[STATEMENT]
theorem blue_dfs_correct:
  fixes G :: "('v,_) b_graph_rec_scheme"
  assumes "b_graph G"
  assumes finitely_reachable: "finite ((g_E G)\<^sup>* `` g_V0 G)"
  shows "blue_dfs G \<le> SPEC (\<lambda>r.
    case r of None \<Rightarrow> (\<forall>L. \<not>b_graph.is_lasso_prpl G L)
  | Some L \<Rightarrow> b_graph.is_lasso_prpl G L)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> b_graph.is_lasso_prpl G L | Some L \<Rightarrow> b_graph.is_lasso_prpl G L)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> b_graph.is_lasso_prpl G L | Some L \<Rightarrow> b_graph.is_lasso_prpl G L)
[PROOF STEP]
interpret b_graph G
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. b_graph G
[PROOF STEP]
by fact
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
let ?A = "bg_F G"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
let ?E = "g_E G"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
let ?V0 = "g_V0 G"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
let ?U = "?E\<^sup>*``?V0"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
define add_inv where "add_inv = (\<lambda>blues reds onstack.
    \<not>(\<exists>v\<in>(blues-onstack)\<inter>?A. (v,v)\<in>?E\<^sup>+)  \<comment> \<open>No cycles over finished, accepting states\<close>
    \<and> reds \<subseteq> blues                     \<comment> \<open>Red nodes are also blue\<close>
    \<and> reds \<inter> onstack = {}              \<comment> \<open>No red nodes on stack\<close>
    \<and> red_dfs_inv ?E ?U reds onstack)"
[PROOF STATE]
proof (state)
this:
add_inv = (\<lambda>blues reds onstack. \<not> (\<exists>v\<in>(blues - onstack) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds \<subseteq> blues \<and> reds \<inter> onstack = {} \<and> red_dfs_inv E reachable reds onstack)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
define cyc_post where "cyc_post = (\<lambda>blues reds onstack u0 cyc. (case cyc of
      NO_CYC \<Rightarrow> add_inv blues reds onstack
    | REACH u p \<Rightarrow>
          path ?E u0 p u
        \<and> u \<in> onstack-{u0}
        \<and> insert u (set p) \<inter> ?A \<noteq> {}
    | CIRC pr pl \<Rightarrow> \<exists>v.
          pl\<noteq>[]
        \<and> path ?E v pl v
        \<and> path ?E u0 pr v
        \<and> set pl \<inter> ?A \<noteq> {}
    ))"
[PROOF STATE]
proof (state)
this:
cyc_post = (\<lambda>blues reds onstack u0 cyc. case cyc of NO_CYC \<Rightarrow> add_inv blues reds onstack | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {})

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
define pre where "pre = (\<lambda>(blues,reds,onstack,u::'v).
    gen_dfs_pre ?E ?U onstack blues u \<and> add_inv blues reds onstack)"
[PROOF STATE]
proof (state)
this:
pre = (\<lambda>(blues, reds, onstack, u). gen_dfs_pre E reachable onstack blues u \<and> add_inv blues reds onstack)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
define post where "post = (\<lambda>(blues0,reds0::'v set,onstack0,u0) (blues,reds,onstack,cyc).
    onstack = onstack0
    \<and> gen_dfs_post ?E ?U onstack0 blues0 u0 blues (cyc\<noteq>NO_CYC)
    \<and> cyc_post blues reds onstack u0 cyc)"
[PROOF STATE]
proof (state)
this:
post = (\<lambda>(blues0, reds0, onstack0, u0) (blues, reds, onstack, cyc). onstack = onstack0 \<and> gen_dfs_post E reachable onstack0 blues0 u0 blues (cyc \<noteq> NO_CYC) \<and> cyc_post blues reds onstack u0 cyc)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
define fe_inv where "fe_inv = (\<lambda>blues0 u0 onstack0 it (blues,reds,onstack,cyc).
    onstack=onstack0
    \<and> gen_dfs_fe_inv ?E ?U onstack0 blues0 u0 it blues (cyc\<noteq>NO_CYC)
    \<and> cyc_post blues reds onstack u0 cyc)"
[PROOF STATE]
proof (state)
this:
fe_inv = (\<lambda>blues0 u0 onstack0 it (blues, reds, onstack, cyc). onstack = onstack0 \<and> gen_dfs_fe_inv E reachable onstack0 blues0 u0 it blues (cyc \<noteq> NO_CYC) \<and> cyc_post blues reds onstack u0 cyc)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
define outer_inv where "outer_inv = (\<lambda>it (blues,reds,cyc).
    case cyc of
      NO_CYC \<Rightarrow>
        add_inv blues reds {}
      \<and> gen_dfs_outer ?E ?U ?V0 it blues False
    | CIRC pr pl \<Rightarrow> \<exists>v0\<in>?V0. \<exists>v.
        pl\<noteq>[]
      \<and> path ?E v pl v
      \<and> path ?E v0 pr v
      \<and> set pl \<inter> ?A \<noteq> {}
    | _ \<Rightarrow> False)"
[PROOF STATE]
proof (state)
this:
outer_inv = (\<lambda>it (blues, reds, cyc). case cyc of NO_CYC \<Rightarrow> add_inv blues reds {} \<and> gen_dfs_outer E reachable V0 it blues False | REACH v list \<Rightarrow> False | CIRC pr pl \<Rightarrow> \<exists>v0\<in>V0. \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E v0 pr v \<and> set pl \<inter> F \<noteq> {})

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
have OUTER_INITIAL: "outer_inv V0 ({}, {}, NO_CYC)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. outer_inv V0 ({}, {}, NO_CYC)
[PROOF STEP]
unfolding outer_inv_def add_inv_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. case ({}, {}, NO_CYC) of (blues, reds, NO_CYC) \<Rightarrow> (\<not> (\<exists>v\<in>(blues - {}) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds \<subseteq> blues \<and> reds \<inter> {} = {} \<and> red_dfs_inv E reachable reds {}) \<and> gen_dfs_outer E reachable V0 V0 blues False | (blues, reds, REACH v list) \<Rightarrow> False | (blues, reds, CIRC pr pl) \<Rightarrow> \<exists>v0\<in>V0. \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E v0 pr v \<and> set pl \<inter> F \<noteq> {}
[PROOF STEP]
using finitely_reachable
[PROOF STATE]
proof (prove)
using this:
finite reachable

goal (1 subgoal):
 1. case ({}, {}, NO_CYC) of (blues, reds, NO_CYC) \<Rightarrow> (\<not> (\<exists>v\<in>(blues - {}) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds \<subseteq> blues \<and> reds \<inter> {} = {} \<and> red_dfs_inv E reachable reds {}) \<and> gen_dfs_outer E reachable V0 V0 blues False | (blues, reds, REACH v list) \<Rightarrow> False | (blues, reds, CIRC pr pl) \<Rightarrow> \<exists>v0\<in>V0. \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E v0 pr v \<and> set pl \<inter> F \<noteq> {}
[PROOF STEP]
apply (auto intro: red_dfs_inv_initial gen_dfs_outer_initial)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
outer_inv V0 ({}, {}, NO_CYC)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
outer_inv V0 ({}, {}, NO_CYC)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
fix onstack blues u0 reds
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume "pre (blues,reds,onstack,u0)"
[PROOF STATE]
proof (state)
this:
pre (blues, reds, onstack, u0)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
hence "fe_inv (insert u0 blues) u0 (insert u0 onstack) (?E``{u0})
      (insert u0 blues,reds,insert u0 onstack,NO_CYC)"
[PROOF STATE]
proof (prove)
using this:
pre (blues, reds, onstack, u0)

goal (1 subgoal):
 1. fe_inv (insert u0 blues) u0 (insert u0 onstack) (E `` {u0}) (insert u0 blues, reds, insert u0 onstack, NO_CYC)
[PROOF STEP]
unfolding fe_inv_def add_inv_def cyc_post_def
[PROOF STATE]
proof (prove)
using this:
pre (blues, reds, onstack, u0)

goal (1 subgoal):
 1. case (insert u0 blues, reds, insert u0 onstack, NO_CYC) of (bluesa, reds, onstacka, cyc) \<Rightarrow> onstacka = insert u0 onstack \<and> gen_dfs_fe_inv E reachable (insert u0 onstack) (insert u0 blues) u0 (E `` {u0}) bluesa (cyc \<noteq> NO_CYC) \<and> (case cyc of NO_CYC \<Rightarrow> \<not> (\<exists>v\<in>(bluesa - onstacka) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds \<subseteq> bluesa \<and> reds \<inter> onstacka = {} \<and> red_dfs_inv E reachable reds onstacka | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstacka - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {})
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pre (blues, reds, onstack, u0) \<Longrightarrow> gen_dfs_fe_inv E reachable (insert u0 onstack) (insert u0 blues) u0 (E `` {u0}) (insert u0 blues) False \<and> (\<forall>v\<in>(blues - insert u0 onstack) \<inter> F. (v, v) \<notin> E\<^sup>+) \<and> reds \<subseteq> insert u0 blues \<and> u0 \<notin> reds \<and> reds \<inter> onstack = {} \<and> red_dfs_inv E reachable reds (insert u0 onstack)
[PROOF STEP]
apply (intro conjI)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. pre (blues, reds, onstack, u0) \<Longrightarrow> gen_dfs_fe_inv E reachable (insert u0 onstack) (insert u0 blues) u0 (E `` {u0}) (insert u0 blues) False
 2. pre (blues, reds, onstack, u0) \<Longrightarrow> \<forall>v\<in>(blues - insert u0 onstack) \<inter> F. (v, v) \<notin> E\<^sup>+
 3. pre (blues, reds, onstack, u0) \<Longrightarrow> reds \<subseteq> insert u0 blues
 4. pre (blues, reds, onstack, u0) \<Longrightarrow> u0 \<notin> reds
 5. pre (blues, reds, onstack, u0) \<Longrightarrow> reds \<inter> onstack = {}
 6. pre (blues, reds, onstack, u0) \<Longrightarrow> red_dfs_inv E reachable reds (insert u0 onstack)
[PROOF STEP]
apply (simp add: pre_def gen_dfs_pre_imp_fe)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. pre (blues, reds, onstack, u0) \<Longrightarrow> \<forall>v\<in>(blues - insert u0 onstack) \<inter> F. (v, v) \<notin> E\<^sup>+
 2. pre (blues, reds, onstack, u0) \<Longrightarrow> reds \<subseteq> insert u0 blues
 3. pre (blues, reds, onstack, u0) \<Longrightarrow> u0 \<notin> reds
 4. pre (blues, reds, onstack, u0) \<Longrightarrow> reds \<inter> onstack = {}
 5. pre (blues, reds, onstack, u0) \<Longrightarrow> red_dfs_inv E reachable reds (insert u0 onstack)
[PROOF STEP]
apply (auto simp: pre_def add_inv_def) []
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. pre (blues, reds, onstack, u0) \<Longrightarrow> reds \<subseteq> insert u0 blues
 2. pre (blues, reds, onstack, u0) \<Longrightarrow> u0 \<notin> reds
 3. pre (blues, reds, onstack, u0) \<Longrightarrow> reds \<inter> onstack = {}
 4. pre (blues, reds, onstack, u0) \<Longrightarrow> red_dfs_inv E reachable reds (insert u0 onstack)
[PROOF STEP]
apply (auto simp: pre_def add_inv_def) []
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. pre (blues, reds, onstack, u0) \<Longrightarrow> u0 \<notin> reds
 2. pre (blues, reds, onstack, u0) \<Longrightarrow> reds \<inter> onstack = {}
 3. pre (blues, reds, onstack, u0) \<Longrightarrow> red_dfs_inv E reachable reds (insert u0 onstack)
[PROOF STEP]
apply (auto simp: pre_def add_inv_def gen_dfs_pre_def) []
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. pre (blues, reds, onstack, u0) \<Longrightarrow> reds \<inter> onstack = {}
 2. pre (blues, reds, onstack, u0) \<Longrightarrow> red_dfs_inv E reachable reds (insert u0 onstack)
[PROOF STEP]
apply (auto simp: pre_def add_inv_def) []
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pre (blues, reds, onstack, u0) \<Longrightarrow> red_dfs_inv E reachable reds (insert u0 onstack)
[PROOF STEP]
apply (unfold pre_def add_inv_def red_dfs_inv_def gen_dfs_pre_def) []
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. case (blues, reds, onstack, u0) of (blues, reds, onstack, u) \<Rightarrow> (E `` reachable \<subseteq> reachable \<and> finite reachable \<and> blues \<subseteq> reachable \<and> u \<in> reachable \<and> E `` (blues - onstack) \<subseteq> blues \<and> u \<notin> blues \<and> onstack \<subseteq> blues \<and> (\<forall>v\<in>onstack. (v, u) \<in> (E \<inter> onstack \<times> UNIV)\<^sup>*)) \<and> \<not> (\<exists>v\<in>(blues - onstack) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds \<subseteq> blues \<and> reds \<inter> onstack = {} \<and> E `` reachable \<subseteq> reachable \<and> finite reachable \<and> reds \<subseteq> reachable \<and> E `` reds \<subseteq> reds \<and> E `` reds \<inter> onstack = {} \<Longrightarrow> E `` reachable \<subseteq> reachable \<and> finite reachable \<and> reds \<subseteq> reachable \<and> E `` reds \<subseteq> reds \<and> E `` reds \<inter> insert u0 onstack = {}
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x xa. \<lbrakk>blues \<subseteq> reachable; (x, u0) \<in> E\<^sup>*; x \<in> V0; E `` (blues - onstack) \<subseteq> blues; u0 \<notin> blues; onstack \<subseteq> blues; \<forall>v\<in>onstack. (v, u0) \<in> (E \<inter> onstack \<times> UNIV)\<^sup>*; \<forall>v\<in>(blues - onstack) \<inter> F. (v, v) \<notin> E\<^sup>+; reds \<subseteq> blues; reds \<inter> onstack = {}; E `` reachable \<subseteq> reachable; finite reachable; reds \<subseteq> reachable; E `` reds \<subseteq> reds; E `` reds \<inter> onstack = {}; (xa, u0) \<in> E; xa \<in> reds\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
fe_inv (insert u0 blues) u0 (insert u0 onstack) (E `` {u0}) (insert u0 blues, reds, insert u0 onstack, NO_CYC)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
pre (?blues3, ?reds3, ?onstack3, ?u0.3) \<Longrightarrow> fe_inv (insert ?u0.3 ?blues3) ?u0.3 (insert ?u0.3 ?onstack3) (E `` {?u0.3}) (insert ?u0.3 ?blues3, ?reds3, insert ?u0.3 ?onstack3, NO_CYC)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
note PRE_IMP_FE = this
[PROOF STATE]
proof (state)
this:
pre (?blues3, ?reds3, ?onstack3, ?u0.3) \<Longrightarrow> fe_inv (insert ?u0.3 ?blues3) ?u0.3 (insert ?u0.3 ?onstack3) (E `` {?u0.3}) (insert ?u0.3 ?blues3, ?reds3, insert ?u0.3 ?onstack3, NO_CYC)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
have [simp]: "\<And>u cyc. prep_wit_blue u cyc = NO_CYC \<longleftrightarrow> cyc=NO_CYC"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>u cyc. (prep_wit_blue u cyc = NO_CYC) = (cyc = NO_CYC)
[PROOF STEP]
by (case_tac cyc) auto
[PROOF STATE]
proof (state)
this:
(prep_wit_blue ?u1 ?cyc1 = NO_CYC) = (?cyc1 = NO_CYC)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
(prep_wit_blue ?u1 ?cyc1 = NO_CYC) = (?cyc1 = NO_CYC)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
fix blues0 reds0 onstack0 and u0::'v  and
      blues reds onstack blues' reds' onstack'
      cyc it t
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume PRE: "pre (blues0,reds0,onstack0,u0)"
[PROOF STATE]
proof (state)
this:
pre (blues0, reds0, onstack0, u0)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume FEI: "fe_inv (insert u0 blues0) u0 (insert u0 onstack0)
        it (blues,reds,onstack,NO_CYC)"
[PROOF STATE]
proof (state)
this:
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) it (blues, reds, onstack, NO_CYC)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume IT: "t\<in>it" "it\<subseteq>?E``{u0}" "t\<notin>blues"
[PROOF STATE]
proof (state)
this:
t \<in> it
it \<subseteq> E `` {u0}
t \<notin> blues

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume POST: "post (blues,reds,onstack, t) (blues',reds',onstack',cyc)"
[PROOF STATE]
proof (state)
this:
post (blues, reds, onstack, t) (blues', reds', onstack', cyc)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
note [simp del] = path_simps
[PROOF STATE]
proof (state)
this:
path ?E ?u [] ?v = (?u = ?v)
path ?E ?u (?u' # ?l) ?w = (?u' = ?u \<and> (\<exists>v. (?u, v) \<in> ?E \<and> path ?E v ?l ?w))
path ?E ?u (?la @ ?lb) ?w = (\<exists>v. path ?E ?u ?la v \<and> path ?E v ?lb ?w)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
have "fe_inv (insert u0 blues0) u0 (insert u0 onstack0) (it-{t})
      (blues',reds',onstack',prep_wit_blue u0 cyc)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fe_inv (insert u0 blues0) u0 (insert u0 onstack0) (it - {t}) (blues', reds', onstack', prep_wit_blue u0 cyc)
[PROOF STEP]
unfolding fe_inv_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. case (blues', reds', onstack', prep_wit_blue u0 cyc) of (blues, reds, onstack, cyc) \<Rightarrow> onstack = insert u0 onstack0 \<and> gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 (it - {t}) blues (cyc \<noteq> NO_CYC) \<and> cyc_post blues reds onstack u0 cyc
[PROOF STEP]
using PRE FEI IT POST
[PROOF STATE]
proof (prove)
using this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) it (blues, reds, onstack, NO_CYC)
t \<in> it
it \<subseteq> E `` {u0}
t \<notin> blues
post (blues, reds, onstack, t) (blues', reds', onstack', cyc)

goal (1 subgoal):
 1. case (blues', reds', onstack', prep_wit_blue u0 cyc) of (blues, reds, onstack, cyc) \<Rightarrow> onstack = insert u0 onstack0 \<and> gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 (it - {t}) blues (cyc \<noteq> NO_CYC) \<and> cyc_post blues reds onstack u0 cyc
[PROOF STEP]
unfolding fe_inv_def post_def pre_def
[PROOF STATE]
proof (prove)
using this:
case (blues0, reds0, onstack0, u0) of (blues, reds, onstack, u) \<Rightarrow> gen_dfs_pre E reachable onstack blues u \<and> add_inv blues reds onstack
case (blues, reds, onstack, NO_CYC) of (blues, reds, onstack, cyc) \<Rightarrow> onstack = insert u0 onstack0 \<and> gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 it blues (cyc \<noteq> NO_CYC) \<and> cyc_post blues reds onstack u0 cyc
t \<in> it
it \<subseteq> E `` {u0}
t \<notin> blues
(case (blues, reds, onstack, t) of (blues0, reds0, onstack0, u0) \<Rightarrow> \<lambda>(blues, reds, onstack, cyc). onstack = onstack0 \<and> gen_dfs_post E reachable onstack0 blues0 u0 blues (cyc \<noteq> NO_CYC) \<and> cyc_post blues reds onstack u0 cyc) (blues', reds', onstack', cyc)

goal (1 subgoal):
 1. case (blues', reds', onstack', prep_wit_blue u0 cyc) of (blues, reds, onstack, cyc) \<Rightarrow> onstack = insert u0 onstack0 \<and> gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 (it - {t}) blues (cyc \<noteq> NO_CYC) \<and> cyc_post blues reds onstack u0 cyc
[PROOF STEP]
apply (clarsimp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>t \<in> it; it \<subseteq> E `` {u0}; t \<notin> blues; gen_dfs_pre E reachable onstack0 blues0 u0; add_inv blues0 reds0 onstack0; onstack = insert u0 onstack0; onstack' = insert u0 onstack0; gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 it blues False; cyc_post blues reds (insert u0 onstack0) u0 NO_CYC; gen_dfs_post E reachable (insert u0 onstack0) blues t blues' (cyc \<noteq> NO_CYC); cyc_post blues' reds' (insert u0 onstack0) t cyc\<rbrakk> \<Longrightarrow> gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 (it - {t}) blues' (cyc \<noteq> NO_CYC) \<and> cyc_post blues' reds' (insert u0 onstack0) u0 (prep_wit_blue u0 cyc)
[PROOF STEP]
apply (intro allI impI conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>t \<in> it; it \<subseteq> E `` {u0}; t \<notin> blues; gen_dfs_pre E reachable onstack0 blues0 u0; add_inv blues0 reds0 onstack0; onstack = insert u0 onstack0; onstack' = insert u0 onstack0; gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 it blues False; cyc_post blues reds (insert u0 onstack0) u0 NO_CYC; gen_dfs_post E reachable (insert u0 onstack0) blues t blues' (cyc \<noteq> NO_CYC); cyc_post blues' reds' (insert u0 onstack0) t cyc\<rbrakk> \<Longrightarrow> gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 (it - {t}) blues' (cyc \<noteq> NO_CYC)
 2. \<lbrakk>t \<in> it; it \<subseteq> E `` {u0}; t \<notin> blues; gen_dfs_pre E reachable onstack0 blues0 u0; add_inv blues0 reds0 onstack0; onstack = insert u0 onstack0; onstack' = insert u0 onstack0; gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 it blues False; cyc_post blues reds (insert u0 onstack0) u0 NO_CYC; gen_dfs_post E reachable (insert u0 onstack0) blues t blues' (cyc \<noteq> NO_CYC); cyc_post blues' reds' (insert u0 onstack0) t cyc\<rbrakk> \<Longrightarrow> cyc_post blues' reds' (insert u0 onstack0) u0 (prep_wit_blue u0 cyc)
[PROOF STEP]
apply (blast intro: gen_dfs_post_imp_fe_inv)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>t \<in> it; it \<subseteq> E `` {u0}; t \<notin> blues; gen_dfs_pre E reachable onstack0 blues0 u0; add_inv blues0 reds0 onstack0; onstack = insert u0 onstack0; onstack' = insert u0 onstack0; gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 it blues False; cyc_post blues reds (insert u0 onstack0) u0 NO_CYC; gen_dfs_post E reachable (insert u0 onstack0) blues t blues' (cyc \<noteq> NO_CYC); cyc_post blues' reds' (insert u0 onstack0) t cyc\<rbrakk> \<Longrightarrow> cyc_post blues' reds' (insert u0 onstack0) u0 (prep_wit_blue u0 cyc)
[PROOF STEP]
unfolding cyc_post_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>t \<in> it; it \<subseteq> E `` {u0}; t \<notin> blues; gen_dfs_pre E reachable onstack0 blues0 u0; add_inv blues0 reds0 onstack0; onstack = insert u0 onstack0; onstack' = insert u0 onstack0; gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 it blues False; case NO_CYC of NO_CYC \<Rightarrow> add_inv blues reds (insert u0 onstack0) | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> insert u0 onstack0 - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {}; gen_dfs_post E reachable (insert u0 onstack0) blues t blues' (cyc \<noteq> NO_CYC); case cyc of NO_CYC \<Rightarrow> add_inv blues' reds' (insert u0 onstack0) | REACH u p \<Rightarrow> path E t p u \<and> u \<in> insert u0 onstack0 - {t} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E t pr v \<and> set pl \<inter> F \<noteq> {}\<rbrakk> \<Longrightarrow> case prep_wit_blue u0 cyc of NO_CYC \<Rightarrow> add_inv blues' reds' (insert u0 onstack0) | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> insert u0 onstack0 - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {}
[PROOF STEP]
apply (auto split: blue_witness.split_asm simp: path_simps)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) (it - {t}) (blues', reds', onstack', prep_wit_blue u0 cyc)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>pre (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4); fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) ?it4 (?blues4, ?reds4, ?onstack4, NO_CYC); ?t4 \<in> ?it4; ?it4 \<subseteq> E `` {?u0.4}; ?t4 \<notin> ?blues4; post (?blues4, ?reds4, ?onstack4, ?t4) (?blues'4, ?reds'4, ?onstack'4, ?cyc4)\<rbrakk> \<Longrightarrow> fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) (?it4 - {?t4}) (?blues'4, ?reds'4, ?onstack'4, prep_wit_blue ?u0.4 ?cyc4)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
note FE_INV_PRES=this
[PROOF STATE]
proof (state)
this:
\<lbrakk>pre (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4); fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) ?it4 (?blues4, ?reds4, ?onstack4, NO_CYC); ?t4 \<in> ?it4; ?it4 \<subseteq> E `` {?u0.4}; ?t4 \<notin> ?blues4; post (?blues4, ?reds4, ?onstack4, ?t4) (?blues'4, ?reds'4, ?onstack'4, ?cyc4)\<rbrakk> \<Longrightarrow> fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) (?it4 - {?t4}) (?blues'4, ?reds'4, ?onstack'4, prep_wit_blue ?u0.4 ?cyc4)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
\<lbrakk>pre (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4); fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) ?it4 (?blues4, ?reds4, ?onstack4, NO_CYC); ?t4 \<in> ?it4; ?it4 \<subseteq> E `` {?u0.4}; ?t4 \<notin> ?blues4; post (?blues4, ?reds4, ?onstack4, ?t4) (?blues'4, ?reds'4, ?onstack'4, ?cyc4)\<rbrakk> \<Longrightarrow> fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) (?it4 - {?t4}) (?blues'4, ?reds'4, ?onstack'4, prep_wit_blue ?u0.4 ?cyc4)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
fix blues reds onstack u0
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume "pre (blues,reds,onstack,u0)"
[PROOF STATE]
proof (state)
this:
pre (blues, reds, onstack, u0)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
hence "u0\<in>?E\<^sup>*``?V0"
[PROOF STATE]
proof (prove)
using this:
pre (blues, reds, onstack, u0)

goal (1 subgoal):
 1. u0 \<in> reachable
[PROOF STEP]
unfolding pre_def gen_dfs_pre_def
[PROOF STATE]
proof (prove)
using this:
case (blues, reds, onstack, u0) of (blues, reds, onstack, u) \<Rightarrow> (E `` reachable \<subseteq> reachable \<and> finite reachable \<and> blues \<subseteq> reachable \<and> u \<in> reachable \<and> E `` (blues - onstack) \<subseteq> blues \<and> u \<notin> blues \<and> onstack \<subseteq> blues \<and> (\<forall>v\<in>onstack. (v, u) \<in> (E \<inter> onstack \<times> UNIV)\<^sup>*)) \<and> add_inv blues reds onstack

goal (1 subgoal):
 1. u0 \<in> reachable
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
u0 \<in> reachable

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
pre (?blues4, ?reds4, ?onstack4, ?u0.4) \<Longrightarrow> ?u0.4 \<in> reachable

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
note PRE_IMP_REACH = this
[PROOF STATE]
proof (state)
this:
pre (?blues4, ?reds4, ?onstack4, ?u0.4) \<Longrightarrow> ?u0.4 \<in> reachable

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
pre (?blues4, ?reds4, ?onstack4, ?u0.4) \<Longrightarrow> ?u0.4 \<in> reachable

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
fix blues0 reds0 onstack0 u0 blues reds onstack
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume A: "pre (blues0,reds0,onstack0,u0)"
       "fe_inv (insert u0 blues0) u0 (insert u0 onstack0)
        {} (blues,reds,onstack,NO_CYC)"
       "u0\<in>?A"
[PROOF STATE]
proof (state)
this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)
u0 \<in> F

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
have "u0\<notin>reds"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. u0 \<notin> reds
[PROOF STEP]
using A
[PROOF STATE]
proof (prove)
using this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)
u0 \<in> F

goal (1 subgoal):
 1. u0 \<notin> reds
[PROOF STEP]
unfolding fe_inv_def add_inv_def pre_def cyc_post_def
[PROOF STATE]
proof (prove)
using this:
case (blues0, reds0, onstack0, u0) of (blues, reds, onstack, u) \<Rightarrow> gen_dfs_pre E reachable onstack blues u \<and> \<not> (\<exists>v\<in>(blues - onstack) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds \<subseteq> blues \<and> reds \<inter> onstack = {} \<and> red_dfs_inv E reachable reds onstack
case (blues, reds, onstack, NO_CYC) of (blues, reds, onstack, cyc) \<Rightarrow> onstack = insert u0 onstack0 \<and> gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 {} blues (cyc \<noteq> NO_CYC) \<and> (case cyc of NO_CYC \<Rightarrow> \<not> (\<exists>v\<in>(blues - onstack) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds \<subseteq> blues \<and> reds \<inter> onstack = {} \<and> red_dfs_inv E reachable reds onstack | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {})
u0 \<in> F

goal (1 subgoal):
 1. u0 \<notin> reds
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
u0 \<notin> reds

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>pre (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4); fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) {} (?blues4, ?reds4, ?onstack4, NO_CYC); ?u0.4 \<in> F\<rbrakk> \<Longrightarrow> ?u0.4 \<notin> ?reds4

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
note FE_IMP_RED_PRE = this
[PROOF STATE]
proof (state)
this:
\<lbrakk>pre (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4); fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) {} (?blues4, ?reds4, ?onstack4, NO_CYC); ?u0.4 \<in> F\<rbrakk> \<Longrightarrow> ?u0.4 \<notin> ?reds4

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
\<lbrakk>pre (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4); fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) {} (?blues4, ?reds4, ?onstack4, NO_CYC); ?u0.4 \<in> F\<rbrakk> \<Longrightarrow> ?u0.4 \<notin> ?reds4

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
fix blues0 reds0 onstack0 u0 blues reds onstack rcyc reds'
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume PRE: "pre (blues0,reds0,onstack0,u0)"
[PROOF STATE]
proof (state)
this:
pre (blues0, reds0, onstack0, u0)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume FEI: "fe_inv (insert u0 blues0) u0 (insert u0 onstack0)
        {} (blues,reds,onstack,NO_CYC)"
[PROOF STATE]
proof (state)
this:
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume ACC: "u0\<in>?A"
[PROOF STATE]
proof (state)
this:
u0 \<in> F

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume SPECR: "case rcyc of
      Some (p,v) \<Rightarrow> v\<in>onstack \<and> p\<noteq>[] \<and> path ?E u0 p v
    | None \<Rightarrow>
        red_dfs_inv ?E ?U reds' onstack
        \<and> u0\<in>reds'
        \<and> reds' \<subseteq> reds \<union> ?E\<^sup>* `` {u0}"
[PROOF STATE]
proof (state)
this:
case rcyc of None \<Rightarrow> red_dfs_inv E reachable reds' onstack \<and> u0 \<in> reds' \<and> reds' \<subseteq> reds \<union> E\<^sup>* `` {u0} | Some (p, v) \<Rightarrow> v \<in> onstack \<and> p \<noteq> [] \<and> path E u0 p v

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
have "post (blues0,reds0,onstack0,u0)
      (blues,reds',onstack - {u0},init_wit_blue u0 rcyc)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. post (blues0, reds0, onstack0, u0) (blues, reds', onstack - {u0}, init_wit_blue u0 rcyc)
[PROOF STEP]
unfolding post_def add_inv_def cyc_post_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (case (blues0, reds0, onstack0, u0) of (blues0, reds0, onstack0, u0) \<Rightarrow> \<lambda>(blues, reds, onstack, cyc). onstack = onstack0 \<and> gen_dfs_post E reachable onstack0 blues0 u0 blues (cyc \<noteq> NO_CYC) \<and> (case cyc of NO_CYC \<Rightarrow> \<not> (\<exists>v\<in>(blues - onstack) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds \<subseteq> blues \<and> reds \<inter> onstack = {} \<and> red_dfs_inv E reachable reds onstack | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {})) (blues, reds', onstack - {u0}, init_wit_blue u0 rcyc)
[PROOF STEP]
apply (clarsimp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. onstack - {u0} = onstack0 \<and> gen_dfs_post E reachable onstack0 blues0 u0 blues (init_wit_blue u0 rcyc \<noteq> NO_CYC) \<and> (case init_wit_blue u0 rcyc of NO_CYC \<Rightarrow> \<not> (\<exists>v\<in>(blues - (onstack - {u0})) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds' \<subseteq> blues \<and> reds' \<inter> (onstack - {u0}) = {} \<and> red_dfs_inv E reachable reds' (onstack - {u0}) | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {})
[PROOF STEP]
apply (intro conjI)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. onstack - {u0} = onstack0
 2. gen_dfs_post E reachable onstack0 blues0 u0 blues (init_wit_blue u0 rcyc \<noteq> NO_CYC)
 3. case init_wit_blue u0 rcyc of NO_CYC \<Rightarrow> \<not> (\<exists>v\<in>(blues - (onstack - {u0})) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds' \<subseteq> blues \<and> reds' \<inter> (onstack - {u0}) = {} \<and> red_dfs_inv E reachable reds' (onstack - {u0}) | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {}
[PROOF STEP]
proof goal_cases
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. onstack - {u0} = onstack0
 2. gen_dfs_post E reachable onstack0 blues0 u0 blues (init_wit_blue u0 rcyc \<noteq> NO_CYC)
 3. case init_wit_blue u0 rcyc of NO_CYC \<Rightarrow> \<not> (\<exists>v\<in>(blues - (onstack - {u0})) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds' \<subseteq> blues \<and> reds' \<inter> (onstack - {u0}) = {} \<and> red_dfs_inv E reachable reds' (onstack - {u0}) | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {}
[PROOF STEP]
from PRE FEI
[PROOF STATE]
proof (chain)
picking this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)
[PROOF STEP]
show OS0[symmetric]: "onstack - {u0} = onstack0"
[PROOF STATE]
proof (prove)
using this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)

goal (1 subgoal):
 1. onstack - {u0} = onstack0
[PROOF STEP]
by (auto simp: pre_def fe_inv_def add_inv_def gen_dfs_pre_def)
[PROOF STATE]
proof (state)
this:
onstack0 = onstack - {u0}

goal (2 subgoals):
 1. gen_dfs_post E reachable onstack0 blues0 u0 blues (init_wit_blue u0 rcyc \<noteq> NO_CYC)
 2. case init_wit_blue u0 rcyc of NO_CYC \<Rightarrow> \<not> (\<exists>v\<in>(blues - (onstack - {u0})) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds' \<subseteq> blues \<and> reds' \<inter> (onstack - {u0}) = {} \<and> red_dfs_inv E reachable reds' (onstack - {u0}) | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {}
[PROOF STEP]
from PRE FEI
[PROOF STATE]
proof (chain)
picking this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)
[PROOF STEP]
have "u0\<in>onstack"
[PROOF STATE]
proof (prove)
using this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)

goal (1 subgoal):
 1. u0 \<in> onstack
[PROOF STEP]
unfolding pre_def gen_dfs_pre_def fe_inv_def gen_dfs_fe_inv_def
[PROOF STATE]
proof (prove)
using this:
case (blues0, reds0, onstack0, u0) of (blues, reds, onstack, u) \<Rightarrow> (E `` reachable \<subseteq> reachable \<and> finite reachable \<and> blues \<subseteq> reachable \<and> u \<in> reachable \<and> E `` (blues - onstack) \<subseteq> blues \<and> u \<notin> blues \<and> onstack \<subseteq> blues \<and> (\<forall>v\<in>onstack. (v, u) \<in> (E \<inter> onstack \<times> UNIV)\<^sup>*)) \<and> add_inv blues reds onstack
case (blues, reds, onstack, NO_CYC) of (blues, reds, onstack, cyc) \<Rightarrow> onstack = insert u0 onstack0 \<and> ((\<not> cyc \<noteq> NO_CYC \<longrightarrow> E `` (blues - insert u0 onstack0) \<subseteq> blues) \<and> E `` {u0} - {} \<subseteq> blues \<and> insert u0 blues0 \<subseteq> blues \<and> blues \<subseteq> insert u0 blues0 \<union> (E - UNIV \<times> insert u0 onstack0)\<^sup>* `` (E `` {u0} - {} - insert u0 onstack0)) \<and> cyc_post blues reds onstack u0 cyc

goal (1 subgoal):
 1. u0 \<in> onstack
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
u0 \<in> onstack

goal (2 subgoals):
 1. gen_dfs_post E reachable onstack0 blues0 u0 blues (init_wit_blue u0 rcyc \<noteq> NO_CYC)
 2. case init_wit_blue u0 rcyc of NO_CYC \<Rightarrow> \<not> (\<exists>v\<in>(blues - (onstack - {u0})) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds' \<subseteq> blues \<and> reds' \<inter> (onstack - {u0}) = {} \<and> red_dfs_inv E reachable reds' (onstack - {u0}) | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {}
[PROOF STEP]
from PRE FEI
[PROOF STATE]
proof (chain)
picking this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)
[PROOF STEP]
show POST: "gen_dfs_post ?E (?E\<^sup>* `` ?V0) onstack0 blues0 u0 blues
        (init_wit_blue u0 rcyc \<noteq> NO_CYC)"
[PROOF STATE]
proof (prove)
using this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)

goal (1 subgoal):
 1. gen_dfs_post E reachable onstack0 blues0 u0 blues (init_wit_blue u0 rcyc \<noteq> NO_CYC)
[PROOF STEP]
by (auto simp: pre_def fe_inv_def intro: gen_dfs_fe_inv_imp_post)
[PROOF STATE]
proof (state)
this:
gen_dfs_post E reachable onstack0 blues0 u0 blues (init_wit_blue u0 rcyc \<noteq> NO_CYC)

goal (1 subgoal):
 1. case init_wit_blue u0 rcyc of NO_CYC \<Rightarrow> \<not> (\<exists>v\<in>(blues - (onstack - {u0})) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds' \<subseteq> blues \<and> reds' \<inter> (onstack - {u0}) = {} \<and> red_dfs_inv E reachable reds' (onstack - {u0}) | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {}
[PROOF STEP]
case 3
[PROOF STATE]
proof (state)
this:

goal (1 subgoal):
 1. case init_wit_blue u0 rcyc of NO_CYC \<Rightarrow> \<not> (\<exists>v\<in>(blues - (onstack - {u0})) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds' \<subseteq> blues \<and> reds' \<inter> (onstack - {u0}) = {} \<and> red_dfs_inv E reachable reds' (onstack - {u0}) | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {}
[PROOF STEP]
from FEI
[PROOF STATE]
proof (chain)
picking this:
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)
[PROOF STEP]
have [simp]: "onstack=insert u0 onstack0"
[PROOF STATE]
proof (prove)
using this:
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)

goal (1 subgoal):
 1. onstack = insert u0 onstack0
[PROOF STEP]
unfolding fe_inv_def
[PROOF STATE]
proof (prove)
using this:
case (blues, reds, onstack, NO_CYC) of (blues, reds, onstack, cyc) \<Rightarrow> onstack = insert u0 onstack0 \<and> gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 {} blues (cyc \<noteq> NO_CYC) \<and> cyc_post blues reds onstack u0 cyc

goal (1 subgoal):
 1. onstack = insert u0 onstack0
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
onstack = insert u0 onstack0

goal (1 subgoal):
 1. case init_wit_blue u0 rcyc of NO_CYC \<Rightarrow> \<not> (\<exists>v\<in>(blues - (onstack - {u0})) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds' \<subseteq> blues \<and> reds' \<inter> (onstack - {u0}) = {} \<and> red_dfs_inv E reachable reds' (onstack - {u0}) | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {}
[PROOF STEP]
from FEI
[PROOF STATE]
proof (chain)
picking this:
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)
[PROOF STEP]
have "u0\<in>blues"
[PROOF STATE]
proof (prove)
using this:
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)

goal (1 subgoal):
 1. u0 \<in> blues
[PROOF STEP]
unfolding fe_inv_def gen_dfs_fe_inv_def
[PROOF STATE]
proof (prove)
using this:
case (blues, reds, onstack, NO_CYC) of (blues, reds, onstack, cyc) \<Rightarrow> onstack = insert u0 onstack0 \<and> ((\<not> cyc \<noteq> NO_CYC \<longrightarrow> E `` (blues - insert u0 onstack0) \<subseteq> blues) \<and> E `` {u0} - {} \<subseteq> blues \<and> insert u0 blues0 \<subseteq> blues \<and> blues \<subseteq> insert u0 blues0 \<union> (E - UNIV \<times> insert u0 onstack0)\<^sup>* `` (E `` {u0} - {} - insert u0 onstack0)) \<and> cyc_post blues reds onstack u0 cyc

goal (1 subgoal):
 1. u0 \<in> blues
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
u0 \<in> blues

goal (1 subgoal):
 1. case init_wit_blue u0 rcyc of NO_CYC \<Rightarrow> \<not> (\<exists>v\<in>(blues - (onstack - {u0})) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds' \<subseteq> blues \<and> reds' \<inter> (onstack - {u0}) = {} \<and> red_dfs_inv E reachable reds' (onstack - {u0}) | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {}
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. case init_wit_blue u0 rcyc of NO_CYC \<Rightarrow> \<not> (\<exists>v\<in>(blues - (onstack - {u0})) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds' \<subseteq> blues \<and> reds' \<inter> (onstack - {u0}) = {} \<and> red_dfs_inv E reachable reds' (onstack - {u0}) | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {}
[PROOF STEP]
apply (cases rcyc)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. rcyc = None \<Longrightarrow> case init_wit_blue u0 rcyc of NO_CYC \<Rightarrow> \<not> (\<exists>v\<in>(blues - (onstack - {u0})) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds' \<subseteq> blues \<and> reds' \<inter> (onstack - {u0}) = {} \<and> red_dfs_inv E reachable reds' (onstack - {u0}) | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {}
 2. \<And>a. rcyc = Some a \<Longrightarrow> case init_wit_blue u0 rcyc of NO_CYC \<Rightarrow> \<not> (\<exists>v\<in>(blues - (onstack - {u0})) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds' \<subseteq> blues \<and> reds' \<inter> (onstack - {u0}) = {} \<and> red_dfs_inv E reachable reds' (onstack - {u0}) | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {}
[PROOF STEP]
apply (simp_all add: split_paired_all)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. rcyc = None \<Longrightarrow> (\<forall>v\<in>(blues - (onstack0 - {u0})) \<inter> F. (v, v) \<notin> E\<^sup>+) \<and> reds' \<subseteq> blues \<and> reds' \<inter> (onstack0 - {u0}) = {} \<and> red_dfs_inv E reachable reds' (onstack0 - {u0})
 2. \<And>a b. rcyc = Some (a, b) \<Longrightarrow> (b = u0 \<longrightarrow> a \<noteq> [] \<and> path E u0 a u0 \<and> set a \<inter> F \<noteq> {}) \<and> (b \<noteq> u0 \<longrightarrow> path E u0 a b \<and> b \<in> onstack0 \<and> (b \<in> F \<or> set a \<inter> F \<noteq> {}))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. rcyc = None \<Longrightarrow> (\<forall>v\<in>(blues - (onstack0 - {u0})) \<inter> F. (v, v) \<notin> E\<^sup>+) \<and> reds' \<subseteq> blues \<and> reds' \<inter> (onstack0 - {u0}) = {} \<and> red_dfs_inv E reachable reds' (onstack0 - {u0})
 2. \<And>a b. rcyc = Some (a, b) \<Longrightarrow> (b = u0 \<longrightarrow> a \<noteq> [] \<and> path E u0 a u0 \<and> set a \<inter> F \<noteq> {}) \<and> (b \<noteq> u0 \<longrightarrow> path E u0 a b \<and> b \<in> onstack0 \<and> (b \<in> F \<or> set a \<inter> F \<noteq> {}))
[PROOF STEP]
assume [simp]: "rcyc=None"
[PROOF STATE]
proof (state)
this:
rcyc = None

goal (2 subgoals):
 1. rcyc = None \<Longrightarrow> (\<forall>v\<in>(blues - (onstack0 - {u0})) \<inter> F. (v, v) \<notin> E\<^sup>+) \<and> reds' \<subseteq> blues \<and> reds' \<inter> (onstack0 - {u0}) = {} \<and> red_dfs_inv E reachable reds' (onstack0 - {u0})
 2. \<And>a b. rcyc = Some (a, b) \<Longrightarrow> (b = u0 \<longrightarrow> a \<noteq> [] \<and> path E u0 a u0 \<and> set a \<inter> F \<noteq> {}) \<and> (b \<noteq> u0 \<longrightarrow> path E u0 a b \<and> b \<in> onstack0 \<and> (b \<in> F \<or> set a \<inter> F \<noteq> {}))
[PROOF STEP]
show "(\<forall>v\<in>(blues - (onstack0 - {u0})) \<inter> ?A. (v, v) \<notin> ?E\<^sup>+) \<and>
          reds' \<subseteq> blues \<and>
          reds' \<inter> (onstack0 - {u0}) = {} \<and>
          red_dfs_inv ?E (?E\<^sup>* `` ?V0) reds' (onstack0 - {u0})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>v\<in>(blues - (onstack0 - {u0})) \<inter> F. (v, v) \<notin> E\<^sup>+) \<and> reds' \<subseteq> blues \<and> reds' \<inter> (onstack0 - {u0}) = {} \<and> red_dfs_inv E reachable reds' (onstack0 - {u0})
[PROOF STEP]
proof (intro conjI)
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<forall>v\<in>(blues - (onstack0 - {u0})) \<inter> F. (v, v) \<notin> E\<^sup>+
 2. reds' \<subseteq> blues
 3. reds' \<inter> (onstack0 - {u0}) = {}
 4. red_dfs_inv E reachable reds' (onstack0 - {u0})
[PROOF STEP]
from SPECR
[PROOF STATE]
proof (chain)
picking this:
case rcyc of None \<Rightarrow> red_dfs_inv E reachable reds' onstack \<and> u0 \<in> reds' \<and> reds' \<subseteq> reds \<union> E\<^sup>* `` {u0} | Some (p, v) \<Rightarrow> v \<in> onstack \<and> p \<noteq> [] \<and> path E u0 p v
[PROOF STEP]
have RINV: "red_dfs_inv ?E ?U reds' onstack"
            and "u0\<in>reds'"
            and REDS'R: "reds' \<subseteq> reds \<union> ?E\<^sup>*``{u0}"
[PROOF STATE]
proof (prove)
using this:
case rcyc of None \<Rightarrow> red_dfs_inv E reachable reds' onstack \<and> u0 \<in> reds' \<and> reds' \<subseteq> reds \<union> E\<^sup>* `` {u0} | Some (p, v) \<Rightarrow> v \<in> onstack \<and> p \<noteq> [] \<and> path E u0 p v

goal (1 subgoal):
 1. red_dfs_inv E reachable reds' onstack &&& u0 \<in> reds' &&& reds' \<subseteq> reds \<union> E\<^sup>* `` {u0}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
red_dfs_inv E reachable reds' onstack
u0 \<in> reds'
reds' \<subseteq> reds \<union> E\<^sup>* `` {u0}

goal (4 subgoals):
 1. \<forall>v\<in>(blues - (onstack0 - {u0})) \<inter> F. (v, v) \<notin> E\<^sup>+
 2. reds' \<subseteq> blues
 3. reds' \<inter> (onstack0 - {u0}) = {}
 4. red_dfs_inv E reachable reds' (onstack0 - {u0})
[PROOF STEP]
from RINV
[PROOF STATE]
proof (chain)
picking this:
red_dfs_inv E reachable reds' onstack
[PROOF STEP]
show
            RINV': "red_dfs_inv ?E (?E\<^sup>* `` ?V0) reds' (onstack0 - {u0})"
[PROOF STATE]
proof (prove)
using this:
red_dfs_inv E reachable reds' onstack

goal (1 subgoal):
 1. red_dfs_inv E reachable reds' (onstack0 - {u0})
[PROOF STEP]
unfolding red_dfs_inv_def
[PROOF STATE]
proof (prove)
using this:
E `` reachable \<subseteq> reachable \<and> finite reachable \<and> reds' \<subseteq> reachable \<and> E `` reds' \<subseteq> reds' \<and> E `` reds' \<inter> onstack = {}

goal (1 subgoal):
 1. E `` reachable \<subseteq> reachable \<and> finite reachable \<and> reds' \<subseteq> reachable \<and> E `` reds' \<subseteq> reds' \<and> E `` reds' \<inter> (onstack0 - {u0}) = {}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
red_dfs_inv E reachable reds' (onstack0 - {u0})

goal (3 subgoals):
 1. \<forall>v\<in>(blues - (onstack0 - {u0})) \<inter> F. (v, v) \<notin> E\<^sup>+
 2. reds' \<subseteq> blues
 3. reds' \<inter> (onstack0 - {u0}) = {}
[PROOF STEP]
from RINV'[unfolded red_dfs_inv_def]
[PROOF STATE]
proof (chain)
picking this:
E `` reachable \<subseteq> reachable \<and> finite reachable \<and> reds' \<subseteq> reachable \<and> E `` reds' \<subseteq> reds' \<and> E `` reds' \<inter> (onstack0 - {u0}) = {}
[PROOF STEP]
have
            REDS'CL: "?E``reds' \<subseteq> reds'"
            and DJ': "?E `` reds' \<inter> (onstack0 - {u0}) = {}"
[PROOF STATE]
proof (prove)
using this:
E `` reachable \<subseteq> reachable \<and> finite reachable \<and> reds' \<subseteq> reachable \<and> E `` reds' \<subseteq> reds' \<and> E `` reds' \<inter> (onstack0 - {u0}) = {}

goal (1 subgoal):
 1. E `` reds' \<subseteq> reds' &&& E `` reds' \<inter> (onstack0 - {u0}) = {}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
E `` reds' \<subseteq> reds'
E `` reds' \<inter> (onstack0 - {u0}) = {}

goal (3 subgoals):
 1. \<forall>v\<in>(blues - (onstack0 - {u0})) \<inter> F. (v, v) \<notin> E\<^sup>+
 2. reds' \<subseteq> blues
 3. reds' \<inter> (onstack0 - {u0}) = {}
[PROOF STEP]
from RINV[unfolded red_dfs_inv_def]
[PROOF STATE]
proof (chain)
picking this:
E `` reachable \<subseteq> reachable \<and> finite reachable \<and> reds' \<subseteq> reachable \<and> E `` reds' \<subseteq> reds' \<and> E `` reds' \<inter> onstack = {}
[PROOF STEP]
have
            DJ: "?E `` reds' \<inter> (onstack) = {}"
[PROOF STATE]
proof (prove)
using this:
E `` reachable \<subseteq> reachable \<and> finite reachable \<and> reds' \<subseteq> reachable \<and> E `` reds' \<subseteq> reds' \<and> E `` reds' \<inter> onstack = {}

goal (1 subgoal):
 1. E `` reds' \<inter> onstack = {}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
E `` reds' \<inter> onstack = {}

goal (3 subgoals):
 1. \<forall>v\<in>(blues - (onstack0 - {u0})) \<inter> F. (v, v) \<notin> E\<^sup>+
 2. reds' \<subseteq> blues
 3. reds' \<inter> (onstack0 - {u0}) = {}
[PROOF STEP]
show "reds' \<subseteq> blues"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. reds' \<subseteq> blues
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. x \<in> reds' \<Longrightarrow> x \<in> blues
[PROOF STEP]
fix v
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. x \<in> reds' \<Longrightarrow> x \<in> blues
[PROOF STEP]
assume "v\<in>reds'"
[PROOF STATE]
proof (state)
this:
v \<in> reds'

goal (1 subgoal):
 1. \<And>x. x \<in> reds' \<Longrightarrow> x \<in> blues
[PROOF STEP]
with REDS'R
[PROOF STATE]
proof (chain)
picking this:
reds' \<subseteq> reds \<union> E\<^sup>* `` {u0}
v \<in> reds'
[PROOF STEP]
have "v\<in>reds \<or> (u0,v)\<in>?E\<^sup>*"
[PROOF STATE]
proof (prove)
using this:
reds' \<subseteq> reds \<union> E\<^sup>* `` {u0}
v \<in> reds'

goal (1 subgoal):
 1. v \<in> reds \<or> (u0, v) \<in> E\<^sup>*
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
v \<in> reds \<or> (u0, v) \<in> E\<^sup>*

goal (1 subgoal):
 1. \<And>x. x \<in> reds' \<Longrightarrow> x \<in> blues
[PROOF STEP]
thus "v\<in>blues"
[PROOF STATE]
proof (prove)
using this:
v \<in> reds \<or> (u0, v) \<in> E\<^sup>*

goal (1 subgoal):
 1. v \<in> blues
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. v \<in> reds \<Longrightarrow> v \<in> blues
 2. (u0, v) \<in> E\<^sup>* \<Longrightarrow> v \<in> blues
[PROOF STEP]
assume "v\<in>reds"
[PROOF STATE]
proof (state)
this:
v \<in> reds

goal (2 subgoals):
 1. v \<in> reds \<Longrightarrow> v \<in> blues
 2. (u0, v) \<in> E\<^sup>* \<Longrightarrow> v \<in> blues
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
v \<in> reds

goal (2 subgoals):
 1. v \<in> reds \<Longrightarrow> v \<in> blues
 2. (u0, v) \<in> E\<^sup>* \<Longrightarrow> v \<in> blues
[PROOF STEP]
with FEI
[PROOF STATE]
proof (chain)
picking this:
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)
v \<in> reds
[PROOF STEP]
have "reds\<subseteq>blues"
[PROOF STATE]
proof (prove)
using this:
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)
v \<in> reds

goal (1 subgoal):
 1. reds \<subseteq> blues
[PROOF STEP]
unfolding fe_inv_def add_inv_def cyc_post_def
[PROOF STATE]
proof (prove)
using this:
case (blues, reds, onstack, NO_CYC) of (blues, reds, onstack, cyc) \<Rightarrow> onstack = insert u0 onstack0 \<and> gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 {} blues (cyc \<noteq> NO_CYC) \<and> (case cyc of NO_CYC \<Rightarrow> \<not> (\<exists>v\<in>(blues - onstack) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds \<subseteq> blues \<and> reds \<inter> onstack = {} \<and> red_dfs_inv E reachable reds onstack | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {})
v \<in> reds

goal (1 subgoal):
 1. reds \<subseteq> blues
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
reds \<subseteq> blues

goal (2 subgoals):
 1. v \<in> reds \<Longrightarrow> v \<in> blues
 2. (u0, v) \<in> E\<^sup>* \<Longrightarrow> v \<in> blues
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
v \<in> reds
reds \<subseteq> blues
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
v \<in> reds
reds \<subseteq> blues

goal (1 subgoal):
 1. v \<in> blues
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
v \<in> blues

goal (1 subgoal):
 1. (u0, v) \<in> E\<^sup>* \<Longrightarrow> v \<in> blues
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (u0, v) \<in> E\<^sup>* \<Longrightarrow> v \<in> blues
[PROOF STEP]
from POST[unfolded gen_dfs_post_def OS0]
[PROOF STATE]
proof (chain)
picking this:
(\<not> init_wit_blue u0 rcyc \<noteq> NO_CYC \<longrightarrow> E `` (blues - (onstack - {u0})) \<subseteq> blues) \<and> u0 \<in> blues \<and> blues0 \<subseteq> blues \<and> blues \<subseteq> blues0 \<union> (E - UNIV \<times> (onstack - {u0}))\<^sup>* `` {u0}
[PROOF STEP]
have
                CL: "?E `` (blues - (onstack0 - {u0})) \<subseteq> blues" and "u0\<in>blues"
[PROOF STATE]
proof (prove)
using this:
(\<not> init_wit_blue u0 rcyc \<noteq> NO_CYC \<longrightarrow> E `` (blues - (onstack - {u0})) \<subseteq> blues) \<and> u0 \<in> blues \<and> blues0 \<subseteq> blues \<and> blues \<subseteq> blues0 \<union> (E - UNIV \<times> (onstack - {u0}))\<^sup>* `` {u0}

goal (1 subgoal):
 1. E `` (blues - (onstack0 - {u0})) \<subseteq> blues &&& u0 \<in> blues
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
E `` (blues - (onstack0 - {u0})) \<subseteq> blues
u0 \<in> blues

goal (1 subgoal):
 1. (u0, v) \<in> E\<^sup>* \<Longrightarrow> v \<in> blues
[PROOF STEP]
from PRE FEI
[PROOF STATE]
proof (chain)
picking this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)
[PROOF STEP]
have "onstack0 \<subseteq> blues"
[PROOF STATE]
proof (prove)
using this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)

goal (1 subgoal):
 1. onstack0 \<subseteq> blues
[PROOF STEP]
unfolding pre_def fe_inv_def gen_dfs_pre_def gen_dfs_fe_inv_def
[PROOF STATE]
proof (prove)
using this:
case (blues0, reds0, onstack0, u0) of (blues, reds, onstack, u) \<Rightarrow> (E `` reachable \<subseteq> reachable \<and> finite reachable \<and> blues \<subseteq> reachable \<and> u \<in> reachable \<and> E `` (blues - onstack) \<subseteq> blues \<and> u \<notin> blues \<and> onstack \<subseteq> blues \<and> (\<forall>v\<in>onstack. (v, u) \<in> (E \<inter> onstack \<times> UNIV)\<^sup>*)) \<and> add_inv blues reds onstack
case (blues, reds, onstack, NO_CYC) of (blues, reds, onstack, cyc) \<Rightarrow> onstack = insert u0 onstack0 \<and> ((\<not> cyc \<noteq> NO_CYC \<longrightarrow> E `` (blues - insert u0 onstack0) \<subseteq> blues) \<and> E `` {u0} - {} \<subseteq> blues \<and> insert u0 blues0 \<subseteq> blues \<and> blues \<subseteq> insert u0 blues0 \<union> (E - UNIV \<times> insert u0 onstack0)\<^sup>* `` (E `` {u0} - {} - insert u0 onstack0)) \<and> cyc_post blues reds onstack u0 cyc

goal (1 subgoal):
 1. onstack0 \<subseteq> blues
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
onstack0 \<subseteq> blues

goal (1 subgoal):
 1. (u0, v) \<in> E\<^sup>* \<Longrightarrow> v \<in> blues
[PROOF STEP]
assume "(u0,v)\<in>?E\<^sup>*"
[PROOF STATE]
proof (state)
this:
(u0, v) \<in> E\<^sup>*

goal (1 subgoal):
 1. (u0, v) \<in> E\<^sup>* \<Longrightarrow> v \<in> blues
[PROOF STEP]
thus "v\<in>blues"
[PROOF STATE]
proof (prove)
using this:
(u0, v) \<in> E\<^sup>*

goal (1 subgoal):
 1. v \<in> blues
[PROOF STEP]
proof (cases rule: rtrancl_last_visit[where S="onstack - {u0}"])
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. (u0, v) \<in> (E - UNIV \<times> (onstack - {u0}))\<^sup>* \<Longrightarrow> v \<in> blues
 2. \<And>qt. \<lbrakk>qt \<in> onstack - {u0}; (u0, qt) \<in> E\<^sup>+; (qt, v) \<in> (E - UNIV \<times> (onstack - {u0}))\<^sup>*\<rbrakk> \<Longrightarrow> v \<in> blues
[PROOF STEP]
case no_visit
[PROOF STATE]
proof (state)
this:
(u0, v) \<in> (E - UNIV \<times> (onstack - {u0}))\<^sup>*

goal (2 subgoals):
 1. (u0, v) \<in> (E - UNIV \<times> (onstack - {u0}))\<^sup>* \<Longrightarrow> v \<in> blues
 2. \<And>qt. \<lbrakk>qt \<in> onstack - {u0}; (u0, qt) \<in> E\<^sup>+; (qt, v) \<in> (E - UNIV \<times> (onstack - {u0}))\<^sup>*\<rbrakk> \<Longrightarrow> v \<in> blues
[PROOF STEP]
thus "v\<in>blues"
[PROOF STATE]
proof (prove)
using this:
(u0, v) \<in> (E - UNIV \<times> (onstack - {u0}))\<^sup>*

goal (1 subgoal):
 1. v \<in> blues
[PROOF STEP]
using \<open>u0\<in>blues\<close> CL
[PROOF STATE]
proof (prove)
using this:
(u0, v) \<in> (E - UNIV \<times> (onstack - {u0}))\<^sup>*
u0 \<in> blues
E `` (blues - (onstack0 - {u0})) \<subseteq> blues

goal (1 subgoal):
 1. v \<in> blues
[PROOF STEP]
by induct (auto elim: rtranclE)
[PROOF STATE]
proof (state)
this:
v \<in> blues

goal (1 subgoal):
 1. \<And>qt. \<lbrakk>qt \<in> onstack - {u0}; (u0, qt) \<in> E\<^sup>+; (qt, v) \<in> (E - UNIV \<times> (onstack - {u0}))\<^sup>*\<rbrakk> \<Longrightarrow> v \<in> blues
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>qt. \<lbrakk>qt \<in> onstack - {u0}; (u0, qt) \<in> E\<^sup>+; (qt, v) \<in> (E - UNIV \<times> (onstack - {u0}))\<^sup>*\<rbrakk> \<Longrightarrow> v \<in> blues
[PROOF STEP]
case (last_visit_point u)
[PROOF STATE]
proof (state)
this:
u \<in> onstack - {u0}
(u0, u) \<in> E\<^sup>+
(u, v) \<in> (E - UNIV \<times> (onstack - {u0}))\<^sup>*

goal (1 subgoal):
 1. \<And>qt. \<lbrakk>qt \<in> onstack - {u0}; (u0, qt) \<in> E\<^sup>+; (qt, v) \<in> (E - UNIV \<times> (onstack - {u0}))\<^sup>*\<rbrakk> \<Longrightarrow> v \<in> blues
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<in> onstack - {u0}
(u0, u) \<in> E\<^sup>+
(u, v) \<in> (E - UNIV \<times> (onstack - {u0}))\<^sup>*
[PROOF STEP]
obtain uh where "(u0,uh)\<in>?E\<^sup>*" and "(uh,u)\<in>?E"
[PROOF STATE]
proof (prove)
using this:
u \<in> onstack - {u0}
(u0, u) \<in> E\<^sup>+
(u, v) \<in> (E - UNIV \<times> (onstack - {u0}))\<^sup>*

goal (1 subgoal):
 1. (\<And>uh. \<lbrakk>(u0, uh) \<in> E\<^sup>*; (uh, u) \<in> E\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis tranclD2)
[PROOF STATE]
proof (state)
this:
(u0, uh) \<in> E\<^sup>*
(uh, u) \<in> E

goal (1 subgoal):
 1. \<And>qt. \<lbrakk>qt \<in> onstack - {u0}; (u0, qt) \<in> E\<^sup>+; (qt, v) \<in> (E - UNIV \<times> (onstack - {u0}))\<^sup>*\<rbrakk> \<Longrightarrow> v \<in> blues
[PROOF STEP]
with REDS'CL DJ' \<open>u0\<in>reds'\<close>
[PROOF STATE]
proof (chain)
picking this:
E `` reds' \<subseteq> reds'
E `` reds' \<inter> (onstack0 - {u0}) = {}
u0 \<in> reds'
(u0, uh) \<in> E\<^sup>*
(uh, u) \<in> E
[PROOF STEP]
have "uh\<in>reds'"
[PROOF STATE]
proof (prove)
using this:
E `` reds' \<subseteq> reds'
E `` reds' \<inter> (onstack0 - {u0}) = {}
u0 \<in> reds'
(u0, uh) \<in> E\<^sup>*
(uh, u) \<in> E

goal (1 subgoal):
 1. uh \<in> reds'
[PROOF STEP]
by (auto dest: Image_closed_trancl)
[PROOF STATE]
proof (state)
this:
uh \<in> reds'

goal (1 subgoal):
 1. \<And>qt. \<lbrakk>qt \<in> onstack - {u0}; (u0, qt) \<in> E\<^sup>+; (qt, v) \<in> (E - UNIV \<times> (onstack - {u0}))\<^sup>*\<rbrakk> \<Longrightarrow> v \<in> blues
[PROOF STEP]
with DJ' \<open>(uh,u)\<in>?E\<close> \<open>u \<in> onstack - {u0}\<close>
[PROOF STATE]
proof (chain)
picking this:
E `` reds' \<inter> (onstack0 - {u0}) = {}
(uh, u) \<in> E
u \<in> onstack - {u0}
uh \<in> reds'
[PROOF STEP]
have False
[PROOF STATE]
proof (prove)
using this:
E `` reds' \<inter> (onstack0 - {u0}) = {}
(uh, u) \<in> E
u \<in> onstack - {u0}
uh \<in> reds'

goal (1 subgoal):
 1. False
[PROOF STEP]
by simp blast
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. \<And>qt. \<lbrakk>qt \<in> onstack - {u0}; (u0, qt) \<in> E\<^sup>+; (qt, v) \<in> (E - UNIV \<times> (onstack - {u0}))\<^sup>*\<rbrakk> \<Longrightarrow> v \<in> blues
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
False

goal (1 subgoal):
 1. v \<in> blues
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
v \<in> blues

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
v \<in> blues

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
v \<in> blues

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
reds' \<subseteq> blues

goal (2 subgoals):
 1. \<forall>v\<in>(blues - (onstack0 - {u0})) \<inter> F. (v, v) \<notin> E\<^sup>+
 2. reds' \<inter> (onstack0 - {u0}) = {}
[PROOF STEP]
show "\<forall>v\<in>(blues - (onstack0 - {u0})) \<inter> ?A. (v, v) \<notin> ?E\<^sup>+"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>v\<in>(blues - (onstack0 - {u0})) \<inter> F. (v, v) \<notin> E\<^sup>+
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>v. v \<in> (blues - (onstack0 - {u0})) \<inter> F \<Longrightarrow> (v, v) \<notin> E\<^sup>+
[PROOF STEP]
fix v
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>v. v \<in> (blues - (onstack0 - {u0})) \<inter> F \<Longrightarrow> (v, v) \<notin> E\<^sup>+
[PROOF STEP]
assume A: "v \<in> (blues - (onstack0 - {u0})) \<inter> ?A"
[PROOF STATE]
proof (state)
this:
v \<in> (blues - (onstack0 - {u0})) \<inter> F

goal (1 subgoal):
 1. \<And>v. v \<in> (blues - (onstack0 - {u0})) \<inter> F \<Longrightarrow> (v, v) \<notin> E\<^sup>+
[PROOF STEP]
show "(v,v)\<notin>?E\<^sup>+"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (v, v) \<notin> E\<^sup>+
[PROOF STEP]
proof (cases "v=u0")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. v = u0 \<Longrightarrow> (v, v) \<notin> E\<^sup>+
 2. v \<noteq> u0 \<Longrightarrow> (v, v) \<notin> E\<^sup>+
[PROOF STEP]
assume "v\<noteq>u0"
[PROOF STATE]
proof (state)
this:
v \<noteq> u0

goal (2 subgoals):
 1. v = u0 \<Longrightarrow> (v, v) \<notin> E\<^sup>+
 2. v \<noteq> u0 \<Longrightarrow> (v, v) \<notin> E\<^sup>+
[PROOF STEP]
with A
[PROOF STATE]
proof (chain)
picking this:
v \<in> (blues - (onstack0 - {u0})) \<inter> F
v \<noteq> u0
[PROOF STEP]
have "v\<in>(blues - (insert u0 onstack)) \<inter> ?A"
[PROOF STATE]
proof (prove)
using this:
v \<in> (blues - (onstack0 - {u0})) \<inter> F
v \<noteq> u0

goal (1 subgoal):
 1. v \<in> (blues - insert u0 onstack) \<inter> F
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
v \<in> (blues - insert u0 onstack) \<inter> F

goal (2 subgoals):
 1. v = u0 \<Longrightarrow> (v, v) \<notin> E\<^sup>+
 2. v \<noteq> u0 \<Longrightarrow> (v, v) \<notin> E\<^sup>+
[PROOF STEP]
with FEI
[PROOF STATE]
proof (chain)
picking this:
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)
v \<in> (blues - insert u0 onstack) \<inter> F
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)
v \<in> (blues - insert u0 onstack) \<inter> F

goal (1 subgoal):
 1. (v, v) \<notin> E\<^sup>+
[PROOF STEP]
unfolding fe_inv_def add_inv_def cyc_post_def
[PROOF STATE]
proof (prove)
using this:
case (blues, reds, onstack, NO_CYC) of (blues, reds, onstack, cyc) \<Rightarrow> onstack = insert u0 onstack0 \<and> gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 {} blues (cyc \<noteq> NO_CYC) \<and> (case cyc of NO_CYC \<Rightarrow> \<not> (\<exists>v\<in>(blues - onstack) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds \<subseteq> blues \<and> reds \<inter> onstack = {} \<and> red_dfs_inv E reachable reds onstack | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {})
v \<in> (blues - insert u0 onstack) \<inter> F

goal (1 subgoal):
 1. (v, v) \<notin> E\<^sup>+
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(v, v) \<notin> E\<^sup>+

goal (1 subgoal):
 1. v = u0 \<Longrightarrow> (v, v) \<notin> E\<^sup>+
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. v = u0 \<Longrightarrow> (v, v) \<notin> E\<^sup>+
[PROOF STEP]
assume [simp]: "v=u0"
[PROOF STATE]
proof (state)
this:
v = u0

goal (1 subgoal):
 1. v = u0 \<Longrightarrow> (v, v) \<notin> E\<^sup>+
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (v, v) \<notin> E\<^sup>+
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (v, v) \<in> E\<^sup>+ \<Longrightarrow> False
[PROOF STEP]
assume "(v,v)\<in>?E\<^sup>+"
[PROOF STATE]
proof (state)
this:
(v, v) \<in> E\<^sup>+

goal (1 subgoal):
 1. (v, v) \<in> E\<^sup>+ \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(v, v) \<in> E\<^sup>+
[PROOF STEP]
obtain uh where "(u0,uh)\<in>?E\<^sup>*" and "(uh,u0)\<in>?E"
[PROOF STATE]
proof (prove)
using this:
(v, v) \<in> E\<^sup>+

goal (1 subgoal):
 1. (\<And>uh. \<lbrakk>(u0, uh) \<in> E\<^sup>*; (uh, u0) \<in> E\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (auto dest: tranclD2)
[PROOF STATE]
proof (state)
this:
(u0, uh) \<in> E\<^sup>*
(uh, u0) \<in> E

goal (1 subgoal):
 1. (v, v) \<in> E\<^sup>+ \<Longrightarrow> False
[PROOF STEP]
with REDS'CL DJ \<open>u0\<in>reds'\<close>
[PROOF STATE]
proof (chain)
picking this:
E `` reds' \<subseteq> reds'
E `` reds' \<inter> onstack = {}
u0 \<in> reds'
(u0, uh) \<in> E\<^sup>*
(uh, u0) \<in> E
[PROOF STEP]
have "uh\<in>reds'"
[PROOF STATE]
proof (prove)
using this:
E `` reds' \<subseteq> reds'
E `` reds' \<inter> onstack = {}
u0 \<in> reds'
(u0, uh) \<in> E\<^sup>*
(uh, u0) \<in> E

goal (1 subgoal):
 1. uh \<in> reds'
[PROOF STEP]
by (auto dest: Image_closed_trancl)
[PROOF STATE]
proof (state)
this:
uh \<in> reds'

goal (1 subgoal):
 1. (v, v) \<in> E\<^sup>+ \<Longrightarrow> False
[PROOF STEP]
with DJ \<open>(uh,u0)\<in>?E\<close> \<open>u0 \<in> onstack\<close>
[PROOF STATE]
proof (chain)
picking this:
E `` reds' \<inter> onstack = {}
(uh, u0) \<in> E
u0 \<in> onstack
uh \<in> reds'
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
E `` reds' \<inter> onstack = {}
(uh, u0) \<in> E
u0 \<in> onstack
uh \<in> reds'

goal (1 subgoal):
 1. False
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(v, v) \<notin> E\<^sup>+

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(v, v) \<notin> E\<^sup>+

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<forall>v\<in>(blues - (onstack0 - {u0})) \<inter> F. (v, v) \<notin> E\<^sup>+

goal (1 subgoal):
 1. reds' \<inter> (onstack0 - {u0}) = {}
[PROOF STEP]
show "reds' \<inter> (onstack0 - {u0}) = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. reds' \<inter> (onstack0 - {u0}) = {}
[PROOF STEP]
proof (rule ccontr)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. reds' \<inter> (onstack0 - {u0}) \<noteq> {} \<Longrightarrow> False
[PROOF STEP]
assume "reds' \<inter> (onstack0 - {u0}) \<noteq> {}"
[PROOF STATE]
proof (state)
this:
reds' \<inter> (onstack0 - {u0}) \<noteq> {}

goal (1 subgoal):
 1. reds' \<inter> (onstack0 - {u0}) \<noteq> {} \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
reds' \<inter> (onstack0 - {u0}) \<noteq> {}
[PROOF STEP]
obtain v where "v\<in>reds'" and "v\<in>onstack0" and "v\<noteq>u0"
[PROOF STATE]
proof (prove)
using this:
reds' \<inter> (onstack0 - {u0}) \<noteq> {}

goal (1 subgoal):
 1. (\<And>v. \<lbrakk>v \<in> reds'; v \<in> onstack0; v \<noteq> u0\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
v \<in> reds'
v \<in> onstack0
v \<noteq> u0

goal (1 subgoal):
 1. reds' \<inter> (onstack0 - {u0}) \<noteq> {} \<Longrightarrow> False
[PROOF STEP]
from \<open>v\<in>reds'\<close> REDS'R
[PROOF STATE]
proof (chain)
picking this:
v \<in> reds'
reds' \<subseteq> reds \<union> E\<^sup>* `` {u0}
[PROOF STEP]
have "v\<in>reds \<or> (u0,v)\<in>?E\<^sup>*"
[PROOF STATE]
proof (prove)
using this:
v \<in> reds'
reds' \<subseteq> reds \<union> E\<^sup>* `` {u0}

goal (1 subgoal):
 1. v \<in> reds \<or> (u0, v) \<in> E\<^sup>*
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
v \<in> reds \<or> (u0, v) \<in> E\<^sup>*

goal (1 subgoal):
 1. reds' \<inter> (onstack0 - {u0}) \<noteq> {} \<Longrightarrow> False
[PROOF STEP]
thus False
[PROOF STATE]
proof (prove)
using this:
v \<in> reds \<or> (u0, v) \<in> E\<^sup>*

goal (1 subgoal):
 1. False
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. v \<in> reds \<Longrightarrow> False
 2. (u0, v) \<in> E\<^sup>* \<Longrightarrow> False
[PROOF STEP]
assume "v\<in>reds"
[PROOF STATE]
proof (state)
this:
v \<in> reds

goal (2 subgoals):
 1. v \<in> reds \<Longrightarrow> False
 2. (u0, v) \<in> E\<^sup>* \<Longrightarrow> False
[PROOF STEP]
with FEI[unfolded fe_inv_def add_inv_def cyc_post_def]
                \<open>v\<in>onstack0\<close>
[PROOF STATE]
proof (chain)
picking this:
case (blues, reds, onstack, NO_CYC) of (blues, reds, onstack, cyc) \<Rightarrow> onstack = insert u0 onstack0 \<and> gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 {} blues (cyc \<noteq> NO_CYC) \<and> (case cyc of NO_CYC \<Rightarrow> \<not> (\<exists>v\<in>(blues - onstack) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds \<subseteq> blues \<and> reds \<inter> onstack = {} \<and> red_dfs_inv E reachable reds onstack | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {})
v \<in> onstack0
v \<in> reds
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
case (blues, reds, onstack, NO_CYC) of (blues, reds, onstack, cyc) \<Rightarrow> onstack = insert u0 onstack0 \<and> gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 {} blues (cyc \<noteq> NO_CYC) \<and> (case cyc of NO_CYC \<Rightarrow> \<not> (\<exists>v\<in>(blues - onstack) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds \<subseteq> blues \<and> reds \<inter> onstack = {} \<and> red_dfs_inv E reachable reds onstack | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {})
v \<in> onstack0
v \<in> reds

goal (1 subgoal):
 1. False
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. (u0, v) \<in> E\<^sup>* \<Longrightarrow> False
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (u0, v) \<in> E\<^sup>* \<Longrightarrow> False
[PROOF STEP]
assume "(u0,v)\<in>?E\<^sup>*"
[PROOF STATE]
proof (state)
this:
(u0, v) \<in> E\<^sup>*

goal (1 subgoal):
 1. (u0, v) \<in> E\<^sup>* \<Longrightarrow> False
[PROOF STEP]
with \<open>v\<noteq>u0\<close>
[PROOF STATE]
proof (chain)
picking this:
v \<noteq> u0
(u0, v) \<in> E\<^sup>*
[PROOF STEP]
obtain uh where "(u0,uh)\<in>?E\<^sup>*" and "(uh,v)\<in>?E"
[PROOF STATE]
proof (prove)
using this:
v \<noteq> u0
(u0, v) \<in> E\<^sup>*

goal (1 subgoal):
 1. (\<And>uh. \<lbrakk>(u0, uh) \<in> E\<^sup>*; (uh, v) \<in> E\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (auto elim: rtranclE)
[PROOF STATE]
proof (state)
this:
(u0, uh) \<in> E\<^sup>*
(uh, v) \<in> E

goal (1 subgoal):
 1. (u0, v) \<in> E\<^sup>* \<Longrightarrow> False
[PROOF STEP]
with REDS'CL DJ \<open>u0\<in>reds'\<close>
[PROOF STATE]
proof (chain)
picking this:
E `` reds' \<subseteq> reds'
E `` reds' \<inter> onstack = {}
u0 \<in> reds'
(u0, uh) \<in> E\<^sup>*
(uh, v) \<in> E
[PROOF STEP]
have "uh\<in>reds'"
[PROOF STATE]
proof (prove)
using this:
E `` reds' \<subseteq> reds'
E `` reds' \<inter> onstack = {}
u0 \<in> reds'
(u0, uh) \<in> E\<^sup>*
(uh, v) \<in> E

goal (1 subgoal):
 1. uh \<in> reds'
[PROOF STEP]
by (auto dest: Image_closed_trancl)
[PROOF STATE]
proof (state)
this:
uh \<in> reds'

goal (1 subgoal):
 1. (u0, v) \<in> E\<^sup>* \<Longrightarrow> False
[PROOF STEP]
with DJ \<open>(uh,v)\<in>?E\<close> \<open>v \<in> onstack0\<close>
[PROOF STATE]
proof (chain)
picking this:
E `` reds' \<inter> onstack = {}
(uh, v) \<in> E
v \<in> onstack0
uh \<in> reds'
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
E `` reds' \<inter> onstack = {}
(uh, v) \<in> E
v \<in> onstack0
uh \<in> reds'

goal (1 subgoal):
 1. False
[PROOF STEP]
by simp blast
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
reds' \<inter> (onstack0 - {u0}) = {}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<forall>v\<in>(blues - (onstack0 - {u0})) \<inter> F. (v, v) \<notin> E\<^sup>+) \<and> reds' \<subseteq> blues \<and> reds' \<inter> (onstack0 - {u0}) = {} \<and> red_dfs_inv E reachable reds' (onstack0 - {u0})

goal (1 subgoal):
 1. \<And>a b. rcyc = Some (a, b) \<Longrightarrow> (b = u0 \<longrightarrow> a \<noteq> [] \<and> path E u0 a u0 \<and> set a \<inter> F \<noteq> {}) \<and> (b \<noteq> u0 \<longrightarrow> path E u0 a b \<and> b \<in> onstack0 \<and> (b \<in> F \<or> set a \<inter> F \<noteq> {}))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a b. rcyc = Some (a, b) \<Longrightarrow> (b = u0 \<longrightarrow> a \<noteq> [] \<and> path E u0 a u0 \<and> set a \<inter> F \<noteq> {}) \<and> (b \<noteq> u0 \<longrightarrow> path E u0 a b \<and> b \<in> onstack0 \<and> (b \<in> F \<or> set a \<inter> F \<noteq> {}))
[PROOF STEP]
fix u p
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a b. rcyc = Some (a, b) \<Longrightarrow> (b = u0 \<longrightarrow> a \<noteq> [] \<and> path E u0 a u0 \<and> set a \<inter> F \<noteq> {}) \<and> (b \<noteq> u0 \<longrightarrow> path E u0 a b \<and> b \<in> onstack0 \<and> (b \<in> F \<or> set a \<inter> F \<noteq> {}))
[PROOF STEP]
assume [simp]: "rcyc = Some (p,u)"
[PROOF STATE]
proof (state)
this:
rcyc = Some (p, u)

goal (1 subgoal):
 1. \<And>a b. rcyc = Some (a, b) \<Longrightarrow> (b = u0 \<longrightarrow> a \<noteq> [] \<and> path E u0 a u0 \<and> set a \<inter> F \<noteq> {}) \<and> (b \<noteq> u0 \<longrightarrow> path E u0 a b \<and> b \<in> onstack0 \<and> (b \<in> F \<or> set a \<inter> F \<noteq> {}))
[PROOF STEP]
show "
          (u = u0 \<longrightarrow> p \<noteq> [] \<and> path ?E u0 p u0 \<and> set p \<inter> ?A \<noteq> {}) \<and>
          (u \<noteq> u0 \<longrightarrow>
              path ?E u0 p u \<and> u \<in> onstack0 \<and> (u \<in> ?A \<or> set p \<inter> ?A \<noteq> {}))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (u = u0 \<longrightarrow> p \<noteq> [] \<and> path E u0 p u0 \<and> set p \<inter> F \<noteq> {}) \<and> (u \<noteq> u0 \<longrightarrow> path E u0 p u \<and> u \<in> onstack0 \<and> (u \<in> F \<or> set p \<inter> F \<noteq> {}))
[PROOF STEP]
proof (intro conjI impI)
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. u = u0 \<Longrightarrow> p \<noteq> []
 2. u = u0 \<Longrightarrow> path E u0 p u0
 3. u = u0 \<Longrightarrow> set p \<inter> F \<noteq> {}
 4. u \<noteq> u0 \<Longrightarrow> path E u0 p u
 5. u \<noteq> u0 \<Longrightarrow> u \<in> onstack0
 6. u \<noteq> u0 \<Longrightarrow> u \<in> F \<or> set p \<inter> F \<noteq> {}
[PROOF STEP]
from SPECR \<open>u0\<in>?A\<close>
[PROOF STATE]
proof (chain)
picking this:
case rcyc of None \<Rightarrow> red_dfs_inv E reachable reds' onstack \<and> u0 \<in> reds' \<and> reds' \<subseteq> reds \<union> E\<^sup>* `` {u0} | Some (p, v) \<Rightarrow> v \<in> onstack \<and> p \<noteq> [] \<and> path E u0 p v
u0 \<in> F
[PROOF STEP]
show
            "u\<noteq>u0 \<Longrightarrow> u\<in>onstack0"
            "p\<noteq>[]"
            "path ?E u0 p u"
            "u=u0 \<Longrightarrow> path ?E u0 p u0"
            "set p \<inter> F \<noteq> {}"
            "u \<in> F \<or> set p \<inter> F \<noteq> {}"
[PROOF STATE]
proof (prove)
using this:
case rcyc of None \<Rightarrow> red_dfs_inv E reachable reds' onstack \<and> u0 \<in> reds' \<and> reds' \<subseteq> reds \<union> E\<^sup>* `` {u0} | Some (p, v) \<Rightarrow> v \<in> onstack \<and> p \<noteq> [] \<and> path E u0 p v
u0 \<in> F

goal (1 subgoal):
 1. ((u \<noteq> u0 \<Longrightarrow> u \<in> onstack0) &&& p \<noteq> [] &&& path E u0 p u) &&& (u = u0 \<Longrightarrow> path E u0 p u0) &&& set p \<inter> F \<noteq> {} &&& u \<in> F \<or> set p \<inter> F \<noteq> {}
[PROOF STEP]
by (auto simp: neq_Nil_conv path_simps)
[PROOF STATE]
proof (state)
this:
u \<noteq> u0 \<Longrightarrow> u \<in> onstack0
p \<noteq> []
path E u0 p u
u = u0 \<Longrightarrow> path E u0 p u0
set p \<inter> F \<noteq> {}
u \<in> F \<or> set p \<inter> F \<noteq> {}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(u = u0 \<longrightarrow> p \<noteq> [] \<and> path E u0 p u0 \<and> set p \<inter> F \<noteq> {}) \<and> (u \<noteq> u0 \<longrightarrow> path E u0 p u \<and> u \<in> onstack0 \<and> (u \<in> F \<or> set p \<inter> F \<noteq> {}))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
case init_wit_blue u0 rcyc of NO_CYC \<Rightarrow> \<not> (\<exists>v\<in>(blues - (onstack - {u0})) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds' \<subseteq> blues \<and> reds' \<inter> (onstack - {u0}) = {} \<and> red_dfs_inv E reachable reds' (onstack - {u0}) | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
post (blues0, reds0, onstack0, u0) (blues, reds', onstack - {u0}, init_wit_blue u0 rcyc)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>pre (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4); fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) {} (?blues4, ?reds4, ?onstack4, NO_CYC); ?u0.4 \<in> F; case ?rcyc4 of None \<Rightarrow> red_dfs_inv E reachable ?reds'4 ?onstack4 \<and> ?u0.4 \<in> ?reds'4 \<and> ?reds'4 \<subseteq> ?reds4 \<union> E\<^sup>* `` {?u0.4} | Some (p, v) \<Rightarrow> v \<in> ?onstack4 \<and> p \<noteq> [] \<and> path E ?u0.4 p v\<rbrakk> \<Longrightarrow> post (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4) (?blues4, ?reds'4, ?onstack4 - {?u0.4}, init_wit_blue ?u0.4 ?rcyc4)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
note RED_IMP_POST = this
[PROOF STATE]
proof (state)
this:
\<lbrakk>pre (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4); fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) {} (?blues4, ?reds4, ?onstack4, NO_CYC); ?u0.4 \<in> F; case ?rcyc4 of None \<Rightarrow> red_dfs_inv E reachable ?reds'4 ?onstack4 \<and> ?u0.4 \<in> ?reds'4 \<and> ?reds'4 \<subseteq> ?reds4 \<union> E\<^sup>* `` {?u0.4} | Some (p, v) \<Rightarrow> v \<in> ?onstack4 \<and> p \<noteq> [] \<and> path E ?u0.4 p v\<rbrakk> \<Longrightarrow> post (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4) (?blues4, ?reds'4, ?onstack4 - {?u0.4}, init_wit_blue ?u0.4 ?rcyc4)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
\<lbrakk>pre (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4); fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) {} (?blues4, ?reds4, ?onstack4, NO_CYC); ?u0.4 \<in> F; case ?rcyc4 of None \<Rightarrow> red_dfs_inv E reachable ?reds'4 ?onstack4 \<and> ?u0.4 \<in> ?reds'4 \<and> ?reds'4 \<subseteq> ?reds4 \<union> E\<^sup>* `` {?u0.4} | Some (p, v) \<Rightarrow> v \<in> ?onstack4 \<and> p \<noteq> [] \<and> path E ?u0.4 p v\<rbrakk> \<Longrightarrow> post (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4) (?blues4, ?reds'4, ?onstack4 - {?u0.4}, init_wit_blue ?u0.4 ?rcyc4)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
fix blues0 reds0 onstack0 u0 blues reds onstack and cyc :: "'v blue_witness"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume PRE: "pre (blues0,reds0,onstack0,u0)"
    and FEI: "fe_inv (insert u0 blues0) u0 (insert u0 onstack0)
        {} (blues,reds,onstack,NO_CYC)"
    and FC[simp]: "cyc=NO_CYC"
    and NCOND: "u0\<notin>?A"
[PROOF STATE]
proof (state)
this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)
cyc = NO_CYC
u0 \<notin> F

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
from PRE FEI
[PROOF STATE]
proof (chain)
picking this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)
[PROOF STEP]
have OS0: "onstack0 = onstack - {u0}"
[PROOF STATE]
proof (prove)
using this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)

goal (1 subgoal):
 1. onstack0 = onstack - {u0}
[PROOF STEP]
by (auto simp: pre_def fe_inv_def add_inv_def gen_dfs_pre_def) []
[PROOF STATE]
proof (state)
this:
onstack0 = onstack - {u0}

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
from PRE FEI
[PROOF STATE]
proof (chain)
picking this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)
[PROOF STEP]
have "u0\<in>onstack"
[PROOF STATE]
proof (prove)
using this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)

goal (1 subgoal):
 1. u0 \<in> onstack
[PROOF STEP]
unfolding pre_def gen_dfs_pre_def fe_inv_def gen_dfs_fe_inv_def
[PROOF STATE]
proof (prove)
using this:
case (blues0, reds0, onstack0, u0) of (blues, reds, onstack, u) \<Rightarrow> (E `` reachable \<subseteq> reachable \<and> finite reachable \<and> blues \<subseteq> reachable \<and> u \<in> reachable \<and> E `` (blues - onstack) \<subseteq> blues \<and> u \<notin> blues \<and> onstack \<subseteq> blues \<and> (\<forall>v\<in>onstack. (v, u) \<in> (E \<inter> onstack \<times> UNIV)\<^sup>*)) \<and> add_inv blues reds onstack
case (blues, reds, onstack, NO_CYC) of (blues, reds, onstack, cyc) \<Rightarrow> onstack = insert u0 onstack0 \<and> ((\<not> cyc \<noteq> NO_CYC \<longrightarrow> E `` (blues - insert u0 onstack0) \<subseteq> blues) \<and> E `` {u0} - {} \<subseteq> blues \<and> insert u0 blues0 \<subseteq> blues \<and> blues \<subseteq> insert u0 blues0 \<union> (E - UNIV \<times> insert u0 onstack0)\<^sup>* `` (E `` {u0} - {} - insert u0 onstack0)) \<and> cyc_post blues reds onstack u0 cyc

goal (1 subgoal):
 1. u0 \<in> onstack
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
u0 \<in> onstack

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
with OS0
[PROOF STATE]
proof (chain)
picking this:
onstack0 = onstack - {u0}
u0 \<in> onstack
[PROOF STEP]
have OS1: "onstack = insert u0 onstack0"
[PROOF STATE]
proof (prove)
using this:
onstack0 = onstack - {u0}
u0 \<in> onstack

goal (1 subgoal):
 1. onstack = insert u0 onstack0
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
onstack = insert u0 onstack0

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
have "post (blues0,reds0,onstack0,u0) (blues,reds,onstack - {u0},NO_CYC)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. post (blues0, reds0, onstack0, u0) (blues, reds, onstack - {u0}, NO_CYC)
[PROOF STEP]
apply (clarsimp simp: post_def cyc_post_def) []
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. onstack - {u0} = onstack0 \<and> gen_dfs_post E reachable onstack0 blues0 u0 blues False \<and> add_inv blues reds (onstack - {u0})
[PROOF STEP]
apply (intro conjI impI)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. onstack - {u0} = onstack0
 2. gen_dfs_post E reachable onstack0 blues0 u0 blues False
 3. add_inv blues reds (onstack - {u0})
[PROOF STEP]
apply (simp add: OS0)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. gen_dfs_post E reachable onstack0 blues0 u0 blues False
 2. add_inv blues reds (onstack - {u0})
[PROOF STEP]
using PRE FEI
[PROOF STATE]
proof (prove)
using this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) {} (blues, reds, onstack, NO_CYC)

goal (2 subgoals):
 1. gen_dfs_post E reachable onstack0 blues0 u0 blues False
 2. add_inv blues reds (onstack - {u0})
[PROOF STEP]
apply (auto
        simp: pre_def fe_inv_def intro: gen_dfs_fe_inv_imp_post) []
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. add_inv blues reds (onstack - {u0})
[PROOF STEP]
using FEI[unfolded fe_inv_def cyc_post_def]
[PROOF STATE]
proof (prove)
using this:
case (blues, reds, onstack, NO_CYC) of (blues, reds, onstack, cyc) \<Rightarrow> onstack = insert u0 onstack0 \<and> gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 {} blues (cyc \<noteq> NO_CYC) \<and> (case cyc of NO_CYC \<Rightarrow> add_inv blues reds onstack | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {})

goal (1 subgoal):
 1. add_inv blues reds (onstack - {u0})
[PROOF STEP]
unfolding add_inv_def
[PROOF STATE]
proof (prove)
using this:
case (blues, reds, onstack, NO_CYC) of (blues, reds, onstack, cyc) \<Rightarrow> onstack = insert u0 onstack0 \<and> gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 {} blues (cyc \<noteq> NO_CYC) \<and> (case cyc of NO_CYC \<Rightarrow> \<not> (\<exists>v\<in>(blues - onstack) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds \<subseteq> blues \<and> reds \<inter> onstack = {} \<and> red_dfs_inv E reachable reds onstack | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {})

goal (1 subgoal):
 1. \<not> (\<exists>v\<in>(blues - (onstack - {u0})) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds \<subseteq> blues \<and> reds \<inter> (onstack - {u0}) = {} \<and> red_dfs_inv E reachable reds (onstack - {u0})
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>onstack = insert u0 onstack0; gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 {} blues False; \<forall>v\<in>(blues - insert u0 onstack0) \<inter> F. (v, v) \<notin> E\<^sup>+; reds \<subseteq> blues; red_dfs_inv E reachable reds (insert u0 onstack0); u0 \<notin> reds; reds \<inter> onstack0 = {}\<rbrakk> \<Longrightarrow> (\<forall>v\<in>(blues - (onstack0 - {u0})) \<inter> F. (v, v) \<notin> E\<^sup>+) \<and> reds \<inter> (onstack0 - {u0}) = {} \<and> red_dfs_inv E reachable reds (onstack0 - {u0})
[PROOF STEP]
apply (intro conjI)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>onstack = insert u0 onstack0; gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 {} blues False; \<forall>v\<in>(blues - insert u0 onstack0) \<inter> F. (v, v) \<notin> E\<^sup>+; reds \<subseteq> blues; red_dfs_inv E reachable reds (insert u0 onstack0); u0 \<notin> reds; reds \<inter> onstack0 = {}\<rbrakk> \<Longrightarrow> \<forall>v\<in>(blues - (onstack0 - {u0})) \<inter> F. (v, v) \<notin> E\<^sup>+
 2. \<lbrakk>onstack = insert u0 onstack0; gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 {} blues False; \<forall>v\<in>(blues - insert u0 onstack0) \<inter> F. (v, v) \<notin> E\<^sup>+; reds \<subseteq> blues; red_dfs_inv E reachable reds (insert u0 onstack0); u0 \<notin> reds; reds \<inter> onstack0 = {}\<rbrakk> \<Longrightarrow> reds \<inter> (onstack0 - {u0}) = {}
 3. \<lbrakk>onstack = insert u0 onstack0; gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 {} blues False; \<forall>v\<in>(blues - insert u0 onstack0) \<inter> F. (v, v) \<notin> E\<^sup>+; reds \<subseteq> blues; red_dfs_inv E reachable reds (insert u0 onstack0); u0 \<notin> reds; reds \<inter> onstack0 = {}\<rbrakk> \<Longrightarrow> red_dfs_inv E reachable reds (onstack0 - {u0})
[PROOF STEP]
using NCOND
[PROOF STATE]
proof (prove)
using this:
u0 \<notin> F

goal (3 subgoals):
 1. \<lbrakk>onstack = insert u0 onstack0; gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 {} blues False; \<forall>v\<in>(blues - insert u0 onstack0) \<inter> F. (v, v) \<notin> E\<^sup>+; reds \<subseteq> blues; red_dfs_inv E reachable reds (insert u0 onstack0); u0 \<notin> reds; reds \<inter> onstack0 = {}\<rbrakk> \<Longrightarrow> \<forall>v\<in>(blues - (onstack0 - {u0})) \<inter> F. (v, v) \<notin> E\<^sup>+
 2. \<lbrakk>onstack = insert u0 onstack0; gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 {} blues False; \<forall>v\<in>(blues - insert u0 onstack0) \<inter> F. (v, v) \<notin> E\<^sup>+; reds \<subseteq> blues; red_dfs_inv E reachable reds (insert u0 onstack0); u0 \<notin> reds; reds \<inter> onstack0 = {}\<rbrakk> \<Longrightarrow> reds \<inter> (onstack0 - {u0}) = {}
 3. \<lbrakk>onstack = insert u0 onstack0; gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 {} blues False; \<forall>v\<in>(blues - insert u0 onstack0) \<inter> F. (v, v) \<notin> E\<^sup>+; reds \<subseteq> blues; red_dfs_inv E reachable reds (insert u0 onstack0); u0 \<notin> reds; reds \<inter> onstack0 = {}\<rbrakk> \<Longrightarrow> red_dfs_inv E reachable reds (onstack0 - {u0})
[PROOF STEP]
apply auto []
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>onstack = insert u0 onstack0; gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 {} blues False; \<forall>v\<in>(blues - insert u0 onstack0) \<inter> F. (v, v) \<notin> E\<^sup>+; reds \<subseteq> blues; red_dfs_inv E reachable reds (insert u0 onstack0); u0 \<notin> reds; reds \<inter> onstack0 = {}\<rbrakk> \<Longrightarrow> reds \<inter> (onstack0 - {u0}) = {}
 2. \<lbrakk>onstack = insert u0 onstack0; gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 {} blues False; \<forall>v\<in>(blues - insert u0 onstack0) \<inter> F. (v, v) \<notin> E\<^sup>+; reds \<subseteq> blues; red_dfs_inv E reachable reds (insert u0 onstack0); u0 \<notin> reds; reds \<inter> onstack0 = {}\<rbrakk> \<Longrightarrow> red_dfs_inv E reachable reds (onstack0 - {u0})
[PROOF STEP]
apply auto []
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>onstack = insert u0 onstack0; gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 {} blues False; \<forall>v\<in>(blues - insert u0 onstack0) \<inter> F. (v, v) \<notin> E\<^sup>+; reds \<subseteq> blues; red_dfs_inv E reachable reds (insert u0 onstack0); u0 \<notin> reds; reds \<inter> onstack0 = {}\<rbrakk> \<Longrightarrow> red_dfs_inv E reachable reds (onstack0 - {u0})
[PROOF STEP]
apply (clarsimp simp: red_dfs_inv_def, blast) []
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
post (blues0, reds0, onstack0, u0) (blues, reds, onstack - {u0}, NO_CYC)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>pre (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4); fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) {} (?blues4, ?reds4, ?onstack4, NO_CYC); ?cyc4 = NO_CYC; ?u0.4 \<notin> F\<rbrakk> \<Longrightarrow> post (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4) (?blues4, ?reds4, ?onstack4 - {?u0.4}, NO_CYC)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
note NCOND_IMP_POST=this
[PROOF STATE]
proof (state)
this:
\<lbrakk>pre (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4); fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) {} (?blues4, ?reds4, ?onstack4, NO_CYC); ?cyc4 = NO_CYC; ?u0.4 \<notin> F\<rbrakk> \<Longrightarrow> post (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4) (?blues4, ?reds4, ?onstack4 - {?u0.4}, NO_CYC)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
\<lbrakk>pre (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4); fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) {} (?blues4, ?reds4, ?onstack4, NO_CYC); ?cyc4 = NO_CYC; ?u0.4 \<notin> F\<rbrakk> \<Longrightarrow> post (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4) (?blues4, ?reds4, ?onstack4 - {?u0.4}, NO_CYC)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
fix blues0 reds0 onstack0 u0 blues reds onstack it
      and cyc :: "'v blue_witness"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume PRE: "pre (blues0,reds0,onstack0,u0)"
    and FEI: "fe_inv (insert u0 blues0) u0 (insert u0 onstack0)
        it (blues,reds,onstack,cyc)"
    and NC: "cyc\<noteq>NO_CYC"
    and IT: "it\<subseteq>?E``{u0}"
[PROOF STATE]
proof (state)
this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) it (blues, reds, onstack, cyc)
cyc \<noteq> NO_CYC
it \<subseteq> E `` {u0}

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
from PRE FEI
[PROOF STATE]
proof (chain)
picking this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) it (blues, reds, onstack, cyc)
[PROOF STEP]
have OS0: "onstack0 = onstack - {u0}"
[PROOF STATE]
proof (prove)
using this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) it (blues, reds, onstack, cyc)

goal (1 subgoal):
 1. onstack0 = onstack - {u0}
[PROOF STEP]
by (auto simp: pre_def fe_inv_def add_inv_def gen_dfs_pre_def) []
[PROOF STATE]
proof (state)
this:
onstack0 = onstack - {u0}

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
from PRE FEI
[PROOF STATE]
proof (chain)
picking this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) it (blues, reds, onstack, cyc)
[PROOF STEP]
have "u0\<in>onstack"
[PROOF STATE]
proof (prove)
using this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) it (blues, reds, onstack, cyc)

goal (1 subgoal):
 1. u0 \<in> onstack
[PROOF STEP]
unfolding pre_def gen_dfs_pre_def fe_inv_def gen_dfs_fe_inv_def
[PROOF STATE]
proof (prove)
using this:
case (blues0, reds0, onstack0, u0) of (blues, reds, onstack, u) \<Rightarrow> (E `` reachable \<subseteq> reachable \<and> finite reachable \<and> blues \<subseteq> reachable \<and> u \<in> reachable \<and> E `` (blues - onstack) \<subseteq> blues \<and> u \<notin> blues \<and> onstack \<subseteq> blues \<and> (\<forall>v\<in>onstack. (v, u) \<in> (E \<inter> onstack \<times> UNIV)\<^sup>*)) \<and> add_inv blues reds onstack
case (blues, reds, onstack, cyc) of (blues, reds, onstack, cyc) \<Rightarrow> onstack = insert u0 onstack0 \<and> ((\<not> cyc \<noteq> NO_CYC \<longrightarrow> E `` (blues - insert u0 onstack0) \<subseteq> blues) \<and> E `` {u0} - it \<subseteq> blues \<and> insert u0 blues0 \<subseteq> blues \<and> blues \<subseteq> insert u0 blues0 \<union> (E - UNIV \<times> insert u0 onstack0)\<^sup>* `` (E `` {u0} - it - insert u0 onstack0)) \<and> cyc_post blues reds onstack u0 cyc

goal (1 subgoal):
 1. u0 \<in> onstack
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
u0 \<in> onstack

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
with OS0
[PROOF STATE]
proof (chain)
picking this:
onstack0 = onstack - {u0}
u0 \<in> onstack
[PROOF STEP]
have OS1: "onstack = insert u0 onstack0"
[PROOF STATE]
proof (prove)
using this:
onstack0 = onstack - {u0}
u0 \<in> onstack

goal (1 subgoal):
 1. onstack = insert u0 onstack0
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
onstack = insert u0 onstack0

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
have "post (blues0,reds0,onstack0,u0) (blues,reds,onstack - {u0},cyc)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. post (blues0, reds0, onstack0, u0) (blues, reds, onstack - {u0}, cyc)
[PROOF STEP]
apply (clarsimp simp: post_def) []
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. onstack - {u0} = onstack0 \<and> gen_dfs_post E reachable onstack0 blues0 u0 blues (cyc \<noteq> NO_CYC) \<and> cyc_post blues reds (onstack - {u0}) u0 cyc
[PROOF STEP]
apply (intro conjI impI)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. onstack - {u0} = onstack0
 2. gen_dfs_post E reachable onstack0 blues0 u0 blues (cyc \<noteq> NO_CYC)
 3. cyc_post blues reds (onstack - {u0}) u0 cyc
[PROOF STEP]
apply (simp add: OS0)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. gen_dfs_post E reachable onstack0 blues0 u0 blues (cyc \<noteq> NO_CYC)
 2. cyc_post blues reds (onstack - {u0}) u0 cyc
[PROOF STEP]
using PRE FEI IT NC
[PROOF STATE]
proof (prove)
using this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) it (blues, reds, onstack, cyc)
it \<subseteq> E `` {u0}
cyc \<noteq> NO_CYC

goal (2 subgoals):
 1. gen_dfs_post E reachable onstack0 blues0 u0 blues (cyc \<noteq> NO_CYC)
 2. cyc_post blues reds (onstack - {u0}) u0 cyc
[PROOF STEP]
apply (auto
        simp: pre_def fe_inv_def intro: gen_dfs_fe_imp_post_brk) []
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cyc_post blues reds (onstack - {u0}) u0 cyc
[PROOF STEP]
using FEI[unfolded fe_inv_def] NC
[PROOF STATE]
proof (prove)
using this:
case (blues, reds, onstack, cyc) of (blues, reds, onstack, cyc) \<Rightarrow> onstack = insert u0 onstack0 \<and> gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 it blues (cyc \<noteq> NO_CYC) \<and> cyc_post blues reds onstack u0 cyc
cyc \<noteq> NO_CYC

goal (1 subgoal):
 1. cyc_post blues reds (onstack - {u0}) u0 cyc
[PROOF STEP]
unfolding cyc_post_def
[PROOF STATE]
proof (prove)
using this:
case (blues, reds, onstack, cyc) of (blues, reds, onstack, cyc) \<Rightarrow> onstack = insert u0 onstack0 \<and> gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 it blues (cyc \<noteq> NO_CYC) \<and> (case cyc of NO_CYC \<Rightarrow> add_inv blues reds onstack | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {})
cyc \<noteq> NO_CYC

goal (1 subgoal):
 1. case cyc of NO_CYC \<Rightarrow> add_inv blues reds (onstack - {u0}) | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {}
[PROOF STEP]
apply (auto split: blue_witness.split simp: OS1) []
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
post (blues0, reds0, onstack0, u0) (blues, reds, onstack - {u0}, cyc)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>pre (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4); fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) ?it4 (?blues4, ?reds4, ?onstack4, ?cyc4); ?cyc4 \<noteq> NO_CYC; ?it4 \<subseteq> E `` {?u0.4}\<rbrakk> \<Longrightarrow> post (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4) (?blues4, ?reds4, ?onstack4 - {?u0.4}, ?cyc4)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
note BREAK_IMP_POST = this
[PROOF STATE]
proof (state)
this:
\<lbrakk>pre (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4); fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) ?it4 (?blues4, ?reds4, ?onstack4, ?cyc4); ?cyc4 \<noteq> NO_CYC; ?it4 \<subseteq> E `` {?u0.4}\<rbrakk> \<Longrightarrow> post (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4) (?blues4, ?reds4, ?onstack4 - {?u0.4}, ?cyc4)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
\<lbrakk>pre (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4); fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) ?it4 (?blues4, ?reds4, ?onstack4, ?cyc4); ?cyc4 \<noteq> NO_CYC; ?it4 \<subseteq> E `` {?u0.4}\<rbrakk> \<Longrightarrow> post (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4) (?blues4, ?reds4, ?onstack4 - {?u0.4}, ?cyc4)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
fix blues0 reds0 onstack0 and u0::'v  and
      blues reds onstack cyc it t
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume PRE: "pre (blues0,reds0,onstack0,u0)"
[PROOF STATE]
proof (state)
this:
pre (blues0, reds0, onstack0, u0)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume FEI: "fe_inv (insert u0 blues0) u0 (insert u0 onstack0)
        it (blues,reds,onstack,NO_CYC)"
[PROOF STATE]
proof (state)
this:
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) it (blues, reds, onstack, NO_CYC)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume IT: "it\<subseteq>?E``{u0}" "t\<in>it"
[PROOF STATE]
proof (state)
this:
it \<subseteq> E `` {u0}
t \<in> it

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume T_OS: "t \<in> onstack"
[PROOF STATE]
proof (state)
this:
t \<in> onstack

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume U0ACC: "u0\<in>F \<or> t\<in>F"
[PROOF STATE]
proof (state)
this:
u0 \<in> F \<or> t \<in> F

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
from T_OS
[PROOF STATE]
proof (chain)
picking this:
t \<in> onstack
[PROOF STEP]
have TIB: "t \<in> blues"
[PROOF STATE]
proof (prove)
using this:
t \<in> onstack

goal (1 subgoal):
 1. t \<in> blues
[PROOF STEP]
using PRE FEI
[PROOF STATE]
proof (prove)
using this:
t \<in> onstack
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) it (blues, reds, onstack, NO_CYC)

goal (1 subgoal):
 1. t \<in> blues
[PROOF STEP]
by (auto simp add: fe_inv_def pre_def gen_dfs_fe_inv_def gen_dfs_pre_def)
[PROOF STATE]
proof (state)
this:
t \<in> blues

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
have "fe_inv (insert u0 blues0) u0 (insert u0 onstack0) (it - {t})
      (blues,reds,onstack,init_wit_blue_early u0 t)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fe_inv (insert u0 blues0) u0 (insert u0 onstack0) (it - {t}) (blues, reds, onstack, init_wit_blue_early u0 t)
[PROOF STEP]
unfolding fe_inv_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. case (blues, reds, onstack, init_wit_blue_early u0 t) of (blues, reds, onstack, cyc) \<Rightarrow> onstack = insert u0 onstack0 \<and> gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 (it - {t}) blues (cyc \<noteq> NO_CYC) \<and> cyc_post blues reds onstack u0 cyc
[PROOF STEP]
apply (clarsimp simp: it_step_insert_iff[OF IT])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. onstack = insert u0 onstack0 \<and> gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 (it - {t}) blues (init_wit_blue_early u0 t \<noteq> NO_CYC) \<and> cyc_post blues reds onstack u0 (init_wit_blue_early u0 t)
[PROOF STEP]
apply (intro conjI)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. onstack = insert u0 onstack0
 2. gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 (it - {t}) blues (init_wit_blue_early u0 t \<noteq> NO_CYC)
 3. cyc_post blues reds onstack u0 (init_wit_blue_early u0 t)
[PROOF STEP]
using PRE FEI
[PROOF STATE]
proof (prove)
using this:
pre (blues0, reds0, onstack0, u0)
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) it (blues, reds, onstack, NO_CYC)

goal (3 subgoals):
 1. onstack = insert u0 onstack0
 2. gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 (it - {t}) blues (init_wit_blue_early u0 t \<noteq> NO_CYC)
 3. cyc_post blues reds onstack u0 (init_wit_blue_early u0 t)
[PROOF STEP]
apply (simp add: fe_inv_def pre_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 (it - {t}) blues (init_wit_blue_early u0 t \<noteq> NO_CYC)
 2. cyc_post blues reds onstack u0 (init_wit_blue_early u0 t)
[PROOF STEP]
(* TODO: This is a generic early-break condition. However, it requires
        t \<in> V. Do we really need such a strict invar in case of break? *)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 (it - {t}) blues (init_wit_blue_early u0 t \<noteq> NO_CYC)
 2. cyc_post blues reds onstack u0 (init_wit_blue_early u0 t)
[PROOF STEP]
using FEI TIB
[PROOF STATE]
proof (prove)
using this:
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) it (blues, reds, onstack, NO_CYC)
t \<in> blues

goal (2 subgoals):
 1. gen_dfs_fe_inv E reachable (insert u0 onstack0) (insert u0 blues0) u0 (it - {t}) blues (init_wit_blue_early u0 t \<noteq> NO_CYC)
 2. cyc_post blues reds onstack u0 (init_wit_blue_early u0 t)
[PROOF STEP]
apply (auto simp add: fe_inv_def gen_dfs_fe_inv_def) []
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cyc_post blues reds onstack u0 (init_wit_blue_early u0 t)
[PROOF STEP]
unfolding cyc_post_def init_wit_blue_early_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. case if u0 = t then CIRC [] [u0] else REACH t [u0] of NO_CYC \<Rightarrow> add_inv blues reds onstack | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {}
[PROOF STEP]
using IT T_OS U0ACC
[PROOF STATE]
proof (prove)
using this:
it \<subseteq> E `` {u0}
t \<in> it
t \<in> onstack
u0 \<in> F \<or> t \<in> F

goal (1 subgoal):
 1. case if u0 = t then CIRC [] [u0] else REACH t [u0] of NO_CYC \<Rightarrow> add_inv blues reds onstack | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {}
[PROOF STEP]
apply (auto simp: path_simps) []
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
fe_inv (insert u0 blues0) u0 (insert u0 onstack0) (it - {t}) (blues, reds, onstack, init_wit_blue_early u0 t)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>pre (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4); fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) ?it4 (?blues4, ?reds4, ?onstack4, NO_CYC); ?it4 \<subseteq> E `` {?u0.4}; ?t4 \<in> ?it4; ?t4 \<in> ?onstack4; ?u0.4 \<in> F \<or> ?t4 \<in> F\<rbrakk> \<Longrightarrow> fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) (?it4 - {?t4}) (?blues4, ?reds4, ?onstack4, init_wit_blue_early ?u0.4 ?t4)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
note EARLY_DET_OPT = this
[PROOF STATE]
proof (state)
this:
\<lbrakk>pre (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4); fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) ?it4 (?blues4, ?reds4, ?onstack4, NO_CYC); ?it4 \<subseteq> E `` {?u0.4}; ?t4 \<in> ?it4; ?t4 \<in> ?onstack4; ?u0.4 \<in> F \<or> ?t4 \<in> F\<rbrakk> \<Longrightarrow> fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) (?it4 - {?t4}) (?blues4, ?reds4, ?onstack4, init_wit_blue_early ?u0.4 ?t4)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
\<lbrakk>pre (?blues0.4, ?reds0.4, ?onstack0.4, ?u0.4); fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) ?it4 (?blues4, ?reds4, ?onstack4, NO_CYC); ?it4 \<subseteq> E `` {?u0.4}; ?t4 \<in> ?it4; ?t4 \<in> ?onstack4; ?u0.4 \<in> F \<or> ?t4 \<in> F\<rbrakk> \<Longrightarrow> fe_inv (insert ?u0.4 ?blues0.4) ?u0.4 (insert ?u0.4 ?onstack0.4) (?it4 - {?t4}) (?blues4, ?reds4, ?onstack4, init_wit_blue_early ?u0.4 ?t4)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
fix \<sigma>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume INV0: "pre \<sigma>"
[PROOF STATE]
proof (state)
this:
pre \<sigma>

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
have "REC\<^sub>T (blue_dfs_body G) \<sigma> \<le> SPEC (post \<sigma>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. REC\<^sub>T (blue_dfs_body G) \<sigma> \<le> SPEC (post \<sigma>)
[PROOF STEP]
apply (intro refine_vcg
        RECT_rule[where pre="pre"
        and V="gen_dfs_var ?U <*lex*> {}"]
      )
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. trimono (blue_dfs_body G)
 2. wf (gen_dfs_var reachable <*lex*> {})
 3. pre \<sigma>
 4. \<And>f x. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f\<rbrakk> \<Longrightarrow> blue_dfs_body G f x \<le> SPEC (post x)
[PROOF STEP]
apply (unfold blue_dfs_body_def, refine_mono) []
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. wf (gen_dfs_var reachable <*lex*> {})
 2. pre \<sigma>
 3. \<And>f x. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f\<rbrakk> \<Longrightarrow> blue_dfs_body G f x \<le> SPEC (post x)
[PROOF STEP]
apply (blast intro!: fin_U_imp_wf finitely_reachable)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. pre \<sigma>
 2. \<And>f x. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f\<rbrakk> \<Longrightarrow> blue_dfs_body G f x \<le> SPEC (post x)
[PROOF STEP]
apply (rule INV0)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>f x. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f\<rbrakk> \<Longrightarrow> blue_dfs_body G f x \<le> SPEC (post x)
[PROOF STEP]
(* Body *)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>f x. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f\<rbrakk> \<Longrightarrow> blue_dfs_body G f x \<le> SPEC (post x)
[PROOF STEP]
apply (simp (no_asm) only: blue_dfs_body_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>f x. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f\<rbrakk> \<Longrightarrow> (case x of (blues, reds, onstack, s) \<Rightarrow> let blues = insert s blues; onstack = insert s onstack; s_acc = s \<in> F in NDFS_SI_Statistics.vis_blue_nres \<bind> (\<lambda>_. FOREACH\<^sub>C (E `` {s}) (\<lambda>(uu_, uu_, uu_, cyc). cyc = NO_CYC) (\<lambda>t (blues, reds, onstack, cyc). if t \<in> onstack \<and> (s_acc \<or> t \<in> F) then RETURN (blues, reds, onstack, init_wit_blue_early s t) else if t \<notin> blues then f (blues, reds, onstack, t) \<bind> (\<lambda>(blues, reds, onstack, cyc). RETURN (blues, reds, onstack, prep_wit_blue s cyc)) else NDFS_SI_Statistics.match_blue_nres \<bind> (\<lambda>_. RETURN (blues, reds, onstack, cyc))) (blues, reds, onstack, NO_CYC) \<bind> (\<lambda>(blues, reds, onstack, cyc). (if cyc = NO_CYC \<and> s_acc then red_dfs E onstack reds s \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue s rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {s} in RETURN (blues, reds, onstack, cyc))))) \<le> SPEC (post x)
[PROOF STEP]
apply (refine_rcg refine_vcg)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>f x a b aa ba ab bb. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb)\<rbrakk> \<Longrightarrow> FOREACH\<^sub>C (E `` {bb}) (\<lambda>(uu_, uu_, uu_, cyc). cyc = NO_CYC) (\<lambda>t (blues, reds, onstack, cyc). if t \<in> onstack \<and> (bb \<in> F \<or> t \<in> F) then RETURN (blues, reds, onstack, init_wit_blue_early bb t) else if t \<notin> blues then f (blues, reds, onstack, t) \<bind> (\<lambda>(blues, reds, onstack, cyc). RETURN (blues, reds, onstack, prep_wit_blue bb cyc)) else NDFS_SI_Statistics.match_blue_nres \<bind> (\<lambda>_. RETURN (blues, reds, onstack, cyc))) (insert bb a, aa, insert bb ab, NO_CYC) \<le> SPEC (\<lambda>xa. (case xa of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x))
[PROOF STEP]
(* Foreach loop *)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>f x a b aa ba ab bb. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb)\<rbrakk> \<Longrightarrow> FOREACH\<^sub>C (E `` {bb}) (\<lambda>(uu_, uu_, uu_, cyc). cyc = NO_CYC) (\<lambda>t (blues, reds, onstack, cyc). if t \<in> onstack \<and> (bb \<in> F \<or> t \<in> F) then RETURN (blues, reds, onstack, init_wit_blue_early bb t) else if t \<notin> blues then f (blues, reds, onstack, t) \<bind> (\<lambda>(blues, reds, onstack, cyc). RETURN (blues, reds, onstack, prep_wit_blue bb cyc)) else NDFS_SI_Statistics.match_blue_nres \<bind> (\<lambda>_. RETURN (blues, reds, onstack, cyc))) (insert bb a, aa, insert bb ab, NO_CYC) \<le> SPEC (\<lambda>xa. (case xa of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x))
[PROOF STEP]
apply (rule_tac
        I="fe_inv (insert bb a) bb (insert bb ab)"
        in FOREACHc_rule')
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>f x a b aa ba ab bb. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb)\<rbrakk> \<Longrightarrow> finite (E `` {bb})
 2. \<And>f x a b aa ba ab bb. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb)\<rbrakk> \<Longrightarrow> fe_inv (insert bb a) bb (insert bb ab) (E `` {bb}) (insert bb a, aa, insert bb ab, NO_CYC)
 3. \<And>f x a b aa ba ab bb xa it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> if xa \<in> onstack \<and> (bb \<in> F \<or> xa \<in> F) then RETURN (blues, reds, onstack, init_wit_blue_early bb xa) else if xa \<notin> blues then f (blues, reds, onstack, xa) \<bind> (\<lambda>(blues, reds, onstack, cyc). RETURN (blues, reds, onstack, prep_wit_blue bb cyc)) else NDFS_SI_Statistics.match_blue_nres \<bind> (\<lambda>_. RETURN (blues, reds, onstack, cyc))) \<le> SPEC (fe_inv (insert bb a) bb (insert bb ab) (it - {xa}))
 4. \<And>f x a b aa ba ab bb \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
 5. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
apply (auto simp add: pre_def gen_dfs_pre_imp_fin) []
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>f x a b aa ba ab bb. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb)\<rbrakk> \<Longrightarrow> fe_inv (insert bb a) bb (insert bb ab) (E `` {bb}) (insert bb a, aa, insert bb ab, NO_CYC)
 2. \<And>f x a b aa ba ab bb xa it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> if xa \<in> onstack \<and> (bb \<in> F \<or> xa \<in> F) then RETURN (blues, reds, onstack, init_wit_blue_early bb xa) else if xa \<notin> blues then f (blues, reds, onstack, xa) \<bind> (\<lambda>(blues, reds, onstack, cyc). RETURN (blues, reds, onstack, prep_wit_blue bb cyc)) else NDFS_SI_Statistics.match_blue_nres \<bind> (\<lambda>_. RETURN (blues, reds, onstack, cyc))) \<le> SPEC (fe_inv (insert bb a) bb (insert bb ab) (it - {xa}))
 3. \<And>f x a b aa ba ab bb \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
 4. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
apply (blast intro: PRE_IMP_FE)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>f x a b aa ba ab bb xa it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> if xa \<in> onstack \<and> (bb \<in> F \<or> xa \<in> F) then RETURN (blues, reds, onstack, init_wit_blue_early bb xa) else if xa \<notin> blues then f (blues, reds, onstack, xa) \<bind> (\<lambda>(blues, reds, onstack, cyc). RETURN (blues, reds, onstack, prep_wit_blue bb cyc)) else NDFS_SI_Statistics.match_blue_nres \<bind> (\<lambda>_. RETURN (blues, reds, onstack, cyc))) \<le> SPEC (fe_inv (insert bb a) bb (insert bb ab) (it - {xa}))
 2. \<And>f x a b aa ba ab bb \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
 3. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
apply (intro refine_vcg)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)\<rbrakk> \<Longrightarrow> fe_inv (insert bb a) bb (insert bb ab) (it - {xa}) (ac, ad, ae, init_wit_blue_early bb xa)
 2. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); xa \<notin> ac\<rbrakk> \<Longrightarrow> f (ac, ad, ae, xa) \<le> SPEC (\<lambda>x. (case x of (blues, reds, onstack, cyc) \<Rightarrow> RETURN (blues, reds, onstack, prep_wit_blue bb cyc)) \<le> SPEC (fe_inv (insert bb a) bb (insert bb ab) (it - {xa})))
 3. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); \<not> xa \<notin> ac\<rbrakk> \<Longrightarrow> fe_inv (insert bb a) bb (insert bb ab) (it - {xa}) (ac, ad, ae, be)
 4. \<And>f x a b aa ba ab bb \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
 5. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
(* Early detection of cycles *)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)\<rbrakk> \<Longrightarrow> fe_inv (insert bb a) bb (insert bb ab) (it - {xa}) (ac, ad, ae, init_wit_blue_early bb xa)
 2. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); xa \<notin> ac\<rbrakk> \<Longrightarrow> f (ac, ad, ae, xa) \<le> SPEC (\<lambda>x. (case x of (blues, reds, onstack, cyc) \<Rightarrow> RETURN (blues, reds, onstack, prep_wit_blue bb cyc)) \<le> SPEC (fe_inv (insert bb a) bb (insert bb ab) (it - {xa})))
 3. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); \<not> xa \<notin> ac\<rbrakk> \<Longrightarrow> fe_inv (insert bb a) bb (insert bb ab) (it - {xa}) (ac, ad, ae, be)
 4. \<And>f x a b aa ba ab bb \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
 5. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
apply (blast intro: EARLY_DET_OPT)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); xa \<notin> ac\<rbrakk> \<Longrightarrow> f (ac, ad, ae, xa) \<le> SPEC (\<lambda>x. (case x of (blues, reds, onstack, cyc) \<Rightarrow> RETURN (blues, reds, onstack, prep_wit_blue bb cyc)) \<le> SPEC (fe_inv (insert bb a) bb (insert bb ab) (it - {xa})))
 2. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); \<not> xa \<notin> ac\<rbrakk> \<Longrightarrow> fe_inv (insert bb a) bb (insert bb ab) (it - {xa}) (ac, ad, ae, be)
 3. \<And>f x a b aa ba ab bb \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
 4. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
(* Recursive call *)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); xa \<notin> ac\<rbrakk> \<Longrightarrow> f (ac, ad, ae, xa) \<le> SPEC (\<lambda>x. (case x of (blues, reds, onstack, cyc) \<Rightarrow> RETURN (blues, reds, onstack, prep_wit_blue bb cyc)) \<le> SPEC (fe_inv (insert bb a) bb (insert bb ab) (it - {xa})))
 2. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); \<not> xa \<notin> ac\<rbrakk> \<Longrightarrow> fe_inv (insert bb a) bb (insert bb ab) (it - {xa}) (ac, ad, ae, be)
 3. \<And>f x a b aa ba ab bb \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
 4. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
apply (rule order_trans)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); xa \<notin> ac\<rbrakk> \<Longrightarrow> f (ac, ad, ae, xa) \<le> ?y717 f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be
 2. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); xa \<notin> ac\<rbrakk> \<Longrightarrow> ?y717 f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be \<le> SPEC (\<lambda>x. (case x of (blues, reds, onstack, cyc) \<Rightarrow> RETURN (blues, reds, onstack, prep_wit_blue bb cyc)) \<le> SPEC (fe_inv (insert bb a) bb (insert bb ab) (it - {xa})))
 3. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); \<not> xa \<notin> ac\<rbrakk> \<Longrightarrow> fe_inv (insert bb a) bb (insert bb ab) (it - {xa}) (ac, ad, ae, be)
 4. \<And>f x a b aa ba ab bb \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
 5. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
apply (rprems)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); xa \<notin> ac\<rbrakk> \<Longrightarrow> pre (ac, ad, ae, xa)
 2. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); xa \<notin> ac\<rbrakk> \<Longrightarrow> ((ac, ad, ae, xa), x) \<in> gen_dfs_var reachable <*lex*> {}
 3. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); xa \<notin> ac\<rbrakk> \<Longrightarrow> SPEC (post (ac, ad, ae, xa)) \<le> SPEC (\<lambda>x. (case x of (blues, reds, onstack, cyc) \<Rightarrow> RETURN (blues, reds, onstack, prep_wit_blue bb cyc)) \<le> SPEC (fe_inv (insert bb a) bb (insert bb ab) (it - {xa})))
 4. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); \<not> xa \<notin> ac\<rbrakk> \<Longrightarrow> fe_inv (insert bb a) bb (insert bb ab) (it - {xa}) (ac, ad, ae, be)
 5. \<And>f x a b aa ba ab bb \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
 6. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
apply (clarsimp simp add: pre_def fe_inv_def cyc_post_def)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>ac aaa aba bba xa it aca ada. \<lbrakk>xa \<in> it; it \<subseteq> E `` {bba}; xa \<noteq> bba \<and> xa \<notin> aba \<or> bba \<notin> F \<and> xa \<notin> F; xa \<notin> aca; gen_dfs_pre E reachable aba ac bba; add_inv ac aaa aba; gen_dfs_fe_inv E reachable (insert bba aba) (insert bba ac) bba it aca False; add_inv aca ada (insert bba aba)\<rbrakk> \<Longrightarrow> gen_dfs_pre E reachable (insert bba aba) aca xa
 2. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); xa \<notin> ac\<rbrakk> \<Longrightarrow> ((ac, ad, ae, xa), x) \<in> gen_dfs_var reachable <*lex*> {}
 3. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); xa \<notin> ac\<rbrakk> \<Longrightarrow> SPEC (post (ac, ad, ae, xa)) \<le> SPEC (\<lambda>x. (case x of (blues, reds, onstack, cyc) \<Rightarrow> RETURN (blues, reds, onstack, prep_wit_blue bb cyc)) \<le> SPEC (fe_inv (insert bb a) bb (insert bb ab) (it - {xa})))
 4. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); \<not> xa \<notin> ac\<rbrakk> \<Longrightarrow> fe_inv (insert bb a) bb (insert bb ab) (it - {xa}) (ac, ad, ae, be)
 5. \<And>f x a b aa ba ab bb \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
 6. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
apply (rule gen_dfs_fe_inv_imp_pre, assumption+) []
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); xa \<notin> ac\<rbrakk> \<Longrightarrow> ((ac, ad, ae, xa), x) \<in> gen_dfs_var reachable <*lex*> {}
 2. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); xa \<notin> ac\<rbrakk> \<Longrightarrow> SPEC (post (ac, ad, ae, xa)) \<le> SPEC (\<lambda>x. (case x of (blues, reds, onstack, cyc) \<Rightarrow> RETURN (blues, reds, onstack, prep_wit_blue bb cyc)) \<le> SPEC (fe_inv (insert bb a) bb (insert bb ab) (it - {xa})))
 3. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); \<not> xa \<notin> ac\<rbrakk> \<Longrightarrow> fe_inv (insert bb a) bb (insert bb ab) (it - {xa}) (ac, ad, ae, be)
 4. \<And>f x a b aa ba ab bb \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
 5. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
apply (auto simp add: pre_def fe_inv_def intro: gen_dfs_fe_inv_imp_var) []
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); xa \<notin> ac\<rbrakk> \<Longrightarrow> SPEC (post (ac, ad, ae, xa)) \<le> SPEC (\<lambda>x. (case x of (blues, reds, onstack, cyc) \<Rightarrow> RETURN (blues, reds, onstack, prep_wit_blue bb cyc)) \<le> SPEC (fe_inv (insert bb a) bb (insert bb ab) (it - {xa})))
 2. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); \<not> xa \<notin> ac\<rbrakk> \<Longrightarrow> fe_inv (insert bb a) bb (insert bb ab) (it - {xa}) (ac, ad, ae, be)
 3. \<And>f x a b aa ba ab bb \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
 4. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
apply (auto intro: FE_INV_PRES) []
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>f x a b aa ba ab bb xa it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); xa \<in> it; it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (xa \<in> ae \<and> (bb \<in> F \<or> xa \<in> F)); \<not> xa \<notin> ac\<rbrakk> \<Longrightarrow> fe_inv (insert bb a) bb (insert bb ab) (it - {xa}) (ac, ad, ae, be)
 2. \<And>f x a b aa ba ab bb \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
 3. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
apply (auto simp add: pre_def post_def fe_inv_def
        intro: gen_dfs_fe_inv_pres_visited) []
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>f x a b aa ba ab bb \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
 2. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
apply (intro refine_vcg)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); be = NO_CYC \<and> bb \<in> F\<rbrakk> \<Longrightarrow> red_dfs E ae ad bb \<le> SPEC (\<lambda>xa. (case xa of (reds, rcyc) \<Rightarrow> RETURN (reds, init_wit_blue bb rcyc)) \<le> SPEC (\<lambda>xa. (case xa of (reds, cyc) \<Rightarrow> let onstack = ae - {bb} in RETURN (ac, reds, onstack, cyc)) \<le> SPEC (post x)))
 2. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be af bf. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (be = NO_CYC \<and> bb \<in> F); (ad, be) = (af, bf)\<rbrakk> \<Longrightarrow> post x (ac, af, ae - {bb}, bf)
 3. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
(* Nested DFS call *)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); be = NO_CYC \<and> bb \<in> F\<rbrakk> \<Longrightarrow> red_dfs E ae ad bb \<le> SPEC (\<lambda>xa. (case xa of (reds, rcyc) \<Rightarrow> RETURN (reds, init_wit_blue bb rcyc)) \<le> SPEC (\<lambda>xa. (case xa of (reds, cyc) \<Rightarrow> let onstack = ae - {bb} in RETURN (ac, reds, onstack, cyc)) \<le> SPEC (post x)))
 2. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be af bf. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (be = NO_CYC \<and> bb \<in> F); (ad, be) = (af, bf)\<rbrakk> \<Longrightarrow> post x (ac, af, ae - {bb}, bf)
 3. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
apply (rule order_trans)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); be = NO_CYC \<and> bb \<in> F\<rbrakk> \<Longrightarrow> red_dfs E ae ad bb \<le> ?y1703 f x a b aa ba ab bb \<sigma> ac bc ad bd ae be
 2. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); be = NO_CYC \<and> bb \<in> F\<rbrakk> \<Longrightarrow> ?y1703 f x a b aa ba ab bb \<sigma> ac bc ad bd ae be \<le> SPEC (\<lambda>xa. (case xa of (reds, rcyc) \<Rightarrow> RETURN (reds, init_wit_blue bb rcyc)) \<le> SPEC (\<lambda>xa. (case xa of (reds, cyc) \<Rightarrow> let onstack = ae - {bb} in RETURN (ac, reds, onstack, cyc)) \<le> SPEC (post x)))
 3. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be af bf. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (be = NO_CYC \<and> bb \<in> F); (ad, be) = (af, bf)\<rbrakk> \<Longrightarrow> post x (ac, af, ae - {bb}, bf)
 4. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
apply (rule red_dfs_correct[where U="?E\<^sup>* `` ?V0"])
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); be = NO_CYC \<and> bb \<in> F\<rbrakk> \<Longrightarrow> red_dfs_inv E reachable ad ae
 2. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); be = NO_CYC \<and> bb \<in> F\<rbrakk> \<Longrightarrow> bb \<in> reachable
 3. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); be = NO_CYC \<and> bb \<in> F\<rbrakk> \<Longrightarrow> bb \<notin> ad
 4. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); be = NO_CYC \<and> bb \<in> F\<rbrakk> \<Longrightarrow> SPEC (\<lambda>(reds', cyc). case cyc of None \<Rightarrow> red_dfs_inv E reachable reds' ae \<and> bb \<in> reds' \<and> reds' \<subseteq> ad \<union> E\<^sup>* `` {bb} | Some (p, v) \<Rightarrow> v \<in> ae \<and> p \<noteq> [] \<and> path E bb p v) \<le> SPEC (\<lambda>xa. (case xa of (reds, rcyc) \<Rightarrow> RETURN (reds, init_wit_blue bb rcyc)) \<le> SPEC (\<lambda>xa. (case xa of (reds, cyc) \<Rightarrow> let onstack = ae - {bb} in RETURN (ac, reds, onstack, cyc)) \<le> SPEC (post x)))
 5. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be af bf. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (be = NO_CYC \<and> bb \<in> F); (ad, be) = (af, bf)\<rbrakk> \<Longrightarrow> post x (ac, af, ae - {bb}, bf)
 6. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
apply (auto simp add: fe_inv_def add_inv_def cyc_post_def) []
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); be = NO_CYC \<and> bb \<in> F\<rbrakk> \<Longrightarrow> bb \<in> reachable
 2. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); be = NO_CYC \<and> bb \<in> F\<rbrakk> \<Longrightarrow> bb \<notin> ad
 3. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); be = NO_CYC \<and> bb \<in> F\<rbrakk> \<Longrightarrow> SPEC (\<lambda>(reds', cyc). case cyc of None \<Rightarrow> red_dfs_inv E reachable reds' ae \<and> bb \<in> reds' \<and> reds' \<subseteq> ad \<union> E\<^sup>* `` {bb} | Some (p, v) \<Rightarrow> v \<in> ae \<and> p \<noteq> [] \<and> path E bb p v) \<le> SPEC (\<lambda>xa. (case xa of (reds, rcyc) \<Rightarrow> RETURN (reds, init_wit_blue bb rcyc)) \<le> SPEC (\<lambda>xa. (case xa of (reds, cyc) \<Rightarrow> let onstack = ae - {bb} in RETURN (ac, reds, onstack, cyc)) \<le> SPEC (post x)))
 4. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be af bf. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (be = NO_CYC \<and> bb \<in> F); (ad, be) = (af, bf)\<rbrakk> \<Longrightarrow> post x (ac, af, ae - {bb}, bf)
 5. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
apply (auto intro: PRE_IMP_REACH) []
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); be = NO_CYC \<and> bb \<in> F\<rbrakk> \<Longrightarrow> bb \<notin> ad
 2. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); be = NO_CYC \<and> bb \<in> F\<rbrakk> \<Longrightarrow> SPEC (\<lambda>(reds', cyc). case cyc of None \<Rightarrow> red_dfs_inv E reachable reds' ae \<and> bb \<in> reds' \<and> reds' \<subseteq> ad \<union> E\<^sup>* `` {bb} | Some (p, v) \<Rightarrow> v \<in> ae \<and> p \<noteq> [] \<and> path E bb p v) \<le> SPEC (\<lambda>xa. (case xa of (reds, rcyc) \<Rightarrow> RETURN (reds, init_wit_blue bb rcyc)) \<le> SPEC (\<lambda>xa. (case xa of (reds, cyc) \<Rightarrow> let onstack = ae - {bb} in RETURN (ac, reds, onstack, cyc)) \<le> SPEC (post x)))
 3. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be af bf. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (be = NO_CYC \<and> bb \<in> F); (ad, be) = (af, bf)\<rbrakk> \<Longrightarrow> post x (ac, af, ae - {bb}, bf)
 4. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
apply (auto dest: FE_IMP_RED_PRE) []
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); be = NO_CYC \<and> bb \<in> F\<rbrakk> \<Longrightarrow> SPEC (\<lambda>(reds', cyc). case cyc of None \<Rightarrow> red_dfs_inv E reachable reds' ae \<and> bb \<in> reds' \<and> reds' \<subseteq> ad \<union> E\<^sup>* `` {bb} | Some (p, v) \<Rightarrow> v \<in> ae \<and> p \<noteq> [] \<and> path E bb p v) \<le> SPEC (\<lambda>xa. (case xa of (reds, rcyc) \<Rightarrow> RETURN (reds, init_wit_blue bb rcyc)) \<le> SPEC (\<lambda>xa. (case xa of (reds, cyc) \<Rightarrow> let onstack = ae - {bb} in RETURN (ac, reds, onstack, cyc)) \<le> SPEC (post x)))
 2. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be af bf. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (be = NO_CYC \<and> bb \<in> F); (ad, be) = (af, bf)\<rbrakk> \<Longrightarrow> post x (ac, af, ae - {bb}, bf)
 3. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
apply (intro refine_vcg)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be xa af bf ag bg. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); be = NO_CYC \<and> bb \<in> F; case xa of (reds', None) \<Rightarrow> red_dfs_inv E reachable reds' ae \<and> bb \<in> reds' \<and> reds' \<subseteq> ad \<union> E\<^sup>* `` {bb} | (reds', Some (p, v)) \<Rightarrow> v \<in> ae \<and> p \<noteq> [] \<and> path E bb p v; xa = (af, bf); (af, init_wit_blue bb bf) = (ag, bg)\<rbrakk> \<Longrightarrow> post x (ac, ag, ae - {bb}, bg)
 2. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be af bf. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (be = NO_CYC \<and> bb \<in> F); (ad, be) = (af, bf)\<rbrakk> \<Longrightarrow> post x (ac, af, ae - {bb}, bf)
 3. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>ac aaa aba bba aca ada aea bfa aga. \<lbrakk>\<And>a aa ab b. \<lbrakk>pre (a, aa, ab, b); (a, ac) \<in> gen_dfs_var reachable\<rbrakk> \<Longrightarrow> REC\<^sub>T (blue_dfs_body G) (a, aa, ab, b) \<le> SPEC (post (a, aa, ab, b)); pre (ac, aaa, aba, bba); fe_inv (insert bba ac) bba (insert bba aba) {} (aca, ada, aea, NO_CYC); bba \<in> F; case bfa of None \<Rightarrow> red_dfs_inv E reachable aga aea \<and> bba \<in> aga \<and> aga \<subseteq> ada \<union> E\<^sup>* `` {bba} | Some (p, v) \<Rightarrow> v \<in> aea \<and> p \<noteq> [] \<and> path E bba p v\<rbrakk> \<Longrightarrow> post (ac, aaa, aba, bba) (aca, aga, aea - {bba}, init_wit_blue bba bfa)
 2. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be af bf. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (be = NO_CYC \<and> bb \<in> F); (ad, be) = (af, bf)\<rbrakk> \<Longrightarrow> post x (ac, af, ae - {bb}, bf)
 3. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
apply (rule RED_IMP_POST, assumption+) []
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>f x a b aa ba ab bb \<sigma> ac bc ad bd ae be af bf. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); fe_inv (insert bb a) bb (insert bb ab) {} \<sigma>; case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (be = NO_CYC \<and> bb \<in> F); (ad, be) = (af, bf)\<rbrakk> \<Longrightarrow> post x (ac, af, ae - {bb}, bf)
 2. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
apply (clarsimp, blast intro: NCOND_IMP_POST) []
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>f x a b aa ba ab bb it \<sigma>. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC)\<rbrakk> \<Longrightarrow> (case \<sigma> of (blues, reds, onstack, cyc) \<Rightarrow> (if cyc = NO_CYC \<and> bb \<in> F then red_dfs E onstack reds bb \<bind> (\<lambda>(reds, rcyc). RETURN (reds, init_wit_blue bb rcyc)) else RETURN (reds, cyc)) \<bind> (\<lambda>(reds, cyc). let onstack = onstack - {bb} in RETURN (blues, reds, onstack, cyc))) \<le> SPEC (post x)
[PROOF STEP]
apply (intro refine_vcg)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>f x a b aa ba ab bb it \<sigma> ac bc ad bd ae be. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC); \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); be = NO_CYC \<and> bb \<in> F\<rbrakk> \<Longrightarrow> red_dfs E ae ad bb \<le> SPEC (\<lambda>xa. (case xa of (reds, rcyc) \<Rightarrow> RETURN (reds, init_wit_blue bb rcyc)) \<le> SPEC (\<lambda>xa. (case xa of (reds, cyc) \<Rightarrow> let onstack = ae - {bb} in RETURN (ac, reds, onstack, cyc)) \<le> SPEC (post x)))
 2. \<And>f x a b aa ba ab bb it \<sigma> ac bc ad bd ae be af bf. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC); \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (be = NO_CYC \<and> bb \<in> F); (ad, be) = (af, bf)\<rbrakk> \<Longrightarrow> post x (ac, af, ae - {bb}, bf)
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>f x a b aa ba ab bb it \<sigma> ac bc ad bd ae be af bf. \<lbrakk>\<And>x'. \<lbrakk>pre x'; (x', x) \<in> gen_dfs_var reachable <*lex*> {}\<rbrakk> \<Longrightarrow> f x' \<le> SPEC (post x'); pre x; REC\<^sub>T (blue_dfs_body G) = f; x = (a, b); b = (aa, ba); ba = (ab, bb); it \<subseteq> E `` {bb}; fe_inv (insert bb a) bb (insert bb ab) it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, uub_, cyc) \<Rightarrow> cyc = NO_CYC); \<sigma> = (ac, bc); bc = (ad, bd); bd = (ae, be); \<not> (be = NO_CYC \<and> bb \<in> F); (ad, be) = (af, bf)\<rbrakk> \<Longrightarrow> post x (ac, af, ae - {bb}, bf)
[PROOF STEP]
apply (clarsimp, blast intro: BREAK_IMP_POST) []
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
REC\<^sub>T (blue_dfs_body G) \<sigma> \<le> SPEC (post \<sigma>)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
pre ?\<sigma>4 \<Longrightarrow> REC\<^sub>T (blue_dfs_body G) ?\<sigma>4 \<le> SPEC (post ?\<sigma>4)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
note GEN=this
[PROOF STATE]
proof (state)
this:
pre ?\<sigma>4 \<Longrightarrow> REC\<^sub>T (blue_dfs_body G) ?\<sigma>4 \<le> SPEC (post ?\<sigma>4)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
pre ?\<sigma>4 \<Longrightarrow> REC\<^sub>T (blue_dfs_body G) ?\<sigma>4 \<le> SPEC (post ?\<sigma>4)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
fix v0 it blues reds
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume "v0 \<in> it" "it \<subseteq> V0" "v0 \<notin> blues"
      "outer_inv it (blues, reds, NO_CYC)"
[PROOF STATE]
proof (state)
this:
v0 \<in> it
it \<subseteq> V0
v0 \<notin> blues
outer_inv it (blues, reds, NO_CYC)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
hence "pre (blues, reds, {}, v0)"
[PROOF STATE]
proof (prove)
using this:
v0 \<in> it
it \<subseteq> V0
v0 \<notin> blues
outer_inv it (blues, reds, NO_CYC)

goal (1 subgoal):
 1. pre (blues, reds, {}, v0)
[PROOF STEP]
unfolding pre_def outer_inv_def
[PROOF STATE]
proof (prove)
using this:
v0 \<in> it
it \<subseteq> V0
v0 \<notin> blues
case (blues, reds, NO_CYC) of (blues, reds, NO_CYC) \<Rightarrow> add_inv blues reds {} \<and> gen_dfs_outer E reachable V0 it blues False | (blues, reds, REACH v list) \<Rightarrow> False | (blues, reds, CIRC pr pl) \<Rightarrow> \<exists>v0\<in>V0. \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E v0 pr v \<and> set pl \<inter> F \<noteq> {}

goal (1 subgoal):
 1. case (blues, reds, {}, v0) of (blues, reds, onstack, u) \<Rightarrow> gen_dfs_pre E reachable onstack blues u \<and> add_inv blues reds onstack
[PROOF STEP]
by (auto intro: gen_dfs_pre_initial)
[PROOF STATE]
proof (state)
this:
pre (blues, reds, {}, v0)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>?v0.4 \<in> ?it4; ?it4 \<subseteq> V0; ?v0.4 \<notin> ?blues4; outer_inv ?it4 (?blues4, ?reds4, NO_CYC)\<rbrakk> \<Longrightarrow> pre (?blues4, ?reds4, {}, ?v0.4)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
note OUTER_IMP_PRE = this
[PROOF STATE]
proof (state)
this:
\<lbrakk>?v0.4 \<in> ?it4; ?it4 \<subseteq> V0; ?v0.4 \<notin> ?blues4; outer_inv ?it4 (?blues4, ?reds4, NO_CYC)\<rbrakk> \<Longrightarrow> pre (?blues4, ?reds4, {}, ?v0.4)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
\<lbrakk>?v0.4 \<in> ?it4; ?it4 \<subseteq> V0; ?v0.4 \<notin> ?blues4; outer_inv ?it4 (?blues4, ?reds4, NO_CYC)\<rbrakk> \<Longrightarrow> pre (?blues4, ?reds4, {}, ?v0.4)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
fix v0 it blues0 reds0 blues reds onstack cyc
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume "v0 \<in> it" "it \<subseteq> V0" "v0 \<notin> blues0"
      "outer_inv it (blues0, reds0, NO_CYC)"
      "post (blues0, reds0, {}, v0) (blues, reds, onstack, cyc)"
[PROOF STATE]
proof (state)
this:
v0 \<in> it
it \<subseteq> V0
v0 \<notin> blues0
outer_inv it (blues0, reds0, NO_CYC)
post (blues0, reds0, {}, v0) (blues, reds, onstack, cyc)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
hence "outer_inv (it - {v0}) (blues, reds, cyc)"
[PROOF STATE]
proof (prove)
using this:
v0 \<in> it
it \<subseteq> V0
v0 \<notin> blues0
outer_inv it (blues0, reds0, NO_CYC)
post (blues0, reds0, {}, v0) (blues, reds, onstack, cyc)

goal (1 subgoal):
 1. outer_inv (it - {v0}) (blues, reds, cyc)
[PROOF STEP]
unfolding post_def outer_inv_def cyc_post_def
[PROOF STATE]
proof (prove)
using this:
v0 \<in> it
it \<subseteq> V0
v0 \<notin> blues0
case (blues0, reds0, NO_CYC) of (blues, reds, NO_CYC) \<Rightarrow> add_inv blues reds {} \<and> gen_dfs_outer E reachable V0 it blues False | (blues, reds, REACH v list) \<Rightarrow> False | (blues, reds, CIRC pr pl) \<Rightarrow> \<exists>v0\<in>V0. \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E v0 pr v \<and> set pl \<inter> F \<noteq> {}
(case (blues0, reds0, {}, v0) of (blues0, reds0, onstack0, u0) \<Rightarrow> \<lambda>(blues, reds, onstack, cyc). onstack = onstack0 \<and> gen_dfs_post E reachable onstack0 blues0 u0 blues (cyc \<noteq> NO_CYC) \<and> (case cyc of NO_CYC \<Rightarrow> add_inv blues reds onstack | REACH u p \<Rightarrow> path E u0 p u \<and> u \<in> onstack - {u0} \<and> insert u (set p) \<inter> F \<noteq> {} | CIRC pr pl \<Rightarrow> \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E u0 pr v \<and> set pl \<inter> F \<noteq> {})) (blues, reds, onstack, cyc)

goal (1 subgoal):
 1. case (blues, reds, cyc) of (blues, reds, NO_CYC) \<Rightarrow> add_inv blues reds {} \<and> gen_dfs_outer E reachable V0 (it - {v0}) blues False | (blues, reds, REACH v list) \<Rightarrow> False | (blues, reds, CIRC pr pl) \<Rightarrow> \<exists>v0\<in>V0. \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E v0 pr v \<and> set pl \<inter> F \<noteq> {}
[PROOF STEP]
by (fastforce split: blue_witness.split intro: gen_dfs_post_imp_outer)
[PROOF STATE]
proof (state)
this:
outer_inv (it - {v0}) (blues, reds, cyc)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>?v0.4 \<in> ?it4; ?it4 \<subseteq> V0; ?v0.4 \<notin> ?blues0.4; outer_inv ?it4 (?blues0.4, ?reds0.4, NO_CYC); post (?blues0.4, ?reds0.4, {}, ?v0.4) (?blues4, ?reds4, ?onstack4, ?cyc4)\<rbrakk> \<Longrightarrow> outer_inv (?it4 - {?v0.4}) (?blues4, ?reds4, ?cyc4)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
note POST_IMP_OUTER = this
[PROOF STATE]
proof (state)
this:
\<lbrakk>?v0.4 \<in> ?it4; ?it4 \<subseteq> V0; ?v0.4 \<notin> ?blues0.4; outer_inv ?it4 (?blues0.4, ?reds0.4, NO_CYC); post (?blues0.4, ?reds0.4, {}, ?v0.4) (?blues4, ?reds4, ?onstack4, ?cyc4)\<rbrakk> \<Longrightarrow> outer_inv (?it4 - {?v0.4}) (?blues4, ?reds4, ?cyc4)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
\<lbrakk>?v0.4 \<in> ?it4; ?it4 \<subseteq> V0; ?v0.4 \<notin> ?blues0.4; outer_inv ?it4 (?blues0.4, ?reds0.4, NO_CYC); post (?blues0.4, ?reds0.4, {}, ?v0.4) (?blues4, ?reds4, ?onstack4, ?cyc4)\<rbrakk> \<Longrightarrow> outer_inv (?it4 - {?v0.4}) (?blues4, ?reds4, ?cyc4)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
fix v0 it blues reds
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume "v0 \<in> it" "it \<subseteq> V0" "outer_inv it (blues, reds, NO_CYC)"
      "v0 \<in> blues"
[PROOF STATE]
proof (state)
this:
v0 \<in> it
it \<subseteq> V0
outer_inv it (blues, reds, NO_CYC)
v0 \<in> blues

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
hence "outer_inv (it - {v0}) (blues, reds, NO_CYC)"
[PROOF STATE]
proof (prove)
using this:
v0 \<in> it
it \<subseteq> V0
outer_inv it (blues, reds, NO_CYC)
v0 \<in> blues

goal (1 subgoal):
 1. outer_inv (it - {v0}) (blues, reds, NO_CYC)
[PROOF STEP]
unfolding outer_inv_def
[PROOF STATE]
proof (prove)
using this:
v0 \<in> it
it \<subseteq> V0
case (blues, reds, NO_CYC) of (blues, reds, NO_CYC) \<Rightarrow> add_inv blues reds {} \<and> gen_dfs_outer E reachable V0 it blues False | (blues, reds, REACH v list) \<Rightarrow> False | (blues, reds, CIRC pr pl) \<Rightarrow> \<exists>v0\<in>V0. \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E v0 pr v \<and> set pl \<inter> F \<noteq> {}
v0 \<in> blues

goal (1 subgoal):
 1. case (blues, reds, NO_CYC) of (blues, reds, NO_CYC) \<Rightarrow> add_inv blues reds {} \<and> gen_dfs_outer E reachable V0 (it - {v0}) blues False | (blues, reds, REACH v list) \<Rightarrow> False | (blues, reds, CIRC pr pl) \<Rightarrow> \<exists>v0\<in>V0. \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E v0 pr v \<and> set pl \<inter> F \<noteq> {}
[PROOF STEP]
by (auto intro: gen_dfs_outer_already_vis)
[PROOF STATE]
proof (state)
this:
outer_inv (it - {v0}) (blues, reds, NO_CYC)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>?v0.4 \<in> ?it4; ?it4 \<subseteq> V0; outer_inv ?it4 (?blues4, ?reds4, NO_CYC); ?v0.4 \<in> ?blues4\<rbrakk> \<Longrightarrow> outer_inv (?it4 - {?v0.4}) (?blues4, ?reds4, NO_CYC)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
note OUTER_ALREX = this
[PROOF STATE]
proof (state)
this:
\<lbrakk>?v0.4 \<in> ?it4; ?it4 \<subseteq> V0; outer_inv ?it4 (?blues4, ?reds4, NO_CYC); ?v0.4 \<in> ?blues4\<rbrakk> \<Longrightarrow> outer_inv (?it4 - {?v0.4}) (?blues4, ?reds4, NO_CYC)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
\<lbrakk>?v0.4 \<in> ?it4; ?it4 \<subseteq> V0; outer_inv ?it4 (?blues4, ?reds4, NO_CYC); ?v0.4 \<in> ?blues4\<rbrakk> \<Longrightarrow> outer_inv (?it4 - {?v0.4}) (?blues4, ?reds4, NO_CYC)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
fix it blues reds cyc
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume "outer_inv it (blues, reds, cyc)" "cyc \<noteq> NO_CYC"
[PROOF STATE]
proof (state)
this:
outer_inv it (blues, reds, cyc)
cyc \<noteq> NO_CYC

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
hence "case extract_res cyc of
        None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L
      | Some x \<Rightarrow> is_lasso_prpl x"
[PROOF STATE]
proof (prove)
using this:
outer_inv it (blues, reds, cyc)
cyc \<noteq> NO_CYC

goal (1 subgoal):
 1. case extract_res cyc of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x
[PROOF STEP]
unfolding outer_inv_def extract_res_def is_lasso_prpl_def
        is_lasso_prpl_pre_def
[PROOF STATE]
proof (prove)
using this:
case (blues, reds, cyc) of (blues, reds, NO_CYC) \<Rightarrow> add_inv blues reds {} \<and> gen_dfs_outer E reachable V0 it blues False | (blues, reds, REACH v list) \<Rightarrow> False | (blues, reds, CIRC pr pl) \<Rightarrow> \<exists>v0\<in>V0. \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E v0 pr v \<and> set pl \<inter> F \<noteq> {}
cyc \<noteq> NO_CYC

goal (1 subgoal):
 1. case case cyc of NO_CYC \<Rightarrow> None | REACH v x \<Rightarrow> Map.empty x | CIRC pr pl \<Rightarrow> Some (pr, pl) of None \<Rightarrow> \<forall>L. \<not> ((case L of (pr, pl) \<Rightarrow> \<exists>v0 va. v0 \<in> V0 \<and> pl \<noteq> [] \<and> path E v0 pr va \<and> path E va pl va) \<and> set (snd L) \<inter> F \<noteq> {}) | Some x \<Rightarrow> (case x of (pr, pl) \<Rightarrow> \<exists>v0 va. v0 \<in> V0 \<and> pl \<noteq> [] \<and> path E v0 pr va \<and> path E va pl va) \<and> set (snd x) \<inter> F \<noteq> {}
[PROOF STEP]
apply (cases cyc)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>case (blues, reds, cyc) of (blues, reds, NO_CYC) \<Rightarrow> add_inv blues reds {} \<and> gen_dfs_outer E reachable V0 it blues False | (blues, reds, REACH v list) \<Rightarrow> False | (blues, reds, CIRC pr pl) \<Rightarrow> \<exists>v0\<in>V0. \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E v0 pr v \<and> set pl \<inter> F \<noteq> {}; cyc \<noteq> NO_CYC; cyc = NO_CYC\<rbrakk> \<Longrightarrow> case case cyc of NO_CYC \<Rightarrow> None | REACH v x \<Rightarrow> Map.empty x | CIRC pr pl \<Rightarrow> Some (pr, pl) of None \<Rightarrow> \<forall>L. \<not> ((case L of (pr, pl) \<Rightarrow> \<exists>v0 va. v0 \<in> V0 \<and> pl \<noteq> [] \<and> path E v0 pr va \<and> path E va pl va) \<and> set (snd L) \<inter> F \<noteq> {}) | Some x \<Rightarrow> (case x of (pr, pl) \<Rightarrow> \<exists>v0 va. v0 \<in> V0 \<and> pl \<noteq> [] \<and> path E v0 pr va \<and> path E va pl va) \<and> set (snd x) \<inter> F \<noteq> {}
 2. \<And>x21 x22. \<lbrakk>case (blues, reds, cyc) of (blues, reds, NO_CYC) \<Rightarrow> add_inv blues reds {} \<and> gen_dfs_outer E reachable V0 it blues False | (blues, reds, REACH v list) \<Rightarrow> False | (blues, reds, CIRC pr pl) \<Rightarrow> \<exists>v0\<in>V0. \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E v0 pr v \<and> set pl \<inter> F \<noteq> {}; cyc \<noteq> NO_CYC; cyc = REACH x21 x22\<rbrakk> \<Longrightarrow> case case cyc of NO_CYC \<Rightarrow> None | REACH v x \<Rightarrow> Map.empty x | CIRC pr pl \<Rightarrow> Some (pr, pl) of None \<Rightarrow> \<forall>L. \<not> ((case L of (pr, pl) \<Rightarrow> \<exists>v0 va. v0 \<in> V0 \<and> pl \<noteq> [] \<and> path E v0 pr va \<and> path E va pl va) \<and> set (snd L) \<inter> F \<noteq> {}) | Some x \<Rightarrow> (case x of (pr, pl) \<Rightarrow> \<exists>v0 va. v0 \<in> V0 \<and> pl \<noteq> [] \<and> path E v0 pr va \<and> path E va pl va) \<and> set (snd x) \<inter> F \<noteq> {}
 3. \<And>x31 x32. \<lbrakk>case (blues, reds, cyc) of (blues, reds, NO_CYC) \<Rightarrow> add_inv blues reds {} \<and> gen_dfs_outer E reachable V0 it blues False | (blues, reds, REACH v list) \<Rightarrow> False | (blues, reds, CIRC pr pl) \<Rightarrow> \<exists>v0\<in>V0. \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E v0 pr v \<and> set pl \<inter> F \<noteq> {}; cyc \<noteq> NO_CYC; cyc = CIRC x31 x32\<rbrakk> \<Longrightarrow> case case cyc of NO_CYC \<Rightarrow> None | REACH v x \<Rightarrow> Map.empty x | CIRC pr pl \<Rightarrow> Some (pr, pl) of None \<Rightarrow> \<forall>L. \<not> ((case L of (pr, pl) \<Rightarrow> \<exists>v0 va. v0 \<in> V0 \<and> pl \<noteq> [] \<and> path E v0 pr va \<and> path E va pl va) \<and> set (snd L) \<inter> F \<noteq> {}) | Some x \<Rightarrow> (case x of (pr, pl) \<Rightarrow> \<exists>v0 va. v0 \<in> V0 \<and> pl \<noteq> [] \<and> path E v0 pr va \<and> path E va pl va) \<and> set (snd x) \<inter> F \<noteq> {}
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
case extract_res cyc of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>outer_inv ?it4 (?blues4, ?reds4, ?cyc4); ?cyc4 \<noteq> NO_CYC\<rbrakk> \<Longrightarrow> case extract_res ?cyc4 of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
note IMP_POST_CYC = this
[PROOF STATE]
proof (state)
this:
\<lbrakk>outer_inv ?it4 (?blues4, ?reds4, ?cyc4); ?cyc4 \<noteq> NO_CYC\<rbrakk> \<Longrightarrow> case extract_res ?cyc4 of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
\<lbrakk>outer_inv ?it4 (?blues4, ?reds4, ?cyc4); ?cyc4 \<noteq> NO_CYC\<rbrakk> \<Longrightarrow> case extract_res ?cyc4 of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
fix "pr" pl blues reds
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume ADD_INV: "add_inv blues reds {}"
[PROOF STATE]
proof (state)
this:
add_inv blues reds {}

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume GEN_INV: "gen_dfs_outer E (E\<^sup>* `` V0) V0 {} blues False"
[PROOF STATE]
proof (state)
this:
gen_dfs_outer E reachable V0 {} blues False

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume LASSO: "is_lasso_prpl (pr, pl)"
[PROOF STATE]
proof (state)
this:
is_lasso_prpl (pr, pl)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
from LASSO[unfolded is_lasso_prpl_def is_lasso_prpl_pre_def]
[PROOF STATE]
proof (chain)
picking this:
(case (pr, pl) of (pr, pl) \<Rightarrow> \<exists>v0 va. v0 \<in> V0 \<and> pl \<noteq> [] \<and> path E v0 pr va \<and> path E va pl va) \<and> set (snd (pr, pl)) \<inter> F \<noteq> {}
[PROOF STEP]
obtain v0 va where
      "v0\<in>V0" "pl\<noteq>[]" and
      PR: "path E v0 pr va" and PL: "path E va pl va" and
      F: "set pl \<inter> F \<noteq> {}"
[PROOF STATE]
proof (prove)
using this:
(case (pr, pl) of (pr, pl) \<Rightarrow> \<exists>v0 va. v0 \<in> V0 \<and> pl \<noteq> [] \<and> path E v0 pr va \<and> path E va pl va) \<and> set (snd (pr, pl)) \<inter> F \<noteq> {}

goal (1 subgoal):
 1. (\<And>v0 va. \<lbrakk>v0 \<in> V0; pl \<noteq> []; path E v0 pr va; path E va pl va; set pl \<inter> F \<noteq> {}\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
v0 \<in> V0
pl \<noteq> []
path E v0 pr va
path E va pl va
set pl \<inter> F \<noteq> {}

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
from F
[PROOF STATE]
proof (chain)
picking this:
set pl \<inter> F \<noteq> {}
[PROOF STEP]
obtain pl1 vf pl2 where [simp]: "pl=pl1@vf#pl2" and "vf\<in>F"
[PROOF STATE]
proof (prove)
using this:
set pl \<inter> F \<noteq> {}

goal (1 subgoal):
 1. (\<And>pl1 vf pl2. \<lbrakk>pl = pl1 @ vf # pl2; vf \<in> F\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (fastforce simp: in_set_conv_decomp)
[PROOF STATE]
proof (state)
this:
pl = pl1 @ vf # pl2
vf \<in> F

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
from PR PL
[PROOF STATE]
proof (chain)
picking this:
path E v0 pr va
path E va pl va
[PROOF STEP]
have "path E v0 (pr@pl1) vf" "path E vf (vf#pl2@pl1) vf"
[PROOF STATE]
proof (prove)
using this:
path E v0 pr va
path E va pl va

goal (1 subgoal):
 1. path E v0 (pr @ pl1) vf &&& path E vf (vf # pl2 @ pl1) vf
[PROOF STEP]
by (auto simp: path_simps)
[PROOF STATE]
proof (state)
this:
path E v0 (pr @ pl1) vf
path E vf (vf # pl2 @ pl1) vf

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
hence "(v0,vf)\<in>E\<^sup>*" and "(vf,vf)\<in>E\<^sup>+"
[PROOF STATE]
proof (prove)
using this:
path E v0 (pr @ pl1) vf
path E vf (vf # pl2 @ pl1) vf

goal (1 subgoal):
 1. (v0, vf) \<in> E\<^sup>* &&& (vf, vf) \<in> E\<^sup>+
[PROOF STEP]
by (auto dest: path_is_rtrancl path_is_trancl)
[PROOF STATE]
proof (state)
this:
(v0, vf) \<in> E\<^sup>*
(vf, vf) \<in> E\<^sup>+

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
from GEN_INV \<open>v0\<in>V0\<close> \<open>(v0,vf)\<in>E\<^sup>*\<close>
[PROOF STATE]
proof (chain)
picking this:
gen_dfs_outer E reachable V0 {} blues False
v0 \<in> V0
(v0, vf) \<in> E\<^sup>*
[PROOF STEP]
have "vf\<in>blues"
[PROOF STATE]
proof (prove)
using this:
gen_dfs_outer E reachable V0 {} blues False
v0 \<in> V0
(v0, vf) \<in> E\<^sup>*

goal (1 subgoal):
 1. vf \<in> blues
[PROOF STEP]
unfolding gen_dfs_outer_def
[PROOF STATE]
proof (prove)
using this:
V0 \<subseteq> reachable \<and> E `` reachable \<subseteq> reachable \<and> finite reachable \<and> blues \<subseteq> reachable \<and> (\<not> False \<longrightarrow> E `` blues \<subseteq> blues) \<and> V0 - {} \<subseteq> blues
v0 \<in> V0
(v0, vf) \<in> E\<^sup>*

goal (1 subgoal):
 1. vf \<in> blues
[PROOF STEP]
apply (clarsimp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>v0 \<in> V0; (v0, vf) \<in> E\<^sup>*; V0 \<subseteq> reachable; E `` reachable \<subseteq> reachable; finite reachable; blues \<subseteq> reachable; E `` blues \<subseteq> blues; V0 \<subseteq> blues\<rbrakk> \<Longrightarrow> vf \<in> blues
[PROOF STEP]
by (metis Image_closed_trancl rev_ImageI rev_subsetD)
[PROOF STATE]
proof (state)
this:
vf \<in> blues

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
from ADD_INV[unfolded add_inv_def] \<open>vf\<in>blues\<close> \<open>vf\<in>F\<close> \<open>(vf,vf)\<in>E\<^sup>+\<close>
[PROOF STATE]
proof (chain)
picking this:
\<not> (\<exists>v\<in>(blues - {}) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds \<subseteq> blues \<and> reds \<inter> {} = {} \<and> red_dfs_inv E reachable reds {}
vf \<in> blues
vf \<in> F
(vf, vf) \<in> E\<^sup>+
[PROOF STEP]
have False
[PROOF STATE]
proof (prove)
using this:
\<not> (\<exists>v\<in>(blues - {}) \<inter> F. (v, v) \<in> E\<^sup>+) \<and> reds \<subseteq> blues \<and> reds \<inter> {} = {} \<and> red_dfs_inv E reachable reds {}
vf \<in> blues
vf \<in> F
(vf, vf) \<in> E\<^sup>+

goal (1 subgoal):
 1. False
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>add_inv ?blues4 ?reds4 {}; gen_dfs_outer E reachable V0 {} ?blues4 False; is_lasso_prpl (?pr4, ?pl4)\<rbrakk> \<Longrightarrow> False

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
note IMP_POST_NOCYC_AUX = this
[PROOF STATE]
proof (state)
this:
\<lbrakk>add_inv ?blues4 ?reds4 {}; gen_dfs_outer E reachable V0 {} ?blues4 False; is_lasso_prpl (?pr4, ?pl4)\<rbrakk> \<Longrightarrow> False

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
\<lbrakk>add_inv ?blues4 ?reds4 {}; gen_dfs_outer E reachable V0 {} ?blues4 False; is_lasso_prpl (?pr4, ?pl4)\<rbrakk> \<Longrightarrow> False

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
fix blues reds cyc
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
assume "outer_inv {} (blues, reds, cyc)"
[PROOF STATE]
proof (state)
this:
outer_inv {} (blues, reds, cyc)

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
hence "case extract_res cyc of
        None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L
      | Some x \<Rightarrow> is_lasso_prpl x"
[PROOF STATE]
proof (prove)
using this:
outer_inv {} (blues, reds, cyc)

goal (1 subgoal):
 1. case extract_res cyc of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x
[PROOF STEP]
apply (cases cyc)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>outer_inv {} (blues, reds, cyc); cyc = NO_CYC\<rbrakk> \<Longrightarrow> case extract_res cyc of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x
 2. \<And>x21 x22. \<lbrakk>outer_inv {} (blues, reds, cyc); cyc = REACH x21 x22\<rbrakk> \<Longrightarrow> case extract_res cyc of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x
 3. \<And>x31 x32. \<lbrakk>outer_inv {} (blues, reds, cyc); cyc = CIRC x31 x32\<rbrakk> \<Longrightarrow> case extract_res cyc of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x
[PROOF STEP]
apply (simp_all add: IMP_POST_CYC)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>outer_inv {} (blues, reds, NO_CYC); cyc = NO_CYC\<rbrakk> \<Longrightarrow> case extract_res NO_CYC of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x
[PROOF STEP]
unfolding outer_inv_def extract_res_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>case (blues, reds, NO_CYC) of (blues, reds, NO_CYC) \<Rightarrow> add_inv blues reds {} \<and> gen_dfs_outer E reachable V0 {} blues False | (blues, reds, REACH v list) \<Rightarrow> False | (blues, reds, CIRC pr pl) \<Rightarrow> \<exists>v0\<in>V0. \<exists>v. pl \<noteq> [] \<and> path E v pl v \<and> path E v0 pr v \<and> set pl \<inter> F \<noteq> {}; cyc = NO_CYC\<rbrakk> \<Longrightarrow> case case NO_CYC of NO_CYC \<Rightarrow> None | REACH v x \<Rightarrow> Map.empty x | CIRC pr pl \<Rightarrow> Some (pr, pl) of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x
[PROOF STEP]
apply (auto intro: IMP_POST_NOCYC_AUX)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
case extract_res cyc of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
outer_inv {} (?blues4, ?reds4, ?cyc4) \<Longrightarrow> case extract_res ?cyc4 of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
note IMP_POST_NOCYC = this
[PROOF STATE]
proof (state)
this:
outer_inv {} (?blues4, ?reds4, ?cyc4) \<Longrightarrow> case extract_res ?cyc4 of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x

goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
unfolding blue_dfs_fe.refine blue_dfs_body.refine
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. NDFS_SI_Statistics.start_nres \<bind> (\<lambda>_. FOREACH\<^sub>C V0 (\<lambda>(uu_, uu_, cyc). cyc = NO_CYC) (\<lambda>v0 (blues, reds, uu_). if v0 \<notin> blues then REC\<^sub>T (blue_dfs_body G) (blues, reds, {}, v0) \<bind> (\<lambda>(blues, reds, uu_, cyc). RETURN (blues, reds, cyc)) else RETURN (blues, reds, NO_CYC)) ({}, {}, NO_CYC) \<bind> (\<lambda>(uu_, uu_, cyc). NDFS_SI_Statistics.stop_nres \<bind> (\<lambda>_. RETURN (extract_res cyc)))) \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)
[PROOF STEP]
apply (refine_rcg
      FOREACHc_rule[where I=outer_inv]
      refine_vcg
    )
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. finite V0
 2. outer_inv V0 ({}, {}, NO_CYC)
 3. \<And>x it \<sigma> a b aa ba. \<lbrakk>x \<in> it; it \<subseteq> V0; outer_inv it \<sigma>; case \<sigma> of (uu_, uua_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (a, b); b = (aa, ba); x \<notin> a\<rbrakk> \<Longrightarrow> REC\<^sub>T (blue_dfs_body G) (a, aa, {}, x) \<le> SPEC (\<lambda>xa. (case xa of (blues, reds, uu_, cyc) \<Rightarrow> RETURN (blues, reds, cyc)) \<le> SPEC (outer_inv (it - {x})))
 4. \<And>x it \<sigma> a b aa ba. \<lbrakk>x \<in> it; it \<subseteq> V0; outer_inv it \<sigma>; case \<sigma> of (uu_, uua_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (a, b); b = (aa, ba); \<not> x \<notin> a\<rbrakk> \<Longrightarrow> outer_inv (it - {x}) (a, aa, NO_CYC)
 5. \<And>\<sigma> a b aa ba. \<lbrakk>outer_inv {} \<sigma>; \<sigma> = (a, b); b = (aa, ba)\<rbrakk> \<Longrightarrow> case extract_res ba of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x
 6. \<And>it \<sigma> a b aa ba. \<lbrakk>it \<noteq> {}; it \<subseteq> V0; outer_inv it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, cyc) \<Rightarrow> cyc = NO_CYC); \<sigma> = (a, b); b = (aa, ba)\<rbrakk> \<Longrightarrow> case extract_res ba of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x
[PROOF STEP]
apply (simp add: finitely_reachable finite_V0)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. outer_inv V0 ({}, {}, NO_CYC)
 2. \<And>x it \<sigma> a b aa ba. \<lbrakk>x \<in> it; it \<subseteq> V0; outer_inv it \<sigma>; case \<sigma> of (uu_, uua_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (a, b); b = (aa, ba); x \<notin> a\<rbrakk> \<Longrightarrow> REC\<^sub>T (blue_dfs_body G) (a, aa, {}, x) \<le> SPEC (\<lambda>xa. (case xa of (blues, reds, uu_, cyc) \<Rightarrow> RETURN (blues, reds, cyc)) \<le> SPEC (outer_inv (it - {x})))
 3. \<And>x it \<sigma> a b aa ba. \<lbrakk>x \<in> it; it \<subseteq> V0; outer_inv it \<sigma>; case \<sigma> of (uu_, uua_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (a, b); b = (aa, ba); \<not> x \<notin> a\<rbrakk> \<Longrightarrow> outer_inv (it - {x}) (a, aa, NO_CYC)
 4. \<And>\<sigma> a b aa ba. \<lbrakk>outer_inv {} \<sigma>; \<sigma> = (a, b); b = (aa, ba)\<rbrakk> \<Longrightarrow> case extract_res ba of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x
 5. \<And>it \<sigma> a b aa ba. \<lbrakk>it \<noteq> {}; it \<subseteq> V0; outer_inv it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, cyc) \<Rightarrow> cyc = NO_CYC); \<sigma> = (a, b); b = (aa, ba)\<rbrakk> \<Longrightarrow> case extract_res ba of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x
[PROOF STEP]
apply (rule OUTER_INITIAL)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>x it \<sigma> a b aa ba. \<lbrakk>x \<in> it; it \<subseteq> V0; outer_inv it \<sigma>; case \<sigma> of (uu_, uua_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (a, b); b = (aa, ba); x \<notin> a\<rbrakk> \<Longrightarrow> REC\<^sub>T (blue_dfs_body G) (a, aa, {}, x) \<le> SPEC (\<lambda>xa. (case xa of (blues, reds, uu_, cyc) \<Rightarrow> RETURN (blues, reds, cyc)) \<le> SPEC (outer_inv (it - {x})))
 2. \<And>x it \<sigma> a b aa ba. \<lbrakk>x \<in> it; it \<subseteq> V0; outer_inv it \<sigma>; case \<sigma> of (uu_, uua_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (a, b); b = (aa, ba); \<not> x \<notin> a\<rbrakk> \<Longrightarrow> outer_inv (it - {x}) (a, aa, NO_CYC)
 3. \<And>\<sigma> a b aa ba. \<lbrakk>outer_inv {} \<sigma>; \<sigma> = (a, b); b = (aa, ba)\<rbrakk> \<Longrightarrow> case extract_res ba of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x
 4. \<And>it \<sigma> a b aa ba. \<lbrakk>it \<noteq> {}; it \<subseteq> V0; outer_inv it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, cyc) \<Rightarrow> cyc = NO_CYC); \<sigma> = (a, b); b = (aa, ba)\<rbrakk> \<Longrightarrow> case extract_res ba of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x
[PROOF STEP]
apply (rule order_trans[OF GEN])
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>x it \<sigma> a b aa ba. \<lbrakk>x \<in> it; it \<subseteq> V0; outer_inv it \<sigma>; case \<sigma> of (uu_, uua_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (a, b); b = (aa, ba); x \<notin> a\<rbrakk> \<Longrightarrow> pre (a, aa, {}, x)
 2. \<And>x it \<sigma> a b aa ba. \<lbrakk>x \<in> it; it \<subseteq> V0; outer_inv it \<sigma>; case \<sigma> of (uu_, uua_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (a, b); b = (aa, ba); x \<notin> a\<rbrakk> \<Longrightarrow> SPEC (post (a, aa, {}, x)) \<le> SPEC (\<lambda>xa. (case xa of (blues, reds, uu_, cyc) \<Rightarrow> RETURN (blues, reds, cyc)) \<le> SPEC (outer_inv (it - {x})))
 3. \<And>x it \<sigma> a b aa ba. \<lbrakk>x \<in> it; it \<subseteq> V0; outer_inv it \<sigma>; case \<sigma> of (uu_, uua_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (a, b); b = (aa, ba); \<not> x \<notin> a\<rbrakk> \<Longrightarrow> outer_inv (it - {x}) (a, aa, NO_CYC)
 4. \<And>\<sigma> a b aa ba. \<lbrakk>outer_inv {} \<sigma>; \<sigma> = (a, b); b = (aa, ba)\<rbrakk> \<Longrightarrow> case extract_res ba of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x
 5. \<And>it \<sigma> a b aa ba. \<lbrakk>it \<noteq> {}; it \<subseteq> V0; outer_inv it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, cyc) \<Rightarrow> cyc = NO_CYC); \<sigma> = (a, b); b = (aa, ba)\<rbrakk> \<Longrightarrow> case extract_res ba of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x
[PROOF STEP]
apply (clarsimp, blast intro: OUTER_IMP_PRE)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>x it \<sigma> a b aa ba. \<lbrakk>x \<in> it; it \<subseteq> V0; outer_inv it \<sigma>; case \<sigma> of (uu_, uua_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (a, b); b = (aa, ba); x \<notin> a\<rbrakk> \<Longrightarrow> SPEC (post (a, aa, {}, x)) \<le> SPEC (\<lambda>xa. (case xa of (blues, reds, uu_, cyc) \<Rightarrow> RETURN (blues, reds, cyc)) \<le> SPEC (outer_inv (it - {x})))
 2. \<And>x it \<sigma> a b aa ba. \<lbrakk>x \<in> it; it \<subseteq> V0; outer_inv it \<sigma>; case \<sigma> of (uu_, uua_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (a, b); b = (aa, ba); \<not> x \<notin> a\<rbrakk> \<Longrightarrow> outer_inv (it - {x}) (a, aa, NO_CYC)
 3. \<And>\<sigma> a b aa ba. \<lbrakk>outer_inv {} \<sigma>; \<sigma> = (a, b); b = (aa, ba)\<rbrakk> \<Longrightarrow> case extract_res ba of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x
 4. \<And>it \<sigma> a b aa ba. \<lbrakk>it \<noteq> {}; it \<subseteq> V0; outer_inv it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, cyc) \<Rightarrow> cyc = NO_CYC); \<sigma> = (a, b); b = (aa, ba)\<rbrakk> \<Longrightarrow> case extract_res ba of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x
[PROOF STEP]
apply (clarsimp, blast intro: POST_IMP_OUTER)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>x it \<sigma> a b aa ba. \<lbrakk>x \<in> it; it \<subseteq> V0; outer_inv it \<sigma>; case \<sigma> of (uu_, uua_, cyc) \<Rightarrow> cyc = NO_CYC; \<sigma> = (a, b); b = (aa, ba); \<not> x \<notin> a\<rbrakk> \<Longrightarrow> outer_inv (it - {x}) (a, aa, NO_CYC)
 2. \<And>\<sigma> a b aa ba. \<lbrakk>outer_inv {} \<sigma>; \<sigma> = (a, b); b = (aa, ba)\<rbrakk> \<Longrightarrow> case extract_res ba of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x
 3. \<And>it \<sigma> a b aa ba. \<lbrakk>it \<noteq> {}; it \<subseteq> V0; outer_inv it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, cyc) \<Rightarrow> cyc = NO_CYC); \<sigma> = (a, b); b = (aa, ba)\<rbrakk> \<Longrightarrow> case extract_res ba of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x
[PROOF STEP]
apply (clarsimp, blast intro: OUTER_ALREX)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> a b aa ba. \<lbrakk>outer_inv {} \<sigma>; \<sigma> = (a, b); b = (aa, ba)\<rbrakk> \<Longrightarrow> case extract_res ba of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x
 2. \<And>it \<sigma> a b aa ba. \<lbrakk>it \<noteq> {}; it \<subseteq> V0; outer_inv it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, cyc) \<Rightarrow> cyc = NO_CYC); \<sigma> = (a, b); b = (aa, ba)\<rbrakk> \<Longrightarrow> case extract_res ba of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x
[PROOF STEP]
apply (clarsimp, blast intro: IMP_POST_NOCYC)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>it \<sigma> a b aa ba. \<lbrakk>it \<noteq> {}; it \<subseteq> V0; outer_inv it \<sigma>; \<not> (case \<sigma> of (uu_, uua_, cyc) \<Rightarrow> cyc = NO_CYC); \<sigma> = (a, b); b = (aa, ba)\<rbrakk> \<Longrightarrow> case extract_res ba of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x
[PROOF STEP]
apply (clarsimp, blast intro: IMP_POST_CYC)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
blue_dfs G \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>L. \<not> is_lasso_prpl L | Some x \<Rightarrow> is_lasso_prpl x)

goal:
No subgoals!
[PROOF STEP]
qed