update_clock (\<lambda>_. count'a) s2, Rval v1); \<forall>count'a. clock s2 = clock s2 - extra3 + ?x19 count count' s' r' \<and> count' + extra3 = count'a + ?x19 count count' s' r' \<longrightarrow> evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) (update_clock (\<lambda>_. clock s2 - extra3) s2) e2 (update_clock (\<lambda>_. count'a) s', r')\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e1 (?s2.25 count count' s' r', Rval (?v1.25 count count' s' r')) \<and> evaluate True (update_v (\<lambda>_. nsOptBind n (?v1.25 count count' s' r') (sem_env.v env)) env) (?s2.25 count count' s' r') e2 (update_clock (\<lambda>_. count') s', r')
 2. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) s2 e2 (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) (update_clock (\<lambda>_. count) s2) e2 (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
apply force
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>count count' s' r'. \<lbrakk>evaluate True env s1 e1 (s2, Rval v1); \<forall>x counta count'. count + extra3 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e1 (update_clock (\<lambda>_. count') s2, Rval v1); evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) s2 e2 (s', r'); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra3 = count'a + x \<longrightarrow> evaluate True (update_v (\<lambda>_. nsOptBind n v1 (sem_env.v env)) env) (update_clock (\<lambda>_. count) s2) e2 (update_clock (\<lambda>_. count'a) s', r'); clock s1 = count + extra3; bv = (s', r'); clock s' = count' + extra3; ck\<rbrakk> \<Longrightarrow> extra3 \<le> clock s2
[PROOF STEP]
by (auto dest:clock_monotone(3))
[PROOF STATE]
proof (state)
this:
\<forall>count count' s' r'. clock s1 = count + extra3 \<and> bv = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (exp0.Let n e1 e2) (update_clock (\<lambda>_. count') s', r')

goal (36 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 7. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 8. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 9. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
 10. \<And>ck env n s extra3. nsLookup (sem_env.v env) n = None \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 36 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (36 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 7. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 8. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 9. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
 10. \<And>ck env n s extra3. nsLookup (sem_env.v env) n = None \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 36 subgoals...
[PROOF STEP]
case (cons1 ck env e es v1 vs s1 s2 s3)
[PROOF STATE]
proof (state)
this:
(evaluate ck env s1 e (s2, Rval v1) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r'))) \<and> evaluate_list ck env s2 es (s3, Rval vs) \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> (s3, Rval vs) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count') s', r'))

goal (36 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 7. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 8. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 9. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
 10. \<And>ck env n s extra3. nsLookup (sem_env.v env) n = None \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 36 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(evaluate ck env s1 e (s2, Rval v1) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r'))) \<and> evaluate_list ck env s2 es (s3, Rval vs) \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> (s3, Rval vs) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count') s', r'))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
(evaluate ck env s1 e (s2, Rval v1) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r'))) \<and> evaluate_list ck env s2 es (s3, Rval vs) \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> (s3, Rval vs) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count') s', r'))

goal (1 subgoal):
 1. \<forall>count count' s' r'. clock s1 = count + extra2 \<and> (s3, Rval (v1 # vs)) = (s', r') \<and> clock s' = count' + extra2 \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s1) (e # es) (update_clock (\<lambda>_. count') s', r')
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra2 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_list True env s2 es (s3, Rval vs); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra2 = count'a + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count'a) s3, Rval vs); clock s1 = count + extra2; clock s3 = count' + extra2; ck\<rbrakk> \<Longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s1) (e # es) (update_clock (\<lambda>_. count') s3, Rval (v1 # vs))
[PROOF STEP]
apply (subgoal_tac "(clock   s2)\<ge>extra2")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra2 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_list True env s2 es (s3, Rval vs); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra2 = count'a + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count'a) s3, Rval vs); clock s1 = count + extra2; clock s3 = count' + extra2; ck; extra2 \<le> clock s2\<rbrakk> \<Longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s1) (e # es) (update_clock (\<lambda>_. count') s3, Rval (v1 # vs))
 2. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra2 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_list True env s2 es (s3, Rval vs); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra2 = count'a + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count'a) s3, Rval vs); clock s1 = count + extra2; clock s3 = count' + extra2; ck\<rbrakk> \<Longrightarrow> extra2 \<le> clock s2
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); evaluate_list True env s2 es (s3, Rval vs); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra2 = count'a + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count'a) s3, Rval vs); clock s1 = count + extra2; clock s3 = count' + extra2; ck; extra2 \<le> clock s2; \<forall>counta count'a. count + extra2 = counta + ?x12 count count' \<and> clock s2 = count'a + ?x12 count count' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count'a) s2, Rval v1)\<rbrakk> \<Longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s1) (e # es) (update_clock (\<lambda>_. count') s3, Rval (v1 # vs))
 2. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra2 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_list True env s2 es (s3, Rval vs); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra2 = count'a + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count'a) s3, Rval vs); clock s1 = count + extra2; clock s3 = count' + extra2; ck\<rbrakk> \<Longrightarrow> extra2 \<le> clock s2
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); evaluate_list True env s2 es (s3, Rval vs); clock s1 = count + extra2; clock s3 = count' + extra2; ck; extra2 \<le> clock s2; \<forall>counta count'a. count + extra2 = counta + ?x12 count count' \<and> clock s2 = count'a + ?x12 count count' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count'a) s2, Rval v1); \<forall>counta count'a. clock s2 = counta + ?x14 count count' \<and> count' + extra2 = count'a + ?x14 count count' \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. counta) s2) es (update_clock (\<lambda>_. count'a) s3, Rval vs)\<rbrakk> \<Longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s1) (e # es) (update_clock (\<lambda>_. count') s3, Rval (v1 # vs))
 2. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra2 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_list True env s2 es (s3, Rval vs); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra2 = count'a + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count'a) s3, Rval vs); clock s1 = count + extra2; clock s3 = count' + extra2; ck\<rbrakk> \<Longrightarrow> extra2 \<le> clock s2
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); evaluate_list True env s2 es (s3, Rval vs); clock s1 = count + extra2; clock s3 = count' + extra2; ck; extra2 \<le> clock s2; \<forall>counta count'a. clock s2 = counta + ?x14 count count' \<and> count' + extra2 = count'a + ?x14 count count' \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. counta) s2) es (update_clock (\<lambda>_. count'a) s3, Rval vs); \<forall>count'a. count + extra2 = ?count16 count count' + ?x12 count count' \<and> clock s2 = count'a + ?x12 count count' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. ?count16 count count') s1) e (update_clock (\<lambda>_. count'a) s2, Rval v1)\<rbrakk> \<Longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s1) (e # es) (update_clock (\<lambda>_. count') s3, Rval (v1 # vs))
 2. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra2 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_list True env s2 es (s3, Rval vs); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra2 = count'a + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count'a) s3, Rval vs); clock s1 = count + extra2; clock s3 = count' + extra2; ck\<rbrakk> \<Longrightarrow> extra2 \<le> clock s2
[PROOF STEP]
apply (drule_tac x="(clock   s2)-extra2" in spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); evaluate_list True env s2 es (s3, Rval vs); clock s1 = count + extra2; clock s3 = count' + extra2; ck; extra2 \<le> clock s2; \<forall>count'a. count + extra2 = ?count16 count count' + ?x12 count count' \<and> clock s2 = count'a + ?x12 count count' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. ?count16 count count') s1) e (update_clock (\<lambda>_. count'a) s2, Rval v1); \<forall>count'a. clock s2 = clock s2 - extra2 + ?x14 count count' \<and> count' + extra2 = count'a + ?x14 count count' \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. clock s2 - extra2) s2) es (update_clock (\<lambda>_. count'a) s3, Rval vs)\<rbrakk> \<Longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s1) (e # es) (update_clock (\<lambda>_. count') s3, Rval (v1 # vs))
 2. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra2 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_list True env s2 es (s3, Rval vs); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra2 = count'a + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count'a) s3, Rval vs); clock s1 = count + extra2; clock s3 = count' + extra2; ck\<rbrakk> \<Longrightarrow> extra2 \<le> clock s2
[PROOF STEP]
apply rule
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); evaluate_list True env s2 es (s3, Rval vs); clock s1 = count + extra2; clock s3 = count' + extra2; ck; extra2 \<le> clock s2; \<forall>count'a. count + extra2 = ?count16 count count' + ?x12 count count' \<and> clock s2 = count'a + ?x12 count count' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. ?count16 count count') s1) e (update_clock (\<lambda>_. count'a) s2, Rval v1); \<forall>count'a. clock s2 = clock s2 - extra2 + ?x14 count count' \<and> count' + extra2 = count'a + ?x14 count count' \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. clock s2 - extra2) s2) es (update_clock (\<lambda>_. count'a) s3, Rval vs)\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (?s2.20 count count', Rval v1) \<and> evaluate_list True env (?s2.20 count count') es (update_clock (\<lambda>_. count') s3, Rval vs)
 2. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra2 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_list True env s2 es (s3, Rval vs); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra2 = count'a + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count'a) s3, Rval vs); clock s1 = count + extra2; clock s3 = count' + extra2; ck\<rbrakk> \<Longrightarrow> extra2 \<le> clock s2
[PROOF STEP]
apply force
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra2 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_list True env s2 es (s3, Rval vs); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra2 = count'a + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count'a) s3, Rval vs); clock s1 = count + extra2; clock s3 = count' + extra2; ck\<rbrakk> \<Longrightarrow> extra2 \<le> clock s2
[PROOF STEP]
by (auto dest:clock_monotone(2))
[PROOF STATE]
proof (state)
this:
\<forall>count count' s' r'. clock s1 = count + extra2 \<and> (s3, Rval (v1 # vs)) = (s', r') \<and> clock s' = count' + extra2 \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s1) (e # es) (update_clock (\<lambda>_. count') s', r')

goal (35 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 7. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 8. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 9. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
 10. \<And>ck env n s extra3. nsLookup (sem_env.v env) n = None \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 35 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (35 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 7. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 8. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 9. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
 10. \<And>ck env n s extra3. nsLookup (sem_env.v env) n = None \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 35 subgoals...
[PROOF STEP]
case (cons3 ck env e es v1 err s1 s2 s3)
[PROOF STATE]
proof (state)
this:
(evaluate ck env s1 e (s2, Rval v1) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r'))) \<and> evaluate_list ck env s2 es (s3, Rerr err) \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> (s3, Rerr err) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count') s', r'))

goal (35 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 7. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 8. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 9. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
 10. \<And>ck env n s extra3. nsLookup (sem_env.v env) n = None \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 35 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(evaluate ck env s1 e (s2, Rval v1) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r'))) \<and> evaluate_list ck env s2 es (s3, Rerr err) \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> (s3, Rerr err) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count') s', r'))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
(evaluate ck env s1 e (s2, Rval v1) \<and> (\<forall>x count count' s' r'. clock s1 = count + x \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r'))) \<and> evaluate_list ck env s2 es (s3, Rerr err) \<and> (\<forall>x count count' s' r'. clock s2 = count + x \<and> (s3, Rerr err) = (s', r') \<and> clock s' = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count') s', r'))

goal (1 subgoal):
 1. \<forall>count count' s' r'. clock s1 = count + extra2 \<and> (s3, Rerr err) = (s', r') \<and> clock s' = count' + extra2 \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s1) (e # es) (update_clock (\<lambda>_. count') s', r')
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra2 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_list True env s2 es (s3, Rerr err); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra2 = count'a + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count'a) s3, Rerr err); clock s1 = count + extra2; clock s3 = count' + extra2; ck\<rbrakk> \<Longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s1) (e # es) (update_clock (\<lambda>_. count') s3, Rerr err)
[PROOF STEP]
apply (subgoal_tac "(clock   s2)\<ge>extra2")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra2 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_list True env s2 es (s3, Rerr err); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra2 = count'a + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count'a) s3, Rerr err); clock s1 = count + extra2; clock s3 = count' + extra2; ck; extra2 \<le> clock s2\<rbrakk> \<Longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s1) (e # es) (update_clock (\<lambda>_. count') s3, Rerr err)
 2. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra2 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_list True env s2 es (s3, Rerr err); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra2 = count'a + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count'a) s3, Rerr err); clock s1 = count + extra2; clock s3 = count' + extra2; ck\<rbrakk> \<Longrightarrow> extra2 \<le> clock s2
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); evaluate_list True env s2 es (s3, Rerr err); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra2 = count'a + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count'a) s3, Rerr err); clock s1 = count + extra2; clock s3 = count' + extra2; ck; extra2 \<le> clock s2; \<forall>counta count'a. count + extra2 = counta + ?x12 count count' \<and> clock s2 = count'a + ?x12 count count' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count'a) s2, Rval v1)\<rbrakk> \<Longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s1) (e # es) (update_clock (\<lambda>_. count') s3, Rerr err)
 2. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra2 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_list True env s2 es (s3, Rerr err); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra2 = count'a + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count'a) s3, Rerr err); clock s1 = count + extra2; clock s3 = count' + extra2; ck\<rbrakk> \<Longrightarrow> extra2 \<le> clock s2
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); evaluate_list True env s2 es (s3, Rerr err); clock s1 = count + extra2; clock s3 = count' + extra2; ck; extra2 \<le> clock s2; \<forall>counta count'a. count + extra2 = counta + ?x12 count count' \<and> clock s2 = count'a + ?x12 count count' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count'a) s2, Rval v1); \<forall>counta count'a. clock s2 = counta + ?x14 count count' \<and> count' + extra2 = count'a + ?x14 count count' \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. counta) s2) es (update_clock (\<lambda>_. count'a) s3, Rerr err)\<rbrakk> \<Longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s1) (e # es) (update_clock (\<lambda>_. count') s3, Rerr err)
 2. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra2 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_list True env s2 es (s3, Rerr err); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra2 = count'a + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count'a) s3, Rerr err); clock s1 = count + extra2; clock s3 = count' + extra2; ck\<rbrakk> \<Longrightarrow> extra2 \<le> clock s2
[PROOF STEP]
apply (drule spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); evaluate_list True env s2 es (s3, Rerr err); clock s1 = count + extra2; clock s3 = count' + extra2; ck; extra2 \<le> clock s2; \<forall>counta count'a. clock s2 = counta + ?x14 count count' \<and> count' + extra2 = count'a + ?x14 count count' \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. counta) s2) es (update_clock (\<lambda>_. count'a) s3, Rerr err); \<forall>count'a. count + extra2 = ?count16 count count' + ?x12 count count' \<and> clock s2 = count'a + ?x12 count count' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. ?count16 count count') s1) e (update_clock (\<lambda>_. count'a) s2, Rval v1)\<rbrakk> \<Longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s1) (e # es) (update_clock (\<lambda>_. count') s3, Rerr err)
 2. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra2 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_list True env s2 es (s3, Rerr err); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra2 = count'a + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count'a) s3, Rerr err); clock s1 = count + extra2; clock s3 = count' + extra2; ck\<rbrakk> \<Longrightarrow> extra2 \<le> clock s2
[PROOF STEP]
apply (drule_tac x="(clock   s2)-extra2" in spec)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); evaluate_list True env s2 es (s3, Rerr err); clock s1 = count + extra2; clock s3 = count' + extra2; ck; extra2 \<le> clock s2; \<forall>count'a. count + extra2 = ?count16 count count' + ?x12 count count' \<and> clock s2 = count'a + ?x12 count count' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. ?count16 count count') s1) e (update_clock (\<lambda>_. count'a) s2, Rval v1); \<forall>count'a. clock s2 = clock s2 - extra2 + ?x14 count count' \<and> count' + extra2 = count'a + ?x14 count count' \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. clock s2 - extra2) s2) es (update_clock (\<lambda>_. count'a) s3, Rerr err)\<rbrakk> \<Longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s1) (e # es) (update_clock (\<lambda>_. count') s3, Rerr err)
 2. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra2 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_list True env s2 es (s3, Rerr err); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra2 = count'a + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count'a) s3, Rerr err); clock s1 = count + extra2; clock s3 = count' + extra2; ck\<rbrakk> \<Longrightarrow> extra2 \<le> clock s2
[PROOF STEP]
apply rule
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); evaluate_list True env s2 es (s3, Rerr err); clock s1 = count + extra2; clock s3 = count' + extra2; ck; extra2 \<le> clock s2; \<forall>count'a. count + extra2 = ?count16 count count' + ?x12 count count' \<and> clock s2 = count'a + ?x12 count count' \<longrightarrow> evaluate True env (update_clock (\<lambda>_. ?count16 count count') s1) e (update_clock (\<lambda>_. count'a) s2, Rval v1); \<forall>count'a. clock s2 = clock s2 - extra2 + ?x14 count count' \<and> count' + extra2 = count'a + ?x14 count count' \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. clock s2 - extra2) s2) es (update_clock (\<lambda>_. count'a) s3, Rerr err)\<rbrakk> \<Longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (?s2.20 count count', Rval (?v1.20 count count')) \<and> evaluate_list True env (?s2.20 count count') es (update_clock (\<lambda>_. count') s3, Rerr err)
 2. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra2 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_list True env s2 es (s3, Rerr err); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra2 = count'a + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count'a) s3, Rerr err); clock s1 = count + extra2; clock s3 = count' + extra2; ck\<rbrakk> \<Longrightarrow> extra2 \<le> clock s2
[PROOF STEP]
apply force
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>count count'. \<lbrakk>evaluate True env s1 e (s2, Rval v1); \<forall>x counta count'. count + extra2 = counta + x \<and> clock s2 = count' + x \<longrightarrow> evaluate True env (update_clock (\<lambda>_. counta) s1) e (update_clock (\<lambda>_. count') s2, Rval v1); evaluate_list True env s2 es (s3, Rerr err); \<forall>x count count'a. clock s2 = count + x \<and> count' + extra2 = count'a + x \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s2) es (update_clock (\<lambda>_. count'a) s3, Rerr err); clock s1 = count + extra2; clock s3 = count' + extra2; ck\<rbrakk> \<Longrightarrow> extra2 \<le> clock s2
[PROOF STEP]
by (auto dest:clock_monotone(2))
[PROOF STATE]
proof (state)
this:
\<forall>count count' s' r'. clock s1 = count + extra2 \<and> (s3, Rerr err) = (s', r') \<and> clock s' = count' + extra2 \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s1) (e # es) (update_clock (\<lambda>_. count') s', r')

goal (34 subgoals):
 1. \<And>ck env l s extra3. \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval (Litv l)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Lit l) (update_clock (\<lambda>_. count') s', r')
 2. \<And>ck env e s1 s2 v1 extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr (Rraise v1)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 3. \<And>ck env e s1 s2 err extra3. \<lbrakk>evaluate ck s1 env e (s2, Rerr err); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rerr err) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Raise e) (update_clock (\<lambda>_. count') s', r')
 4. \<And>ck s1 s2 env e v1 pes extra3. \<lbrakk>evaluate ck s1 env e (s2, Rval v1); \<And>extra3. \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock env = count + extra3 \<and> (s2, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True s1 (update_clock (\<lambda>_. count) env) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 5. \<And>ck s1 s2 env e pes a extra3. \<lbrakk>evaluate ck env s1 e (s2, Rerr (Rabort a)); \<And>extra3. \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) e (update_clock (\<lambda>_. count') s', r')\<rbrakk> \<Longrightarrow> \<forall>count count' s' r'. clock s1 = count + extra3 \<and> (s2, Rerr (Rabort a)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s1) (Handle e pes) (update_clock (\<lambda>_. count') s', r')
 6. \<And>ck env cn es vs s s' v1 extra3. do_con_check (c env) cn (length es) \<and> build_conv (c env) cn (rev vs) = Some v1 \<and> evaluate_list ck env s (rev es) (s', Rval vs) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rval vs) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rval v1) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 7. \<And>ck env cn es s extra3. \<not> do_con_check (c env) cn (length es) \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s', r')
 8. \<And>ck env cn es err s s' extra3. do_con_check (c env) cn (length es) \<and> evaluate_list ck env s (rev es) (s', Rerr err) \<and> (\<forall>x count count' s'a r'. clock s = count + x \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + x \<and> ck = True \<longrightarrow> evaluate_list True env (update_clock (\<lambda>_. count) s) (rev es) (update_clock (\<lambda>_. count') s'a, r')) \<Longrightarrow> \<forall>count count' s'a r'. clock s = count + extra3 \<and> (s', Rerr err) = (s'a, r') \<and> clock s'a = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Con cn es) (update_clock (\<lambda>_. count') s'a, r')
 9. \<And>ck env n v1 s extra3. nsLookup (sem_env.v env) n = Some v1 \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rval v1) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
 10. \<And>ck env n s extra3. nsLookup (sem_env.v env) n = None \<Longrightarrow> \<forall>count count' s' r'. clock s = count + extra3 \<and> (s, Rerr (Rabort Rtype_error)) = (s', r') \<and> clock s' = count' + extra3 \<and> ck = True \<longrightarrow> evaluate True env (update_clock (\<lambda>_. count) s) (Var n) (update_clock (\<lambda>_. count') s', r')
A total of 34 subgoals...
[PROOF STEP]
qed(fastforce intro:evaluate_match_evaluate_list_evaluate.intros)+