[STATEMENT]
lemma spy_framework_completeness_and_finiteness :
  fixes M1 :: "('a::linorder,'b::linorder,'c::linorder) fsm"
  fixes M2 :: "('d,'b,'c) fsm"
  assumes "observable M1"
  and     "observable M2"
  and     "minimal M1"
  and     "minimal M2"
  and     "size_r M1 \<le> m"
  and     "size M2 \<le> m"
  and     "inputs M2 = inputs M1"
  and     "outputs M2 = outputs M1"
  and     "is_state_cover_assignment M1 (get_state_cover M1)"
  and     "\<And> xs . List.set xs = List.set (sort_unverified_transitions M1 (get_state_cover M1) xs)"
  and     "convergence_graph_initial_invar M1 M2 cg_lookup cg_initial"
  and     "convergence_graph_insert_invar M1 M2 cg_lookup cg_insert"
  and     "convergence_graph_merge_invar M1 M2 cg_lookup cg_merge"
  and     "separates_state_cover separate_state_cover M1 M2 cg_initial cg_insert cg_lookup"
  and     "verifies_transition establish_convergence M1 M2 (get_state_cover M1) (fst (separate_state_cover M1 (get_state_cover M1) cg_initial cg_insert cg_lookup)) cg_insert cg_lookup"
  and     "verifies_io_pair append_io_pair M1 M2 cg_insert cg_lookup"
shows "(L M1 = L M2) \<longleftrightarrow> ((L M1 \<inter> set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m))
                          = (L M2 \<inter> set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)))"
  (is "(L M1 = L M2) \<longleftrightarrow> ((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS))")
and "finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (L M1 = L M2) = (L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)) &&& finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. L M1 = L M2 \<Longrightarrow> L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
 2. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 3. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
show "(L M1 = L M2) \<Longrightarrow> ((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 = L M2 \<Longrightarrow> L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 = L M2 \<Longrightarrow> L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
define rstates where rstates: "rstates = reachable_states_as_list M1"
[PROOF STATE]
proof (state)
this:
rstates = reachable_states_as_list M1

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
define rstates_io where rstates_io: "rstates_io = List.product rstates (List.product (inputs_as_list M1) (outputs_as_list M1))"
[PROOF STATE]
proof (state)
this:
rstates_io = List.product rstates (List.product (inputs_as_list M1) (outputs_as_list M1))

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
define undefined_io_pairs where undefined_io_pairs: "undefined_io_pairs = List.filter (\<lambda> (q,(x,y)) . h_obs M1 q x y = None) rstates_io"
[PROOF STATE]
proof (state)
this:
undefined_io_pairs = filter (\<lambda>(q, x, y). FSM.h_obs M1 q x y = None) rstates_io

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
define V where V: "V             = get_state_cover M1"
[PROOF STATE]
proof (state)
this:
V = get_state_cover M1

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
define n where n: "n             = size_r M1"
[PROOF STATE]
proof (state)
this:
n = size_r M1

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
define TG1 where TG1: "TG1 = separate_state_cover M1 V cg_initial cg_insert cg_lookup"
[PROOF STATE]
proof (state)
this:
TG1 = separate_state_cover M1 V cg_initial cg_insert cg_lookup

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
define sc_covered_transitions where sc_covered_transitions: "sc_covered_transitions = (\<Union> q \<in> reachable_states M1 . covered_transitions M1 V (V q))"
[PROOF STATE]
proof (state)
this:
sc_covered_transitions = (\<Union>q\<in>reachable_states M1. covered_transitions M1 V (V q))

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
define unverified_transitions where unverified_transitions: "unverified_transitions = sort_unverified_transitions M1 V (filter (\<lambda>t . t_source t \<in> reachable_states M1 \<and> t \<notin> sc_covered_transitions) (transitions_as_list M1))"
[PROOF STATE]
proof (state)
this:
unverified_transitions = sort_unverified_transitions M1 V (filter (\<lambda>t. t_source t \<in> reachable_states M1 \<and> t \<notin> sc_covered_transitions) (transitions_as_list M1))

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
define verify_transition where verify_transition: "verify_transition = (\<lambda> (T,G) t . let TGxy = append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t);
                                                                                (T',G') = establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t;
                                       G'' = cg_merge G' ((V (t_source t)) @ [(t_input t, t_output t)]) (V (t_target t))
                                    in (T',G''))"
[PROOF STATE]
proof (state)
this:
verify_transition = (\<lambda>(T, G) t. let TGxy = append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t); (T', G') = establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t in Let (cg_merge G' (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))) (Pair T'))

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
define TG2 where TG2: "TG2       = (foldl verify_transition TG1 unverified_transitions)"
[PROOF STATE]
proof (state)
this:
TG2 = foldl verify_transition TG1 unverified_transitions

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
define verify_undefined_io_pair where verify_undefined_io_pair: "verify_undefined_io_pair = (\<lambda> T (q,(x,y)) . fst (append_io_pair M1 V T (snd TG2) cg_insert cg_lookup q x y))"
[PROOF STATE]
proof (state)
this:
verify_undefined_io_pair = (\<lambda>T (q, x, y). fst (append_io_pair M1 V T (snd TG2) cg_insert cg_lookup q x y))

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
define T3 where T3: "T3            = foldl verify_undefined_io_pair (fst TG2) undefined_io_pairs"
[PROOF STATE]
proof (state)
this:
T3 = foldl verify_undefined_io_pair (fst TG2) undefined_io_pairs

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have "?TS = T3"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m = T3
[PROOF STEP]
unfolding rstates rstates_io undefined_io_pairs V n TG1 sc_covered_transitions unverified_transitions verify_transition TG2 verify_undefined_io_pair T3
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m = foldl (\<lambda>T (q, x, y). fst (append_io_pair M1 (get_state_cover M1) T (snd (foldl (\<lambda>(T, G) t. let TGxy = append_io_pair M1 (get_state_cover M1) T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t); (T', G') = establish_convergence M1 (get_state_cover M1) (fst TGxy) (snd TGxy) cg_insert cg_lookup m t in Let (cg_merge G' (get_state_cover M1 (t_source t) @ [(t_input t, t_output t)]) (get_state_cover M1 (t_target t))) (Pair T')) (separate_state_cover M1 (get_state_cover M1) cg_initial cg_insert cg_lookup) (sort_unverified_transitions M1 (get_state_cover M1) (filter (\<lambda>t. t_source t \<in> reachable_states M1 \<and> t \<notin> (\<Union>q\<in>reachable_states M1. covered_transitions M1 (get_state_cover M1) (get_state_cover M1 q))) (transitions_as_list M1))))) cg_insert cg_lookup q x y)) (fst (foldl (\<lambda>(T, G) t. let TGxy = append_io_pair M1 (get_state_cover M1) T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t); (T', G') = establish_convergence M1 (get_state_cover M1) (fst TGxy) (snd TGxy) cg_insert cg_lookup m t in Let (cg_merge G' (get_state_cover M1 (t_source t) @ [(t_input t, t_output t)]) (get_state_cover M1 (t_target t))) (Pair T')) (separate_state_cover M1 (get_state_cover M1) cg_initial cg_insert cg_lookup) (sort_unverified_transitions M1 (get_state_cover M1) (filter (\<lambda>t. t_source t \<in> reachable_states M1 \<and> t \<notin> (\<Union>q\<in>reachable_states M1. covered_transitions M1 (get_state_cover M1) (get_state_cover M1 q))) (transitions_as_list M1))))) (filter (\<lambda>(q, x, y). FSM.h_obs M1 q x y = None) (List.product (reachable_states_as_list M1) (List.product (inputs_as_list M1) (outputs_as_list M1))))
[PROOF STEP]
unfolding spy_framework_def Let_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. foldl (\<lambda>T (q, x, y). fst (append_io_pair M1 (get_state_cover M1) T (snd (foldl (\<lambda>(T, G) t. case establish_convergence M1 (get_state_cover M1) (fst (append_io_pair M1 (get_state_cover M1) T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) (snd (append_io_pair M1 (get_state_cover M1) T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) cg_insert cg_lookup m t of (T', G') \<Rightarrow> (T', cg_merge G' (get_state_cover M1 (t_source t) @ [(t_input t, t_output t)]) (get_state_cover M1 (t_target t)))) (separate_state_cover M1 (get_state_cover M1) cg_initial cg_insert cg_lookup) (sort_unverified_transitions M1 (get_state_cover M1) (filter (\<lambda>t. t_source t \<in> reachable_states M1 \<and> t \<notin> (\<Union>q\<in>reachable_states M1. covered_transitions M1 (get_state_cover M1) (get_state_cover M1 q))) (transitions_as_list M1))))) cg_insert cg_lookup q x y)) (fst (foldl (\<lambda>(T, G) t. case establish_convergence M1 (get_state_cover M1) (fst (append_io_pair M1 (get_state_cover M1) T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) (snd (append_io_pair M1 (get_state_cover M1) T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) cg_insert cg_lookup m t of (T', G') \<Rightarrow> (T', cg_merge G' (get_state_cover M1 (t_source t) @ [(t_input t, t_output t)]) (get_state_cover M1 (t_target t)))) (separate_state_cover M1 (get_state_cover M1) cg_initial cg_insert cg_lookup) (sort_unverified_transitions M1 (get_state_cover M1) (filter (\<lambda>t. t_source t \<in> reachable_states M1 \<and> t \<notin> (\<Union>q\<in>reachable_states M1. covered_transitions M1 (get_state_cover M1) (get_state_cover M1 q))) (transitions_as_list M1))))) (filter (\<lambda>(q, x, y). FSM.h_obs M1 q x y = None) (List.product (reachable_states_as_list M1) (List.product (inputs_as_list M1) (outputs_as_list M1)))) = foldl (\<lambda>T (q, x, y). fst (append_io_pair M1 (get_state_cover M1) T (snd (foldl (\<lambda>(T, G) t. case establish_convergence M1 (get_state_cover M1) (fst (append_io_pair M1 (get_state_cover M1) T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) (snd (append_io_pair M1 (get_state_cover M1) T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) cg_insert cg_lookup m t of (T', G') \<Rightarrow> (T', cg_merge G' (get_state_cover M1 (t_source t) @ [(t_input t, t_output t)]) (get_state_cover M1 (t_target t)))) (separate_state_cover M1 (get_state_cover M1) cg_initial cg_insert cg_lookup) (sort_unverified_transitions M1 (get_state_cover M1) (filter (\<lambda>t. t_source t \<in> reachable_states M1 \<and> t \<notin> (\<Union>q\<in>reachable_states M1. covered_transitions M1 (get_state_cover M1) (get_state_cover M1 q))) (transitions_as_list M1))))) cg_insert cg_lookup q x y)) (fst (foldl (\<lambda>(T, G) t. case establish_convergence M1 (get_state_cover M1) (fst (append_io_pair M1 (get_state_cover M1) T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) (snd (append_io_pair M1 (get_state_cover M1) T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) cg_insert cg_lookup m t of (T', G') \<Rightarrow> (T', cg_merge G' (get_state_cover M1 (t_source t) @ [(t_input t, t_output t)]) (get_state_cover M1 (t_target t)))) (separate_state_cover M1 (get_state_cover M1) cg_initial cg_insert cg_lookup) (sort_unverified_transitions M1 (get_state_cover M1) (filter (\<lambda>t. t_source t \<in> reachable_states M1 \<and> t \<notin> (\<Union>q\<in>reachable_states M1. covered_transitions M1 (get_state_cover M1) (get_state_cover M1 q))) (transitions_as_list M1))))) (filter (\<lambda>(q, x, y). FSM.h_obs M1 q x y = None) (List.product (reachable_states_as_list M1) (List.product (inputs_as_list M1) (outputs_as_list M1))))
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m = T3

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m = T3
[PROOF STEP]
have "((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS)) \<Longrightarrow> L M1 \<inter> set T3 = L M2 \<inter> set T3"
[PROOF STATE]
proof (prove)
using this:
spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m = T3

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 \<inter> Prefix_Tree.set T3 = L M2 \<inter> Prefix_Tree.set T3
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 \<inter> Prefix_Tree.set T3 = L M2 \<inter> Prefix_Tree.set T3

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have "is_state_cover_assignment M1 V"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_state_cover_assignment M1 V
[PROOF STEP]
unfolding V
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_state_cover_assignment M1 (get_state_cover M1)
[PROOF STEP]
using assms(9)
[PROOF STATE]
proof (prove)
using this:
is_state_cover_assignment M1 (get_state_cover M1)

goal (1 subgoal):
 1. is_state_cover_assignment M1 (get_state_cover M1)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
is_state_cover_assignment M1 V

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
(* basic properties of T1 and G1 *)
[PROOF STATE]
proof (state)
this:
is_state_cover_assignment M1 V

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
define T1 where T1: "T1 = fst TG1"
[PROOF STATE]
proof (state)
this:
T1 = fst TG1

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
T1 = fst TG1

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
define G1 where G1: "G1 = snd TG1"
[PROOF STATE]
proof (state)
this:
G1 = snd TG1

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
T1 = fst TG1
G1 = snd TG1
[PROOF STEP]
have "TG1 = (T1,G1)"
[PROOF STATE]
proof (prove)
using this:
T1 = fst TG1
G1 = snd TG1

goal (1 subgoal):
 1. TG1 = (T1, G1)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
TG1 = (T1, G1)

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have T1_state_cover: "V ` reachable_states M1 \<subseteq> set T1"
  and  T1_finite: "finite_tree T1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V ` reachable_states M1 \<subseteq> Prefix_Tree.set T1 &&& finite_tree T1
[PROOF STEP]
using \<open>separates_state_cover separate_state_cover M1 M2 cg_initial cg_insert cg_lookup\<close>
[PROOF STATE]
proof (prove)
using this:
separates_state_cover separate_state_cover M1 M2 cg_initial cg_insert cg_lookup

goal (1 subgoal):
 1. V ` reachable_states M1 \<subseteq> Prefix_Tree.set T1 &&& finite_tree T1
[PROOF STEP]
unfolding T1 TG1 separates_state_cover_def
[PROOF STATE]
proof (prove)
using this:
\<forall>V. V ` reachable_states M1 \<subseteq> Prefix_Tree.set (fst (separate_state_cover M1 V cg_initial cg_insert cg_lookup)) \<and> finite_tree (fst (separate_state_cover M1 V cg_initial cg_insert cg_lookup)) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_initial_invar M1 M2 cg_lookup cg_initial \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (separate_state_cover M1 V cg_initial cg_insert cg_lookup)) = L M2 \<inter> Prefix_Tree.set (fst (separate_state_cover M1 V cg_initial cg_insert cg_lookup)) \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (separate_state_cover M1 V cg_initial cg_insert cg_lookup)))

goal (1 subgoal):
 1. V ` reachable_states M1 \<subseteq> Prefix_Tree.set (fst (separate_state_cover M1 V cg_initial cg_insert cg_lookup)) &&& finite_tree (fst (separate_state_cover M1 V cg_initial cg_insert cg_lookup))
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T1
finite_tree T1

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have T1_V_div: "(L M1 \<inter> set T1 = (L M2 \<inter> set T1)) \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1)"
   and G1_invar: "(L M1 \<inter> set T1 = (L M2 \<inter> set T1)) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1 \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1)) &&& (L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1 \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G1)
[PROOF STEP]
using \<open>separates_state_cover separate_state_cover M1 M2 cg_initial cg_insert cg_lookup\<close>
[PROOF STATE]
proof (prove)
using this:
separates_state_cover separate_state_cover M1 M2 cg_initial cg_insert cg_lookup

goal (1 subgoal):
 1. (L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1 \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1)) &&& (L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1 \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G1)
[PROOF STEP]
unfolding T1 G1 TG1 separates_state_cover_def
[PROOF STATE]
proof (prove)
using this:
\<forall>V. V ` reachable_states M1 \<subseteq> Prefix_Tree.set (fst (separate_state_cover M1 V cg_initial cg_insert cg_lookup)) \<and> finite_tree (fst (separate_state_cover M1 V cg_initial cg_insert cg_lookup)) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_initial_invar M1 M2 cg_lookup cg_initial \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (separate_state_cover M1 V cg_initial cg_insert cg_lookup)) = L M2 \<inter> Prefix_Tree.set (fst (separate_state_cover M1 V cg_initial cg_insert cg_lookup)) \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (separate_state_cover M1 V cg_initial cg_insert cg_lookup)))

goal (1 subgoal):
 1. (L M1 \<inter> Prefix_Tree.set (fst (separate_state_cover M1 V cg_initial cg_insert cg_lookup)) = L M2 \<inter> Prefix_Tree.set (fst (separate_state_cover M1 V cg_initial cg_insert cg_lookup)) \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1)) &&& (L M1 \<inter> Prefix_Tree.set (fst (separate_state_cover M1 V cg_initial cg_insert cg_lookup)) = L M2 \<inter> Prefix_Tree.set (fst (separate_state_cover M1 V cg_initial cg_insert cg_lookup)) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (separate_state_cover M1 V cg_initial cg_insert cg_lookup)))
[PROOF STEP]
using assms(1-4,7,8) \<open>is_state_cover_assignment M1 V\<close> assms(12,11)
[PROOF STATE]
proof (prove)
using this:
\<forall>V. V ` reachable_states M1 \<subseteq> Prefix_Tree.set (fst (separate_state_cover M1 V cg_initial cg_insert cg_lookup)) \<and> finite_tree (fst (separate_state_cover M1 V cg_initial cg_insert cg_lookup)) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> convergence_graph_initial_invar M1 M2 cg_lookup cg_initial \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (separate_state_cover M1 V cg_initial cg_insert cg_lookup)) = L M2 \<inter> Prefix_Tree.set (fst (separate_state_cover M1 V cg_initial cg_insert cg_lookup)) \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (separate_state_cover M1 V cg_initial cg_insert cg_lookup)))
observable M1
observable M2
minimal M1
minimal M2
FSM.inputs M2 = FSM.inputs M1
FSM.outputs M2 = FSM.outputs M1
is_state_cover_assignment M1 V
convergence_graph_insert_invar M1 M2 cg_lookup cg_insert
convergence_graph_initial_invar M1 M2 cg_lookup cg_initial

goal (1 subgoal):
 1. (L M1 \<inter> Prefix_Tree.set (fst (separate_state_cover M1 V cg_initial cg_insert cg_lookup)) = L M2 \<inter> Prefix_Tree.set (fst (separate_state_cover M1 V cg_initial cg_insert cg_lookup)) \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1)) &&& (L M1 \<inter> Prefix_Tree.set (fst (separate_state_cover M1 V cg_initial cg_insert cg_lookup)) = L M2 \<inter> Prefix_Tree.set (fst (separate_state_cover M1 V cg_initial cg_insert cg_lookup)) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (separate_state_cover M1 V cg_initial cg_insert cg_lookup)))
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1 \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1)
L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1 \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G1

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have "verifies_transition establish_convergence M1 M2 V T1 cg_insert cg_lookup"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. verifies_transition establish_convergence M1 M2 V T1 cg_insert cg_lookup
[PROOF STEP]
using assms(15)
[PROOF STATE]
proof (prove)
using this:
verifies_transition establish_convergence M1 M2 (get_state_cover M1) (fst (separate_state_cover M1 (get_state_cover M1) cg_initial cg_insert cg_lookup)) cg_insert cg_lookup

goal (1 subgoal):
 1. verifies_transition establish_convergence M1 M2 V T1 cg_insert cg_lookup
[PROOF STEP]
unfolding T1 TG1 V
[PROOF STATE]
proof (prove)
using this:
verifies_transition establish_convergence M1 M2 (get_state_cover M1) (fst (separate_state_cover M1 (get_state_cover M1) cg_initial cg_insert cg_lookup)) cg_insert cg_lookup

goal (1 subgoal):
 1. verifies_transition establish_convergence M1 M2 (get_state_cover M1) (fst (separate_state_cover M1 (get_state_cover M1) cg_initial cg_insert cg_lookup)) cg_insert cg_lookup
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
verifies_transition establish_convergence M1 M2 V T1 cg_insert cg_lookup

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
(* properties of transition filtering and sorting *)
[PROOF STATE]
proof (state)
this:
verifies_transition establish_convergence M1 M2 V T1 cg_insert cg_lookup

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have sc_covered_transitions_alt_def: "sc_covered_transitions = {t . t \<in> transitions M1 \<and> t_source t \<in> reachable_states M1 \<and> (V (t_target t) = (V (t_source t))@[(t_input t, t_output t)])}"
    (is "?A = ?B")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sc_covered_transitions = {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. sc_covered_transitions \<subseteq> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}
 2. {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]} \<subseteq> sc_covered_transitions
[PROOF STEP]
show "?A \<subseteq> ?B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sc_covered_transitions \<subseteq> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. x \<in> sc_covered_transitions \<Longrightarrow> x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}
[PROOF STEP]
fix t
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. x \<in> sc_covered_transitions \<Longrightarrow> x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}
[PROOF STEP]
assume "t \<in> ?A"
[PROOF STATE]
proof (state)
this:
t \<in> sc_covered_transitions

goal (1 subgoal):
 1. \<And>x. x \<in> sc_covered_transitions \<Longrightarrow> x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
t \<in> sc_covered_transitions
[PROOF STEP]
obtain q where "t \<in> covered_transitions M1 V (V q)" and "q \<in> reachable_states M1"
[PROOF STATE]
proof (prove)
using this:
t \<in> sc_covered_transitions

goal (1 subgoal):
 1. (\<And>q. \<lbrakk>t \<in> covered_transitions M1 V (V q); q \<in> reachable_states M1\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding sc_covered_transitions
[PROOF STATE]
proof (prove)
using this:
t \<in> (\<Union>q\<in>reachable_states M1. covered_transitions M1 V (V q))

goal (1 subgoal):
 1. (\<And>q. \<lbrakk>t \<in> covered_transitions M1 V (V q); q \<in> reachable_states M1\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
t \<in> covered_transitions M1 V (V q)
q \<in> reachable_states M1

goal (1 subgoal):
 1. \<And>x. x \<in> sc_covered_transitions \<Longrightarrow> x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
t \<in> covered_transitions M1 V (V q)
q \<in> reachable_states M1
[PROOF STEP]
have "V q \<in> L M1" and "after_initial M1 (V q) = q"
[PROOF STATE]
proof (prove)
using this:
t \<in> covered_transitions M1 V (V q)
q \<in> reachable_states M1

goal (1 subgoal):
 1. V q \<in> L M1 &&& after_initial M1 (V q) = q
[PROOF STEP]
using state_cover_assignment_after[OF assms(1) \<open>is_state_cover_assignment M1 V\<close>]
[PROOF STATE]
proof (prove)
using this:
t \<in> covered_transitions M1 V (V q)
q \<in> reachable_states M1
?q \<in> reachable_states M1 \<Longrightarrow> V ?q \<in> L M1
?q \<in> reachable_states M1 \<Longrightarrow> after_initial M1 (V ?q) = ?q

goal (1 subgoal):
 1. V q \<in> L M1 &&& after_initial M1 (V q) = q
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
V q \<in> L M1
after_initial M1 (V q) = q

goal (1 subgoal):
 1. \<And>x. x \<in> sc_covered_transitions \<Longrightarrow> x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V q \<in> L M1
after_initial M1 (V q) = q
[PROOF STEP]
obtain p where "path M1 (initial M1) p" and "p_io p = V q"
[PROOF STATE]
proof (prove)
using this:
V q \<in> L M1
after_initial M1 (V q) = q

goal (1 subgoal):
 1. (\<And>p. \<lbrakk>path M1 (FSM.initial M1) p; p_io p = V q\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
path M1 (FSM.initial M1) p
p_io p = V q

goal (1 subgoal):
 1. \<And>x. x \<in> sc_covered_transitions \<Longrightarrow> x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
path M1 (FSM.initial M1) p
p_io p = V q
[PROOF STEP]
have *: "the_elem (paths_for_io M1 (initial M1) (V q)) = p"
[PROOF STATE]
proof (prove)
using this:
path M1 (FSM.initial M1) p
p_io p = V q

goal (1 subgoal):
 1. the_elem (paths_for_io M1 (FSM.initial M1) (V q)) = p
[PROOF STEP]
using observable_paths_for_io[OF assms(1) \<open>V q \<in> L M1\<close>]
[PROOF STATE]
proof (prove)
using this:
path M1 (FSM.initial M1) p
p_io p = V q
(\<And>p. paths_for_io M1 (FSM.initial M1) (V q) = {p} \<Longrightarrow> ?thesis) \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. the_elem (paths_for_io M1 (FSM.initial M1) (V q)) = p
[PROOF STEP]
unfolding paths_for_io_def
[PROOF STATE]
proof (prove)
using this:
path M1 (FSM.initial M1) p
p_io p = V q
(\<And>p. {p. path M1 (FSM.initial M1) p \<and> p_io p = V q} = {p} \<Longrightarrow> ?thesis) \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. the_elem {p. path M1 (FSM.initial M1) p \<and> p_io p = V q} = p
[PROOF STEP]
by (metis (mono_tags, lifting) assms(1) mem_Collect_eq observable_path_unique singletonI the_elem_eq)
[PROOF STATE]
proof (state)
this:
the_elem (paths_for_io M1 (FSM.initial M1) (V q)) = p

goal (1 subgoal):
 1. \<And>x. x \<in> sc_covered_transitions \<Longrightarrow> x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}
[PROOF STEP]
have "t \<in> list.set p" and "V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. t \<in> list.set p &&& V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)
[PROOF STEP]
using \<open>t \<in> covered_transitions M1 V (V q)\<close>
[PROOF STATE]
proof (prove)
using this:
t \<in> covered_transitions M1 V (V q)

goal (1 subgoal):
 1. t \<in> list.set p &&& V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)
[PROOF STEP]
unfolding covered_transitions_def Let_def *
[PROOF STATE]
proof (prove)
using this:
t \<in> list.set (filter (\<lambda>t. V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)) p)

goal (1 subgoal):
 1. t \<in> list.set p &&& V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
t \<in> list.set p
V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)

goal (1 subgoal):
 1. \<And>x. x \<in> sc_covered_transitions \<Longrightarrow> x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}
[PROOF STEP]
have "t \<in> transitions M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. t \<in> FSM.transitions M1
[PROOF STEP]
using \<open>t \<in> list.set p\<close> \<open>path M1 (initial M1) p\<close>
[PROOF STATE]
proof (prove)
using this:
t \<in> list.set p
path M1 (FSM.initial M1) p

goal (1 subgoal):
 1. t \<in> FSM.transitions M1
[PROOF STEP]
by (meson path_transitions subsetD)
[PROOF STATE]
proof (state)
this:
t \<in> FSM.transitions M1

goal (1 subgoal):
 1. \<And>x. x \<in> sc_covered_transitions \<Longrightarrow> x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
t \<in> FSM.transitions M1

goal (1 subgoal):
 1. \<And>x. x \<in> sc_covered_transitions \<Longrightarrow> x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}
[PROOF STEP]
have "t_source t \<in> reachable_states M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. t_source t \<in> reachable_states M1
[PROOF STEP]
using reachable_states_path[OF reachable_states_initial \<open>path M1 (initial M1) p\<close> \<open>t \<in> list.set p\<close>]
[PROOF STATE]
proof (prove)
using this:
t_source t \<in> reachable_states M1

goal (1 subgoal):
 1. t_source t \<in> reachable_states M1
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
t_source t \<in> reachable_states M1

goal (1 subgoal):
 1. \<And>x. x \<in> sc_covered_transitions \<Longrightarrow> x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1
[PROOF STEP]
show "t \<in> ?B"
[PROOF STATE]
proof (prove)
using this:
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1

goal (1 subgoal):
 1. t \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}
[PROOF STEP]
using \<open>V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)\<close>
[PROOF STATE]
proof (prove)
using this:
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1
V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)

goal (1 subgoal):
 1. t \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
t \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
sc_covered_transitions \<subseteq> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}

goal (1 subgoal):
 1. {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]} \<subseteq> sc_covered_transitions
[PROOF STEP]
show "?B \<subseteq> ?A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]} \<subseteq> sc_covered_transitions
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]} \<Longrightarrow> x \<in> sc_covered_transitions
[PROOF STEP]
fix t
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]} \<Longrightarrow> x \<in> sc_covered_transitions
[PROOF STEP]
assume "t \<in> ?B"
[PROOF STATE]
proof (state)
this:
t \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}

goal (1 subgoal):
 1. \<And>x. x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]} \<Longrightarrow> x \<in> sc_covered_transitions
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
t \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}
[PROOF STEP]
have "t \<in> transitions M1"
                "t_source t \<in> reachable_states M1"
                "(V (t_source t))@[(t_input t, t_output t)] = V (t_target t)"
[PROOF STATE]
proof (prove)
using this:
t \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}

goal (1 subgoal):
 1. t \<in> FSM.transitions M1 &&& t_source t \<in> reachable_states M1 &&& V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1
V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)

goal (1 subgoal):
 1. \<And>x. x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]} \<Longrightarrow> x \<in> sc_covered_transitions
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1
V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)
[PROOF STEP]
have "t_target t \<in> reachable_states M1"
[PROOF STATE]
proof (prove)
using this:
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1
V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)

goal (1 subgoal):
 1. t_target t \<in> reachable_states M1
[PROOF STEP]
using reachable_states_next[of "t_source t" M1 t]
[PROOF STATE]
proof (prove)
using this:
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1
V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)
\<lbrakk>t_source t \<in> reachable_states M1; t \<in> FSM.transitions M1; t_source t = t_source t\<rbrakk> \<Longrightarrow> t_target t \<in> reachable_states M1

goal (1 subgoal):
 1. t_target t \<in> reachable_states M1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
t_target t \<in> reachable_states M1

goal (1 subgoal):
 1. \<And>x. x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]} \<Longrightarrow> x \<in> sc_covered_transitions
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
t_target t \<in> reachable_states M1
[PROOF STEP]
have "V (t_target t) \<in> L M1" and "after_initial M1 (V (t_target t)) = (t_target t)"
[PROOF STATE]
proof (prove)
using this:
t_target t \<in> reachable_states M1

goal (1 subgoal):
 1. V (t_target t) \<in> L M1 &&& after_initial M1 (V (t_target t)) = t_target t
[PROOF STEP]
using state_cover_assignment_after[OF assms(1) \<open>is_state_cover_assignment M1 V\<close>]
[PROOF STATE]
proof (prove)
using this:
t_target t \<in> reachable_states M1
?q \<in> reachable_states M1 \<Longrightarrow> V ?q \<in> L M1
?q \<in> reachable_states M1 \<Longrightarrow> after_initial M1 (V ?q) = ?q

goal (1 subgoal):
 1. V (t_target t) \<in> L M1 &&& after_initial M1 (V (t_target t)) = t_target t
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
V (t_target t) \<in> L M1
after_initial M1 (V (t_target t)) = t_target t

goal (1 subgoal):
 1. \<And>x. x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]} \<Longrightarrow> x \<in> sc_covered_transitions
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V (t_target t) \<in> L M1
after_initial M1 (V (t_target t)) = t_target t
[PROOF STEP]
obtain p where "path M1 (initial M1) p" and "p_io p = V (t_target t)"
[PROOF STATE]
proof (prove)
using this:
V (t_target t) \<in> L M1
after_initial M1 (V (t_target t)) = t_target t

goal (1 subgoal):
 1. (\<And>p. \<lbrakk>path M1 (FSM.initial M1) p; p_io p = V (t_target t)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
path M1 (FSM.initial M1) p
p_io p = V (t_target t)

goal (1 subgoal):
 1. \<And>x. x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]} \<Longrightarrow> x \<in> sc_covered_transitions
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
path M1 (FSM.initial M1) p
p_io p = V (t_target t)
[PROOF STEP]
have *: "the_elem (paths_for_io M1 (initial M1) (V (t_target t))) = p"
[PROOF STATE]
proof (prove)
using this:
path M1 (FSM.initial M1) p
p_io p = V (t_target t)

goal (1 subgoal):
 1. the_elem (paths_for_io M1 (FSM.initial M1) (V (t_target t))) = p
[PROOF STEP]
using observable_paths_for_io[OF assms(1) \<open>V (t_target t) \<in> L M1\<close>]
[PROOF STATE]
proof (prove)
using this:
path M1 (FSM.initial M1) p
p_io p = V (t_target t)
(\<And>p. paths_for_io M1 (FSM.initial M1) (V (t_target t)) = {p} \<Longrightarrow> ?thesis) \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. the_elem (paths_for_io M1 (FSM.initial M1) (V (t_target t))) = p
[PROOF STEP]
unfolding paths_for_io_def
[PROOF STATE]
proof (prove)
using this:
path M1 (FSM.initial M1) p
p_io p = V (t_target t)
(\<And>p. {p. path M1 (FSM.initial M1) p \<and> p_io p = V (t_target t)} = {p} \<Longrightarrow> ?thesis) \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. the_elem {p. path M1 (FSM.initial M1) p \<and> p_io p = V (t_target t)} = p
[PROOF STEP]
by (metis (mono_tags, lifting) assms(1) mem_Collect_eq observable_path_unique singletonI the_elem_eq)
[PROOF STATE]
proof (state)
this:
the_elem (paths_for_io M1 (FSM.initial M1) (V (t_target t))) = p

goal (1 subgoal):
 1. \<And>x. x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]} \<Longrightarrow> x \<in> sc_covered_transitions
[PROOF STEP]
have "V (t_source t) \<in> L M1" and "after_initial M1 (V (t_source t)) = (t_source t)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V (t_source t) \<in> L M1 &&& after_initial M1 (V (t_source t)) = t_source t
[PROOF STEP]
using \<open>t_source t \<in> reachable_states M1\<close>
[PROOF STATE]
proof (prove)
using this:
t_source t \<in> reachable_states M1

goal (1 subgoal):
 1. V (t_source t) \<in> L M1 &&& after_initial M1 (V (t_source t)) = t_source t
[PROOF STEP]
using state_cover_assignment_after[OF assms(1) \<open>is_state_cover_assignment M1 V\<close>]
[PROOF STATE]
proof (prove)
using this:
t_source t \<in> reachable_states M1
?q \<in> reachable_states M1 \<Longrightarrow> V ?q \<in> L M1
?q \<in> reachable_states M1 \<Longrightarrow> after_initial M1 (V ?q) = ?q

goal (1 subgoal):
 1. V (t_source t) \<in> L M1 &&& after_initial M1 (V (t_source t)) = t_source t
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
V (t_source t) \<in> L M1
after_initial M1 (V (t_source t)) = t_source t

goal (1 subgoal):
 1. \<And>x. x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]} \<Longrightarrow> x \<in> sc_covered_transitions
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V (t_source t) \<in> L M1
after_initial M1 (V (t_source t)) = t_source t
[PROOF STEP]
obtain p' where "path M1 (initial M1) p'" and "p_io p' = V (t_source t)"
[PROOF STATE]
proof (prove)
using this:
V (t_source t) \<in> L M1
after_initial M1 (V (t_source t)) = t_source t

goal (1 subgoal):
 1. (\<And>p'. \<lbrakk>path M1 (FSM.initial M1) p'; p_io p' = V (t_source t)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
path M1 (FSM.initial M1) p'
p_io p' = V (t_source t)

goal (1 subgoal):
 1. \<And>x. x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]} \<Longrightarrow> x \<in> sc_covered_transitions
[PROOF STEP]
have "path M1 (initial M1) (p'@[t])"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. path M1 (FSM.initial M1) (p' @ [t])
[PROOF STEP]
using after_path[OF assms(1) \<open>path M1 (initial M1) p'\<close>] \<open>path M1 (initial M1) p'\<close> \<open>t\<in>transitions M1\<close>
[PROOF STATE]
proof (prove)
using this:
after_initial M1 (p_io p') = target (FSM.initial M1) p'
path M1 (FSM.initial M1) p'
t \<in> FSM.transitions M1

goal (1 subgoal):
 1. path M1 (FSM.initial M1) (p' @ [t])
[PROOF STEP]
unfolding \<open>p_io p' = V (t_source t)\<close>
[PROOF STATE]
proof (prove)
using this:
after_initial M1 (V (t_source t)) = target (FSM.initial M1) p'
path M1 (FSM.initial M1) p'
t \<in> FSM.transitions M1

goal (1 subgoal):
 1. path M1 (FSM.initial M1) (p' @ [t])
[PROOF STEP]
unfolding \<open>after_initial M1 (V (t_source t)) = (t_source t)\<close>
[PROOF STATE]
proof (prove)
using this:
t_source t = target (FSM.initial M1) p'
path M1 (FSM.initial M1) p'
t \<in> FSM.transitions M1

goal (1 subgoal):
 1. path M1 (FSM.initial M1) (p' @ [t])
[PROOF STEP]
by (metis path_append single_transition_path)
[PROOF STATE]
proof (state)
this:
path M1 (FSM.initial M1) (p' @ [t])

goal (1 subgoal):
 1. \<And>x. x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]} \<Longrightarrow> x \<in> sc_covered_transitions
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
path M1 (FSM.initial M1) (p' @ [t])

goal (1 subgoal):
 1. \<And>x. x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]} \<Longrightarrow> x \<in> sc_covered_transitions
[PROOF STEP]
have "p_io (p'@[t]) = p_io p"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p_io (p' @ [t]) = p_io p
[PROOF STEP]
using \<open>p_io p' = V (t_source t)\<close>
[PROOF STATE]
proof (prove)
using this:
p_io p' = V (t_source t)

goal (1 subgoal):
 1. p_io (p' @ [t]) = p_io p
[PROOF STEP]
unfolding \<open>p_io p = V (t_target t)\<close>  \<open>(V (t_source t))@[(t_input t, t_output t)] = V (t_target t)\<close>[symmetric]
[PROOF STATE]
proof (prove)
using this:
p_io p' = V (t_source t)

goal (1 subgoal):
 1. p_io (p' @ [t]) = V (t_source t) @ [(t_input t, t_output t)]
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
p_io (p' @ [t]) = p_io p

goal (1 subgoal):
 1. \<And>x. x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]} \<Longrightarrow> x \<in> sc_covered_transitions
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
path M1 (FSM.initial M1) (p' @ [t])
p_io (p' @ [t]) = p_io p
[PROOF STEP]
have "p'@[t] = p"
[PROOF STATE]
proof (prove)
using this:
path M1 (FSM.initial M1) (p' @ [t])
p_io (p' @ [t]) = p_io p

goal (1 subgoal):
 1. p' @ [t] = p
[PROOF STEP]
using observable_path_unique[OF assms(1) _ \<open>path M1 (initial M1) p\<close>]
[PROOF STATE]
proof (prove)
using this:
path M1 (FSM.initial M1) (p' @ [t])
p_io (p' @ [t]) = p_io p
\<lbrakk>path M1 (FSM.initial M1) ?p; p_io ?p = p_io p\<rbrakk> \<Longrightarrow> ?p = p

goal (1 subgoal):
 1. p' @ [t] = p
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
p' @ [t] = p

goal (1 subgoal):
 1. \<And>x. x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]} \<Longrightarrow> x \<in> sc_covered_transitions
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
p' @ [t] = p
[PROOF STEP]
have "t \<in> list.set p"
[PROOF STATE]
proof (prove)
using this:
p' @ [t] = p

goal (1 subgoal):
 1. t \<in> list.set p
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
t \<in> list.set p

goal (1 subgoal):
 1. \<And>x. x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]} \<Longrightarrow> x \<in> sc_covered_transitions
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
t \<in> list.set p
[PROOF STEP]
have "t \<in> covered_transitions M1 V (V (t_target t))"
[PROOF STATE]
proof (prove)
using this:
t \<in> list.set p

goal (1 subgoal):
 1. t \<in> covered_transitions M1 V (V (t_target t))
[PROOF STEP]
using \<open>(V (t_source t))@[(t_input t, t_output t)] = V (t_target t)\<close>
[PROOF STATE]
proof (prove)
using this:
t \<in> list.set p
V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)

goal (1 subgoal):
 1. t \<in> covered_transitions M1 V (V (t_target t))
[PROOF STEP]
unfolding covered_transitions_def Let_def *
[PROOF STATE]
proof (prove)
using this:
t \<in> list.set p
V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)

goal (1 subgoal):
 1. t \<in> list.set (filter (\<lambda>t. V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)) p)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
t \<in> covered_transitions M1 V (V (t_target t))

goal (1 subgoal):
 1. \<And>x. x \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]} \<Longrightarrow> x \<in> sc_covered_transitions
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
t \<in> covered_transitions M1 V (V (t_target t))
[PROOF STEP]
show "t \<in> ?A"
[PROOF STATE]
proof (prove)
using this:
t \<in> covered_transitions M1 V (V (t_target t))

goal (1 subgoal):
 1. t \<in> sc_covered_transitions
[PROOF STEP]
using \<open>t_target t \<in> reachable_states M1\<close>
[PROOF STATE]
proof (prove)
using this:
t \<in> covered_transitions M1 V (V (t_target t))
t_target t \<in> reachable_states M1

goal (1 subgoal):
 1. t \<in> sc_covered_transitions
[PROOF STEP]
unfolding sc_covered_transitions
[PROOF STATE]
proof (prove)
using this:
t \<in> covered_transitions M1 V (V (t_target t))
t_target t \<in> reachable_states M1

goal (1 subgoal):
 1. t \<in> (\<Union>q\<in>reachable_states M1. covered_transitions M1 V (V q))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
t \<in> sc_covered_transitions

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
{t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]} \<subseteq> sc_covered_transitions

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
sc_covered_transitions = {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have T1_covered_transitions_conv: "\<And> t . (L M1 \<inter> set T1 = (L M2 \<inter> set T1)) \<Longrightarrow> t \<in> sc_covered_transitions \<Longrightarrow> converge M2 (V (t_target t)) ((V (t_source t))@[(t_input t, t_output t)])"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>t. \<lbrakk>L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1; t \<in> sc_covered_transitions\<rbrakk> \<Longrightarrow> converge M2 (V (t_target t)) (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>t. \<lbrakk>L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1; t \<in> sc_covered_transitions\<rbrakk> \<Longrightarrow> converge M2 (V (t_target t)) (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
fix t
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>t. \<lbrakk>L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1; t \<in> sc_covered_transitions\<rbrakk> \<Longrightarrow> converge M2 (V (t_target t)) (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
assume "(L M1 \<inter> set T1 = (L M2 \<inter> set T1))"
                 "t \<in> sc_covered_transitions"
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1
t \<in> sc_covered_transitions

goal (1 subgoal):
 1. \<And>t. \<lbrakk>L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1; t \<in> sc_covered_transitions\<rbrakk> \<Longrightarrow> converge M2 (V (t_target t)) (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1
t \<in> sc_covered_transitions
[PROOF STEP]
have "t \<in> transitions M1"
              "t_source t \<in> reachable_states M1"
              "(V (t_source t))@[(t_input t, t_output t)] = V (t_target t)"
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1
t \<in> sc_covered_transitions

goal (1 subgoal):
 1. t \<in> FSM.transitions M1 &&& t_source t \<in> reachable_states M1 &&& V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)
[PROOF STEP]
unfolding sc_covered_transitions_alt_def
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1
t \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}

goal (1 subgoal):
 1. t \<in> FSM.transitions M1 &&& t_source t \<in> reachable_states M1 &&& V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1
V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)

goal (1 subgoal):
 1. \<And>t. \<lbrakk>L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1; t \<in> sc_covered_transitions\<rbrakk> \<Longrightarrow> converge M2 (V (t_target t)) (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1
V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)
[PROOF STEP]
have "t_target t \<in> reachable_states M1"
[PROOF STATE]
proof (prove)
using this:
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1
V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)

goal (1 subgoal):
 1. t_target t \<in> reachable_states M1
[PROOF STEP]
using reachable_states_next[of "t_source t" M1 t]
[PROOF STATE]
proof (prove)
using this:
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1
V (t_source t) @ [(t_input t, t_output t)] = V (t_target t)
\<lbrakk>t_source t \<in> reachable_states M1; t \<in> FSM.transitions M1; t_source t = t_source t\<rbrakk> \<Longrightarrow> t_target t \<in> reachable_states M1

goal (1 subgoal):
 1. t_target t \<in> reachable_states M1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
t_target t \<in> reachable_states M1

goal (1 subgoal):
 1. \<And>t. \<lbrakk>L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1; t \<in> sc_covered_transitions\<rbrakk> \<Longrightarrow> converge M2 (V (t_target t)) (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
t_target t \<in> reachable_states M1
[PROOF STEP]
have "V (t_target t) \<in> L M1"
[PROOF STATE]
proof (prove)
using this:
t_target t \<in> reachable_states M1

goal (1 subgoal):
 1. V (t_target t) \<in> L M1
[PROOF STEP]
using state_cover_assignment_after[OF assms(1) \<open>is_state_cover_assignment M1 V\<close>]
[PROOF STATE]
proof (prove)
using this:
t_target t \<in> reachable_states M1
?q \<in> reachable_states M1 \<Longrightarrow> V ?q \<in> L M1
?q \<in> reachable_states M1 \<Longrightarrow> after_initial M1 (V ?q) = ?q

goal (1 subgoal):
 1. V (t_target t) \<in> L M1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V (t_target t) \<in> L M1

goal (1 subgoal):
 1. \<And>t. \<lbrakk>L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1; t \<in> sc_covered_transitions\<rbrakk> \<Longrightarrow> converge M2 (V (t_target t)) (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
V (t_target t) \<in> L M1

goal (1 subgoal):
 1. \<And>t. \<lbrakk>L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1; t \<in> sc_covered_transitions\<rbrakk> \<Longrightarrow> converge M2 (V (t_target t)) (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
have "V (t_target t) \<in> set T1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V (t_target t) \<in> Prefix_Tree.set T1
[PROOF STEP]
using T1_state_cover \<open>t_target t \<in> reachable_states M1\<close>
[PROOF STATE]
proof (prove)
using this:
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T1
t_target t \<in> reachable_states M1

goal (1 subgoal):
 1. V (t_target t) \<in> Prefix_Tree.set T1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V (t_target t) \<in> Prefix_Tree.set T1

goal (1 subgoal):
 1. \<And>t. \<lbrakk>L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1; t \<in> sc_covered_transitions\<rbrakk> \<Longrightarrow> converge M2 (V (t_target t)) (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
V (t_target t) \<in> L M1
V (t_target t) \<in> Prefix_Tree.set T1
[PROOF STEP]
have "V (t_target t) \<in> L M2"
[PROOF STATE]
proof (prove)
using this:
V (t_target t) \<in> L M1
V (t_target t) \<in> Prefix_Tree.set T1

goal (1 subgoal):
 1. V (t_target t) \<in> L M2
[PROOF STEP]
using \<open>(L M1 \<inter> set T1 = (L M2 \<inter> set T1))\<close>
[PROOF STATE]
proof (prove)
using this:
V (t_target t) \<in> L M1
V (t_target t) \<in> Prefix_Tree.set T1
L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1

goal (1 subgoal):
 1. V (t_target t) \<in> L M2
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V (t_target t) \<in> L M2

goal (1 subgoal):
 1. \<And>t. \<lbrakk>L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1; t \<in> sc_covered_transitions\<rbrakk> \<Longrightarrow> converge M2 (V (t_target t)) (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V (t_target t) \<in> L M2
[PROOF STEP]
show "converge M2 (V (t_target t)) ((V (t_source t))@[(t_input t, t_output t)])"
[PROOF STATE]
proof (prove)
using this:
V (t_target t) \<in> L M2

goal (1 subgoal):
 1. converge M2 (V (t_target t)) (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
unfolding \<open>(V (t_source t))@[(t_input t, t_output t)] = V (t_target t)\<close>
[PROOF STATE]
proof (prove)
using this:
V (t_target t) \<in> L M2

goal (1 subgoal):
 1. converge M2 (V (t_target t)) (V (t_target t))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M2 (V (t_target t)) (V (t_source t) @ [(t_input t, t_output t)])

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1; ?t \<in> sc_covered_transitions\<rbrakk> \<Longrightarrow> converge M2 (V (t_target ?t)) (V (t_source ?t) @ [(t_input ?t, t_output ?t)])

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have unverified_transitions_alt_def : "list.set unverified_transitions = {t . t \<in> transitions M1 \<and> t_source t \<in> reachable_states M1 \<and> (V (t_target t) \<noteq> (V (t_source t))@[(t_input t, t_output t)])}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list.set unverified_transitions = {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) \<noteq> V (t_source t) @ [(t_input t, t_output t)]}
[PROOF STEP]
unfolding unverified_transitions sc_covered_transitions_alt_def V
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list.set (sort_unverified_transitions M1 (get_state_cover M1) (filter (\<lambda>t. t_source t \<in> reachable_states M1 \<and> t \<notin> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> get_state_cover M1 (t_target t) = get_state_cover M1 (t_source t) @ [(t_input t, t_output t)]}) (transitions_as_list M1))) = {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> get_state_cover M1 (t_target t) \<noteq> get_state_cover M1 (t_source t) @ [(t_input t, t_output t)]}
[PROOF STEP]
unfolding assms(10)[symmetric]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list.set (filter (\<lambda>t. t_source t \<in> reachable_states M1 \<and> t \<notin> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> get_state_cover M1 (t_target t) = get_state_cover M1 (t_source t) @ [(t_input t, t_output t)]}) (transitions_as_list M1)) = {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> get_state_cover M1 (t_target t) \<noteq> get_state_cover M1 (t_source t) @ [(t_input t, t_output t)]}
[PROOF STEP]
using transitions_as_list_set[of M1]
[PROOF STATE]
proof (prove)
using this:
list.set (transitions_as_list M1) = FSM.transitions M1

goal (1 subgoal):
 1. list.set (filter (\<lambda>t. t_source t \<in> reachable_states M1 \<and> t \<notin> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> get_state_cover M1 (t_target t) = get_state_cover M1 (t_source t) @ [(t_input t, t_output t)]}) (transitions_as_list M1)) = {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> get_state_cover M1 (t_target t) \<noteq> get_state_cover M1 (t_source t) @ [(t_input t, t_output t)]}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
list.set unverified_transitions = {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) \<noteq> V (t_source t) @ [(t_input t, t_output t)]}

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
(* remaining properties before the computation of TG2 *)
[PROOF STATE]
proof (state)
this:
list.set unverified_transitions = {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) \<noteq> V (t_source t) @ [(t_input t, t_output t)]}

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have cg_insert_invar : "\<And> G \<gamma> . \<gamma> \<in> L M1 \<Longrightarrow> \<gamma> \<in> L M2 \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (cg_insert G \<gamma>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>G \<gamma>. \<lbrakk>\<gamma> \<in> L M1; \<gamma> \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (cg_insert G \<gamma>)
[PROOF STEP]
using assms(12)
[PROOF STATE]
proof (prove)
using this:
convergence_graph_insert_invar M1 M2 cg_lookup cg_insert

goal (1 subgoal):
 1. \<And>G \<gamma>. \<lbrakk>\<gamma> \<in> L M1; \<gamma> \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (cg_insert G \<gamma>)
[PROOF STEP]
unfolding convergence_graph_insert_invar_def
[PROOF STATE]
proof (prove)
using this:
\<forall>G \<gamma>. \<gamma> \<in> L M1 \<longrightarrow> \<gamma> \<in> L M2 \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (cg_insert G \<gamma>)

goal (1 subgoal):
 1. \<And>G \<gamma>. \<lbrakk>\<gamma> \<in> L M1; \<gamma> \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup G\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (cg_insert G \<gamma>)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>?\<gamma> \<in> L M1; ?\<gamma> \<in> L M2; convergence_graph_lookup_invar M1 M2 cg_lookup ?G\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (cg_insert ?G ?\<gamma>)

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have cg_merge_invar : "\<And> G \<gamma> \<gamma>'. convergence_graph_lookup_invar M1 M2 cg_lookup G \<Longrightarrow> converge M1 \<gamma> \<gamma>' \<Longrightarrow> converge M2 \<gamma> \<gamma>' \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (cg_merge G \<gamma> \<gamma>')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>G \<gamma> \<gamma>'. \<lbrakk>convergence_graph_lookup_invar M1 M2 cg_lookup G; converge M1 \<gamma> \<gamma>'; converge M2 \<gamma> \<gamma>'\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (cg_merge G \<gamma> \<gamma>')
[PROOF STEP]
using assms(13)
[PROOF STATE]
proof (prove)
using this:
convergence_graph_merge_invar M1 M2 cg_lookup cg_merge

goal (1 subgoal):
 1. \<And>G \<gamma> \<gamma>'. \<lbrakk>convergence_graph_lookup_invar M1 M2 cg_lookup G; converge M1 \<gamma> \<gamma>'; converge M2 \<gamma> \<gamma>'\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (cg_merge G \<gamma> \<gamma>')
[PROOF STEP]
unfolding convergence_graph_merge_invar_def
[PROOF STATE]
proof (prove)
using this:
\<forall>G \<gamma> \<gamma>'. converge M1 \<gamma> \<gamma>' \<longrightarrow> converge M2 \<gamma> \<gamma>' \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (cg_merge G \<gamma> \<gamma>')

goal (1 subgoal):
 1. \<And>G \<gamma> \<gamma>'. \<lbrakk>convergence_graph_lookup_invar M1 M2 cg_lookup G; converge M1 \<gamma> \<gamma>'; converge M2 \<gamma> \<gamma>'\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (cg_merge G \<gamma> \<gamma>')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>convergence_graph_lookup_invar M1 M2 cg_lookup ?G; converge M1 ?\<gamma> ?\<gamma>'; converge M2 ?\<gamma> ?\<gamma>'\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (cg_merge ?G ?\<gamma> ?\<gamma>')

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
(* properties of the computation of TG2 *)
[PROOF STATE]
proof (state)
this:
\<lbrakk>convergence_graph_lookup_invar M1 M2 cg_lookup ?G; converge M1 ?\<gamma> ?\<gamma>'; converge M2 ?\<gamma> ?\<gamma>'\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (cg_merge ?G ?\<gamma> ?\<gamma>')

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
define T2 where T2: "T2 = fst TG2"
[PROOF STATE]
proof (state)
this:
T2 = fst TG2

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
define G2 where G2: "G2 = snd TG2"
[PROOF STATE]
proof (state)
this:
G2 = snd TG2

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
(* idea: in each application of verify_transition, a further transition of unverified_transitions
           (q,x,y,q') is covered - that is
            - traces \<alpha>.(x/y), \<beta> are added to the test suite such that
              - \<alpha> converges with V s in both M1 and M2
              - \<beta> converges with V s' in both M1 and M2
              - \<alpha>.(x/y) converges with \<beta> in both M1 and M2
            - the test suite is added as required to establish this convergence
            - the convergence graph is updated, respecting the lookup-invariants due to convergence (in merge)
  *)
[PROOF STATE]
proof (state)
this:
G2 = snd TG2

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have verify_transition_retains_testsuite: "\<And> t T G . set T \<subseteq> set (fst (verify_transition (T,G) t))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>t T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (verify_transition (T, G) t))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>t T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (verify_transition (T, G) t))
[PROOF STEP]
fix t T G
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>t T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (verify_transition (T, G) t))
[PROOF STEP]
define TGxy where TGxy: "TGxy = append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t)"
[PROOF STATE]
proof (state)
this:
TGxy = append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t)

goal (1 subgoal):
 1. \<And>t T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (verify_transition (T, G) t))
[PROOF STEP]
obtain T' G' where TG': "(T',G') = establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>T' G'. (T', G') = establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using prod.exhaust
[PROOF STATE]
proof (prove)
using this:
(\<And>x1 x2. ?y = (x1, x2) \<Longrightarrow> ?P) \<Longrightarrow> ?P

goal (1 subgoal):
 1. (\<And>T' G'. (T', G') = establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
(T', G') = establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t

goal (1 subgoal):
 1. \<And>t T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (verify_transition (T, G) t))
[PROOF STEP]
define G'' where G'': "G'' = cg_merge G' ((V (t_source t)) @ [(t_input t, t_output t)]) (V (t_target t))"
[PROOF STATE]
proof (state)
this:
G'' = cg_merge G' (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))

goal (1 subgoal):
 1. \<And>t T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (verify_transition (T, G) t))
[PROOF STEP]
have *:"verify_transition (T,G) t = (T',G'')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. verify_transition (T, G) t = (T', G'')
[PROOF STEP]
using TG'[symmetric]
[PROOF STATE]
proof (prove)
using this:
establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t = (T', G')

goal (1 subgoal):
 1. verify_transition (T, G) t = (T', G'')
[PROOF STEP]
unfolding verify_transition G'' TGxy Let_def case_prod_conv
[PROOF STATE]
proof (prove)
using this:
establish_convergence M1 V (fst (append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) (snd (append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) cg_insert cg_lookup m t = (T', G')

goal (1 subgoal):
 1. (case establish_convergence M1 V (fst (append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) (snd (append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) cg_insert cg_lookup m t of (T', G') \<Rightarrow> (T', cg_merge G' (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)))) = (T', cg_merge G' (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)))
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
verify_transition (T, G) t = (T', G'')

goal (1 subgoal):
 1. \<And>t T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (verify_transition (T, G) t))
[PROOF STEP]
have "set T \<subseteq> set (fst TGxy)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TGxy)
[PROOF STEP]
using \<open>verifies_io_pair append_io_pair M1 M2 cg_insert cg_lookup\<close>
[PROOF STATE]
proof (prove)
using this:
verifies_io_pair append_io_pair M1 M2 cg_insert cg_lookup

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TGxy)
[PROOF STEP]
unfolding verifies_io_pair_def TGxy
[PROOF STATE]
proof (prove)
using this:
\<forall>V T G q x y. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1 \<longrightarrow> q \<in> reachable_states M1 \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) = L M2 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<longrightarrow> (\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y))) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (append_io_pair M1 V T G cg_insert cg_lookup q x y)))

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TGxy)

goal (1 subgoal):
 1. \<And>t T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (verify_transition (T, G) t))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TGxy)

goal (1 subgoal):
 1. \<And>t T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (verify_transition (T, G) t))
[PROOF STEP]
have "set (fst TGxy) \<subseteq> set (fst (T',G'))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (fst TGxy) \<subseteq> Prefix_Tree.set (fst (T', G'))
[PROOF STEP]
using \<open>verifies_transition establish_convergence M1 M2 V T1 cg_insert cg_lookup\<close>
[PROOF STATE]
proof (prove)
using this:
verifies_transition establish_convergence M1 M2 V T1 cg_insert cg_lookup

goal (1 subgoal):
 1. Prefix_Tree.set (fst TGxy) \<subseteq> Prefix_Tree.set (fst (T', G'))
[PROOF STEP]
unfolding TG' verifies_transition_def
[PROOF STATE]
proof (prove)
using this:
\<forall>T G m t. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (establish_convergence M1 V T G cg_insert cg_lookup m t)) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (establish_convergence M1 V T G cg_insert cg_lookup m t))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<in> L M2 \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (establish_convergence M1 V T G cg_insert cg_lookup m t)) = L M2 \<inter> Prefix_Tree.set (fst (establish_convergence M1 V T G cg_insert cg_lookup m t)) \<longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T \<longrightarrow> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence M1 V T G cg_insert cg_lookup m t)))

goal (1 subgoal):
 1. Prefix_Tree.set (fst TGxy) \<subseteq> Prefix_Tree.set (fst (establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst TGxy) \<subseteq> Prefix_Tree.set (fst (T', G'))

goal (1 subgoal):
 1. \<And>t T G. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (verify_transition (T, G) t))
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (T', G'))
[PROOF STEP]
show "set T \<subseteq> set (fst (verify_transition (T,G) t))"
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (T', G'))

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (verify_transition (T, G) t))
[PROOF STEP]
unfolding * fst_conv
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (verify_transition (T, G) t))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (verify_transition (?T, ?G) ?t))

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have verify_transition_retains_finiteness: "\<And> t T G . finite_tree T \<Longrightarrow> finite_tree (fst (verify_transition (T,G) t))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>t T G. finite_tree T \<Longrightarrow> finite_tree (fst (verify_transition (T, G) t))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>t T G. finite_tree T \<Longrightarrow> finite_tree (fst (verify_transition (T, G) t))
[PROOF STEP]
fix T :: "('b\<times>'c) prefix_tree"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>t T G. finite_tree T \<Longrightarrow> finite_tree (fst (verify_transition (T, G) t))
[PROOF STEP]
fix t G
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>t T G. finite_tree T \<Longrightarrow> finite_tree (fst (verify_transition (T, G) t))
[PROOF STEP]
assume "finite_tree T"
[PROOF STATE]
proof (state)
this:
finite_tree T

goal (1 subgoal):
 1. \<And>t T G. finite_tree T \<Longrightarrow> finite_tree (fst (verify_transition (T, G) t))
[PROOF STEP]
define TGxy where TGxy: "TGxy = append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t)"
[PROOF STATE]
proof (state)
this:
TGxy = append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t)

goal (1 subgoal):
 1. \<And>t T G. finite_tree T \<Longrightarrow> finite_tree (fst (verify_transition (T, G) t))
[PROOF STEP]
obtain T' G' where TG': "(T',G') = establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>T' G'. (T', G') = establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using prod.exhaust
[PROOF STATE]
proof (prove)
using this:
(\<And>x1 x2. ?y = (x1, x2) \<Longrightarrow> ?P) \<Longrightarrow> ?P

goal (1 subgoal):
 1. (\<And>T' G'. (T', G') = establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
(T', G') = establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t

goal (1 subgoal):
 1. \<And>t T G. finite_tree T \<Longrightarrow> finite_tree (fst (verify_transition (T, G) t))
[PROOF STEP]
define G'' where G'': "G'' = cg_merge G' ((V (t_source t)) @ [(t_input t, t_output t)]) (V (t_target t))"
[PROOF STATE]
proof (state)
this:
G'' = cg_merge G' (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))

goal (1 subgoal):
 1. \<And>t T G. finite_tree T \<Longrightarrow> finite_tree (fst (verify_transition (T, G) t))
[PROOF STEP]
have *:"verify_transition (T,G) t = (T',G'')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. verify_transition (T, G) t = (T', G'')
[PROOF STEP]
using TG'[symmetric]
[PROOF STATE]
proof (prove)
using this:
establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t = (T', G')

goal (1 subgoal):
 1. verify_transition (T, G) t = (T', G'')
[PROOF STEP]
unfolding verify_transition G'' TGxy Let_def case_prod_conv
[PROOF STATE]
proof (prove)
using this:
establish_convergence M1 V (fst (append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) (snd (append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) cg_insert cg_lookup m t = (T', G')

goal (1 subgoal):
 1. (case establish_convergence M1 V (fst (append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) (snd (append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) cg_insert cg_lookup m t of (T', G') \<Rightarrow> (T', cg_merge G' (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)))) = (T', cg_merge G' (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)))
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
verify_transition (T, G) t = (T', G'')

goal (1 subgoal):
 1. \<And>t T G. finite_tree T \<Longrightarrow> finite_tree (fst (verify_transition (T, G) t))
[PROOF STEP]
have "finite_tree (fst TGxy)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite_tree (fst TGxy)
[PROOF STEP]
using \<open>verifies_io_pair append_io_pair M1 M2 cg_insert cg_lookup\<close> \<open>finite_tree T\<close>
[PROOF STATE]
proof (prove)
using this:
verifies_io_pair append_io_pair M1 M2 cg_insert cg_lookup
finite_tree T

goal (1 subgoal):
 1. finite_tree (fst TGxy)
[PROOF STEP]
unfolding verifies_io_pair_def TGxy
[PROOF STATE]
proof (prove)
using this:
\<forall>V T G q x y. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1 \<longrightarrow> q \<in> reachable_states M1 \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) = L M2 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<longrightarrow> (\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y))) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (append_io_pair M1 V T G cg_insert cg_lookup q x y)))
finite_tree T

goal (1 subgoal):
 1. finite_tree (fst (append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
finite_tree (fst TGxy)

goal (1 subgoal):
 1. \<And>t T G. finite_tree T \<Longrightarrow> finite_tree (fst (verify_transition (T, G) t))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
finite_tree (fst TGxy)
[PROOF STEP]
have "finite_tree (fst (T',G'))"
[PROOF STATE]
proof (prove)
using this:
finite_tree (fst TGxy)

goal (1 subgoal):
 1. finite_tree (fst (T', G'))
[PROOF STEP]
using \<open>verifies_transition establish_convergence M1 M2 V T1 cg_insert cg_lookup\<close>
[PROOF STATE]
proof (prove)
using this:
finite_tree (fst TGxy)
verifies_transition establish_convergence M1 M2 V T1 cg_insert cg_lookup

goal (1 subgoal):
 1. finite_tree (fst (T', G'))
[PROOF STEP]
unfolding TG' verifies_transition_def
[PROOF STATE]
proof (prove)
using this:
finite_tree (fst TGxy)
\<forall>T G m t. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (establish_convergence M1 V T G cg_insert cg_lookup m t)) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (establish_convergence M1 V T G cg_insert cg_lookup m t))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<in> L M2 \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (establish_convergence M1 V T G cg_insert cg_lookup m t)) = L M2 \<inter> Prefix_Tree.set (fst (establish_convergence M1 V T G cg_insert cg_lookup m t)) \<longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T \<longrightarrow> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence M1 V T G cg_insert cg_lookup m t)))

goal (1 subgoal):
 1. finite_tree (fst (establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
finite_tree (fst (T', G'))

goal (1 subgoal):
 1. \<And>t T G. finite_tree T \<Longrightarrow> finite_tree (fst (verify_transition (T, G) t))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
finite_tree (fst (T', G'))
[PROOF STEP]
show "finite_tree (fst (verify_transition (T,G) t))"
[PROOF STATE]
proof (prove)
using this:
finite_tree (fst (T', G'))

goal (1 subgoal):
 1. finite_tree (fst (verify_transition (T, G) t))
[PROOF STEP]
unfolding * fst_conv
[PROOF STATE]
proof (prove)
using this:
finite_tree T'

goal (1 subgoal):
 1. finite_tree T'
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
finite_tree (fst (verify_transition (T, G) t))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
finite_tree ?T \<Longrightarrow> finite_tree (fst (verify_transition (?T, ?G) ?t))

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
define covers_unverified_transition
    where covers_unverified_transition: "covers_unverified_transition  = (\<lambda>t (T',G') .
                                                ((\<exists> \<alpha> \<beta> . converge M1 \<alpha> (V (t_source t)) \<and>
                                                          converge M2 \<alpha> (V (t_source t)) \<and>
                                                          converge M1 \<beta> (V (t_target t)) \<and>
                                                          converge M2 \<beta> (V (t_target t)) \<and>
                                                          \<alpha>@[(t_input t,t_output t)] \<in> (set T') \<and>
                                                          \<beta> \<in> (set T'))
                                                  \<and> (converge M2 ((V (t_source t)) @ [(t_input t,t_output t)]) (V (t_target t)))
                                                  \<and> convergence_graph_lookup_invar M1 M2 cg_lookup G'))"
[PROOF STATE]
proof (state)
this:
covers_unverified_transition = (\<lambda>t (T', G'). (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T') \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup G')

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have verify_transition_cover_prop: "\<And> t T G . (L M1 \<inter> (set (fst (verify_transition (T,G) t))) = L M2 \<inter> (set (fst (verify_transition (T,G) t))))
                                          \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G
                                          \<Longrightarrow> t \<in> transitions M1
                                          \<Longrightarrow> t_source t \<in> reachable_states M1
                                          \<Longrightarrow> ((V (t_source t)) @ [(t_input t,t_output t)]) \<noteq> (V (t_target t))
                                          \<Longrightarrow> set T1 \<subseteq> set T
                                          \<Longrightarrow> covers_unverified_transition t (verify_transition (T,G) t)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
fix t T G
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
assume a1: "(L M1 \<inter> (set (fst (verify_transition (T,G) t))) = L M2 \<inter> (set (fst (verify_transition (T,G) t))))"
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t))

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
assume a2: "convergence_graph_lookup_invar M1 M2 cg_lookup G"
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup G

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
assume a3: "t \<in> transitions M1"
[PROOF STATE]
proof (state)
this:
t \<in> FSM.transitions M1

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
assume a4: "t_source t \<in> reachable_states M1"
[PROOF STATE]
proof (state)
this:
t_source t \<in> reachable_states M1

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
assume a5: "set T1 \<subseteq> set T"
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
assume a6: "((V (t_source t)) @ [(t_input t,t_output t)]) \<noteq> (V (t_target t))"
[PROOF STATE]
proof (state)
this:
V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t)

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
define TGxy where TGxy: "TGxy = append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t)"
[PROOF STATE]
proof (state)
this:
TGxy = append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t)

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
obtain T' G' where TG': "(T',G') = establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>T' G'. (T', G') = establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using prod.exhaust
[PROOF STATE]
proof (prove)
using this:
(\<And>x1 x2. ?y = (x1, x2) \<Longrightarrow> ?P) \<Longrightarrow> ?P

goal (1 subgoal):
 1. (\<And>T' G'. (T', G') = establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
(T', G') = establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
have T':  "T'  = fst (establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t)"
     and G':  "G'  = snd (establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. T' = fst (establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t) &&& G' = snd (establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t)
[PROOF STEP]
unfolding TG'[symmetric]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. T' = fst (T', G') &&& G' = snd (T', G')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
T' = fst (establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t)
G' = snd (establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t)

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
define G'' where G'': "G'' = cg_merge G' ((V (t_source t)) @ [(t_input t, t_output t)]) (V (t_target t))"
[PROOF STATE]
proof (state)
this:
G'' = cg_merge G' (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
have "verify_transition (T,G) t = (T',G'')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. verify_transition (T, G) t = (T', G'')
[PROOF STEP]
using TG'[symmetric]
[PROOF STATE]
proof (prove)
using this:
establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t = (T', G')

goal (1 subgoal):
 1. verify_transition (T, G) t = (T', G'')
[PROOF STEP]
unfolding verify_transition G'' TGxy Let_def case_prod_conv
[PROOF STATE]
proof (prove)
using this:
establish_convergence M1 V (fst (append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) (snd (append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) cg_insert cg_lookup m t = (T', G')

goal (1 subgoal):
 1. (case establish_convergence M1 V (fst (append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) (snd (append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) cg_insert cg_lookup m t of (T', G') \<Rightarrow> (T', cg_merge G' (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)))) = (T', cg_merge G' (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)))
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
verify_transition (T, G) t = (T', G'')

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
verify_transition (T, G) t = (T', G'')
[PROOF STEP]
have "set T \<subseteq> set T'"
[PROOF STATE]
proof (prove)
using this:
verify_transition (T, G) t = (T', G'')

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'
[PROOF STEP]
using verify_transition_retains_testsuite[of T G t]
[PROOF STATE]
proof (prove)
using this:
verify_transition (T, G) t = (T', G'')
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (verify_transition (T, G) t))

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'
[PROOF STEP]
unfolding T'
[PROOF STATE]
proof (prove)
using this:
verify_transition (T, G) t = (fst (establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t), G'')
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (verify_transition (T, G) t))

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'
[PROOF STEP]
have "(L M1 \<inter> (set T1) = L M2 \<inter> (set T1))"
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1
[PROOF STEP]
using a1 a5
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'
L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t))
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1
[PROOF STEP]
unfolding \<open>verify_transition (T,G) t = (T',G'')\<close> fst_conv
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'
L M1 \<inter> Prefix_Tree.set T' = L M2 \<inter> Prefix_Tree.set T'
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1
[PROOF STEP]
have *: "preserves_divergence M1 M2 (V ` reachable_states M1)"
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1

goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1)
[PROOF STEP]
using T1_V_div
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1
L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1 \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1)

goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (V ` reachable_states M1)

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
have "set (fst TGxy) \<subseteq> set (fst (T',G'))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (fst TGxy) \<subseteq> Prefix_Tree.set (fst (T', G'))
[PROOF STEP]
using \<open>verifies_transition establish_convergence M1 M2 V T1 cg_insert cg_lookup\<close>
[PROOF STATE]
proof (prove)
using this:
verifies_transition establish_convergence M1 M2 V T1 cg_insert cg_lookup

goal (1 subgoal):
 1. Prefix_Tree.set (fst TGxy) \<subseteq> Prefix_Tree.set (fst (T', G'))
[PROOF STEP]
unfolding TG' verifies_transition_def
[PROOF STATE]
proof (prove)
using this:
\<forall>T G m t. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (establish_convergence M1 V T G cg_insert cg_lookup m t)) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (establish_convergence M1 V T G cg_insert cg_lookup m t))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<in> L M2 \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (establish_convergence M1 V T G cg_insert cg_lookup m t)) = L M2 \<inter> Prefix_Tree.set (fst (establish_convergence M1 V T G cg_insert cg_lookup m t)) \<longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T \<longrightarrow> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence M1 V T G cg_insert cg_lookup m t)))

goal (1 subgoal):
 1. Prefix_Tree.set (fst TGxy) \<subseteq> Prefix_Tree.set (fst (establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst TGxy) \<subseteq> Prefix_Tree.set (fst (T', G'))

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set (fst TGxy) \<subseteq> Prefix_Tree.set (fst (T', G'))
[PROOF STEP]
have "set (fst TGxy) \<subseteq> set (fst (verify_transition (T,G) t))"
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TGxy) \<subseteq> Prefix_Tree.set (fst (T', G'))

goal (1 subgoal):
 1. Prefix_Tree.set (fst TGxy) \<subseteq> Prefix_Tree.set (fst (verify_transition (T, G) t))
[PROOF STEP]
unfolding \<open>verify_transition (T,G) t = (T',G'')\<close> fst_conv
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TGxy) \<subseteq> Prefix_Tree.set T'

goal (1 subgoal):
 1. Prefix_Tree.set (fst TGxy) \<subseteq> Prefix_Tree.set T'
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst TGxy) \<subseteq> Prefix_Tree.set (fst (verify_transition (T, G) t))

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set (fst TGxy) \<subseteq> Prefix_Tree.set (fst (verify_transition (T, G) t))
[PROOF STEP]
have "L M1 \<inter> set (fst TGxy) = L M2 \<inter> set (fst TGxy)"
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TGxy) \<subseteq> Prefix_Tree.set (fst (verify_transition (T, G) t))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst TGxy) = L M2 \<inter> Prefix_Tree.set (fst TGxy)
[PROOF STEP]
using a1
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TGxy) \<subseteq> Prefix_Tree.set (fst (verify_transition (T, G) t))
L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst TGxy) = L M2 \<inter> Prefix_Tree.set (fst TGxy)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst TGxy) = L M2 \<inter> Prefix_Tree.set (fst TGxy)

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
have "L M1 \<inter> set T' = L M2 \<inter> set T'" and "L M1 \<inter> set T = L M2 \<inter> set T"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set T' = L M2 \<inter> Prefix_Tree.set T' &&& L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
[PROOF STEP]
using a1 \<open>set T \<subseteq> set T'\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t))
Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set T' = L M2 \<inter> Prefix_Tree.set T' &&& L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
[PROOF STEP]
unfolding T' \<open>verify_transition (T,G) t = (T',G'')\<close> fst_conv
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t)) = L M2 \<inter> Prefix_Tree.set (fst (establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t))
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t)) = L M2 \<inter> Prefix_Tree.set (fst (establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t)) &&& L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set T' = L M2 \<inter> Prefix_Tree.set T'
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
have **: "V ` reachable_states M1 \<subseteq> set T"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V ` reachable_states M1 \<subseteq> Prefix_Tree.set T
[PROOF STEP]
using a5 T1_state_cover
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T1

goal (1 subgoal):
 1. V ` reachable_states M1 \<subseteq> Prefix_Tree.set T
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
have "L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1
[PROOF STEP]
using T1_state_cover \<open>L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1\<close>
[PROOF STATE]
proof (prove)
using this:
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T1
L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1

goal (1 subgoal):
 1. L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
have "(\<exists>\<alpha>. converge M1 \<alpha> (V (t_source t)) \<and>
            converge M2 \<alpha> (V (t_source t)) \<and>
            \<alpha> \<in> Prefix_Tree.set (fst TGxy) \<and>
            \<alpha> @ [((t_input t), (t_output t))] \<in> Prefix_Tree.set (fst TGxy))"
    and  "convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGxy)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>\<alpha>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> \<alpha> \<in> Prefix_Tree.set (fst TGxy) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst TGxy) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGxy)
[PROOF STEP]
using \<open>verifies_io_pair append_io_pair M1 M2 cg_insert cg_lookup\<close>
[PROOF STATE]
proof (prove)
using this:
verifies_io_pair append_io_pair M1 M2 cg_insert cg_lookup

goal (1 subgoal):
 1. \<exists>\<alpha>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> \<alpha> \<in> Prefix_Tree.set (fst TGxy) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst TGxy) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGxy)
[PROOF STEP]
unfolding verifies_io_pair_def
[PROOF STATE]
proof (prove)
using this:
\<forall>V T G q x y. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1 \<longrightarrow> q \<in> reachable_states M1 \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) = L M2 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<longrightarrow> (\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y))) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (append_io_pair M1 V T G cg_insert cg_lookup q x y)))

goal (1 subgoal):
 1. \<exists>\<alpha>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> \<alpha> \<in> Prefix_Tree.set (fst TGxy) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst TGxy) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGxy)
[PROOF STEP]
using assms(1-4,7,8) \<open>is_state_cover_assignment M1 V\<close> \<open>L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1\<close> a4 fsm_transition_input[OF a3] fsm_transition_output[OF a3] a2 \<open>convergence_graph_insert_invar M1 M2 cg_lookup cg_insert\<close> \<open>L M1 \<inter> set (fst TGxy) = L M2 \<inter> set (fst TGxy)\<close>
[PROOF STATE]
proof (prove)
using this:
\<forall>V T G q x y. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1 \<longrightarrow> q \<in> reachable_states M1 \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) = L M2 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<longrightarrow> (\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y))) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (append_io_pair M1 V T G cg_insert cg_lookup q x y)))
observable M1
observable M2
minimal M1
minimal M2
FSM.inputs M2 = FSM.inputs M1
FSM.outputs M2 = FSM.outputs M1
is_state_cover_assignment M1 V
L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1
t_source t \<in> reachable_states M1
t_input t \<in> FSM.inputs M1
t_output t \<in> FSM.outputs M1
convergence_graph_lookup_invar M1 M2 cg_lookup G
convergence_graph_insert_invar M1 M2 cg_lookup cg_insert
L M1 \<inter> Prefix_Tree.set (fst TGxy) = L M2 \<inter> Prefix_Tree.set (fst TGxy)

goal (1 subgoal):
 1. \<exists>\<alpha>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> \<alpha> \<in> Prefix_Tree.set (fst TGxy) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst TGxy) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGxy)
[PROOF STEP]
unfolding TGxy
[PROOF STATE]
proof (prove)
using this:
\<forall>V T G q x y. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1 \<longrightarrow> q \<in> reachable_states M1 \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) = L M2 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<longrightarrow> (\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y))) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (append_io_pair M1 V T G cg_insert cg_lookup q x y)))
observable M1
observable M2
minimal M1
minimal M2
FSM.inputs M2 = FSM.inputs M1
FSM.outputs M2 = FSM.outputs M1
is_state_cover_assignment M1 V
L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1
t_source t \<in> reachable_states M1
t_input t \<in> FSM.inputs M1
t_output t \<in> FSM.outputs M1
convergence_graph_lookup_invar M1 M2 cg_lookup G
convergence_graph_insert_invar M1 M2 cg_lookup cg_insert
L M1 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) = L M2 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t)))

goal (1 subgoal):
 1. \<exists>\<alpha>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> \<alpha> \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t))) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd (append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t)))
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
\<exists>\<alpha>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> \<alpha> \<in> Prefix_Tree.set (fst TGxy) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst TGxy)
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGxy)

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>\<alpha>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> \<alpha> \<in> Prefix_Tree.set (fst TGxy) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst TGxy)
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGxy)
[PROOF STEP]
obtain w where "converge M1 w (V (t_source t))"
                        "converge M2 w (V (t_source t))"
                        "w \<in> Prefix_Tree.set (fst TGxy)"
                        "w @ [((t_input t), (t_output t))] \<in> set (fst TGxy)"
[PROOF STATE]
proof (prove)
using this:
\<exists>\<alpha>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> \<alpha> \<in> Prefix_Tree.set (fst TGxy) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst TGxy)
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGxy)

goal (1 subgoal):
 1. (\<And>w. \<lbrakk>converge M1 w (V (t_source t)); converge M2 w (V (t_source t)); w \<in> Prefix_Tree.set (fst TGxy); w @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst TGxy)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
converge M1 w (V (t_source t))
converge M2 w (V (t_source t))
w \<in> Prefix_Tree.set (fst TGxy)
w @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst TGxy)

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
converge M1 w (V (t_source t))
converge M2 w (V (t_source t))
w \<in> Prefix_Tree.set (fst TGxy)
w @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst TGxy)
[PROOF STEP]
have "w @ [((t_input t), (t_output t))] \<in> L M1 \<longleftrightarrow> w @ [((t_input t), (t_output t))] \<in> L M2"
[PROOF STATE]
proof (prove)
using this:
converge M1 w (V (t_source t))
converge M2 w (V (t_source t))
w \<in> Prefix_Tree.set (fst TGxy)
w @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst TGxy)

goal (1 subgoal):
 1. (w @ [(t_input t, t_output t)] \<in> L M1) = (w @ [(t_input t, t_output t)] \<in> L M2)
[PROOF STEP]
using \<open>L M1 \<inter> set (fst TGxy) = L M2 \<inter> set (fst TGxy)\<close>
[PROOF STATE]
proof (prove)
using this:
converge M1 w (V (t_source t))
converge M2 w (V (t_source t))
w \<in> Prefix_Tree.set (fst TGxy)
w @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst TGxy)
L M1 \<inter> Prefix_Tree.set (fst TGxy) = L M2 \<inter> Prefix_Tree.set (fst TGxy)

goal (1 subgoal):
 1. (w @ [(t_input t, t_output t)] \<in> L M1) = (w @ [(t_input t, t_output t)] \<in> L M2)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(w @ [(t_input t, t_output t)] \<in> L M1) = (w @ [(t_input t, t_output t)] \<in> L M2)

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(w @ [(t_input t, t_output t)] \<in> L M1) = (w @ [(t_input t, t_output t)] \<in> L M2)

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
have "w @ [((t_input t), (t_output t))] \<in> L M1 \<longleftrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<in> L M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (w @ [(t_input t, t_output t)] \<in> L M1) = (V (t_source t) @ [(t_input t, t_output t)] \<in> L M1)
[PROOF STEP]
using \<open>converge M1 w (V (t_source t))\<close>
[PROOF STATE]
proof (prove)
using this:
converge M1 w (V (t_source t))

goal (1 subgoal):
 1. (w @ [(t_input t, t_output t)] \<in> L M1) = (V (t_source t) @ [(t_input t, t_output t)] \<in> L M1)
[PROOF STEP]
by (meson assms(1) converge_append_language_iff)
[PROOF STATE]
proof (state)
this:
(w @ [(t_input t, t_output t)] \<in> L M1) = (V (t_source t) @ [(t_input t, t_output t)] \<in> L M1)

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(w @ [(t_input t, t_output t)] \<in> L M1) = (V (t_source t) @ [(t_input t, t_output t)] \<in> L M1)

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
have "V (t_source t) @ [(t_input t, t_output t)] \<in> L M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V (t_source t) @ [(t_input t, t_output t)] \<in> L M1
[PROOF STEP]
using state_cover_transition_converges[OF assms(1) \<open>is_state_cover_assignment M1 V\<close> \<open>t \<in> transitions M1\<close> \<open>t_source t \<in> reachable_states M1\<close>]
[PROOF STATE]
proof (prove)
using this:
converge M1 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))

goal (1 subgoal):
 1. V (t_source t) @ [(t_input t, t_output t)] \<in> L M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
V (t_source t) @ [(t_input t, t_output t)] \<in> L M1

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(w @ [(t_input t, t_output t)] \<in> L M1) = (w @ [(t_input t, t_output t)] \<in> L M2)
(w @ [(t_input t, t_output t)] \<in> L M1) = (V (t_source t) @ [(t_input t, t_output t)] \<in> L M1)
V (t_source t) @ [(t_input t, t_output t)] \<in> L M1
[PROOF STEP]
have "w @ [(t_input t, t_output t)] \<in> L M2"
[PROOF STATE]
proof (prove)
using this:
(w @ [(t_input t, t_output t)] \<in> L M1) = (w @ [(t_input t, t_output t)] \<in> L M2)
(w @ [(t_input t, t_output t)] \<in> L M1) = (V (t_source t) @ [(t_input t, t_output t)] \<in> L M1)
V (t_source t) @ [(t_input t, t_output t)] \<in> L M1

goal (1 subgoal):
 1. w @ [(t_input t, t_output t)] \<in> L M2
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
w @ [(t_input t, t_output t)] \<in> L M2

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
w @ [(t_input t, t_output t)] \<in> L M2
[PROOF STEP]
have "V (t_source t) @ [(t_input t, t_output t)] \<in> L M2"
[PROOF STATE]
proof (prove)
using this:
w @ [(t_input t, t_output t)] \<in> L M2

goal (1 subgoal):
 1. V (t_source t) @ [(t_input t, t_output t)] \<in> L M2
[PROOF STEP]
using \<open>converge M2 w (V (t_source t))\<close>
[PROOF STATE]
proof (prove)
using this:
w @ [(t_input t, t_output t)] \<in> L M2
converge M2 w (V (t_source t))

goal (1 subgoal):
 1. V (t_source t) @ [(t_input t, t_output t)] \<in> L M2
[PROOF STEP]
by (meson assms(2) converge_append_language_iff)
[PROOF STATE]
proof (state)
this:
V (t_source t) @ [(t_input t, t_output t)] \<in> L M2

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
have "V ` reachable_states M1 \<subseteq> set T"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V ` reachable_states M1 \<subseteq> Prefix_Tree.set T
[PROOF STEP]
using a5 T1_state_cover
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T1

goal (1 subgoal):
 1. V ` reachable_states M1 \<subseteq> Prefix_Tree.set T
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
have "set T \<subseteq> set (fst TGxy)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TGxy)
[PROOF STEP]
using \<open>verifies_io_pair append_io_pair M1 M2 cg_insert cg_lookup\<close>
[PROOF STATE]
proof (prove)
using this:
verifies_io_pair append_io_pair M1 M2 cg_insert cg_lookup

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TGxy)
[PROOF STEP]
unfolding verifies_io_pair_def TGxy
[PROOF STATE]
proof (prove)
using this:
\<forall>V T G q x y. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1 \<longrightarrow> q \<in> reachable_states M1 \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) = L M2 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<longrightarrow> (\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y))) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (append_io_pair M1 V T G cg_insert cg_lookup q x y)))

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup (t_source t) (t_input t) (t_output t)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TGxy)

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TGxy)
[PROOF STEP]
have "set T1 \<subseteq> set (fst TGxy)"
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TGxy)

goal (1 subgoal):
 1. Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst TGxy)
[PROOF STEP]
using a5
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TGxy)
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T

goal (1 subgoal):
 1. Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst TGxy)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst TGxy)

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst TGxy)
[PROOF STEP]
have "\<And> io . set (after T1 io) \<subseteq> set (after (fst TGxy) io)"
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst TGxy)

goal (1 subgoal):
 1. \<And>io. Prefix_Tree.set (Prefix_Tree.after T1 io) \<subseteq> Prefix_Tree.set (Prefix_Tree.after (fst TGxy) io)
[PROOF STEP]
unfolding after_set
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst TGxy)

goal (1 subgoal):
 1. \<And>io. Set.insert [] {xs'. io @ xs' \<in> Prefix_Tree.set T1} \<subseteq> Set.insert [] {xs'. io @ xs' \<in> Prefix_Tree.set (fst TGxy)}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (Prefix_Tree.after T1 ?io) \<subseteq> Prefix_Tree.set (Prefix_Tree.after (fst TGxy) ?io)

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
have "V ` reachable_states M1 \<subseteq> set (fst TGxy)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V ` reachable_states M1 \<subseteq> Prefix_Tree.set (fst TGxy)
[PROOF STEP]
using "**" \<open>Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TGxy)\<close>
[PROOF STATE]
proof (prove)
using this:
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst TGxy)

goal (1 subgoal):
 1. V ` reachable_states M1 \<subseteq> Prefix_Tree.set (fst TGxy)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
V ` reachable_states M1 \<subseteq> Prefix_Tree.set (fst TGxy)

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
have p2: "converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))"
     and "convergence_graph_lookup_invar M1 M2 cg_lookup G'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)) &&& convergence_graph_lookup_invar M1 M2 cg_lookup G'
[PROOF STEP]
using \<open>verifies_transition establish_convergence M1 M2 V T1 cg_insert cg_lookup\<close>
[PROOF STATE]
proof (prove)
using this:
verifies_transition establish_convergence M1 M2 V T1 cg_insert cg_lookup

goal (1 subgoal):
 1. converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)) &&& convergence_graph_lookup_invar M1 M2 cg_lookup G'
[PROOF STEP]
unfolding verifies_transition_def
[PROOF STATE]
proof (prove)
using this:
\<forall>T G m t. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (establish_convergence M1 V T G cg_insert cg_lookup m t)) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (establish_convergence M1 V T G cg_insert cg_lookup m t))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<in> L M2 \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (establish_convergence M1 V T G cg_insert cg_lookup m t)) = L M2 \<inter> Prefix_Tree.set (fst (establish_convergence M1 V T G cg_insert cg_lookup m t)) \<longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T \<longrightarrow> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence M1 V T G cg_insert cg_lookup m t)))

goal (1 subgoal):
 1. converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)) &&& convergence_graph_lookup_invar M1 M2 cg_lookup G'
[PROOF STEP]
using assms(1-8) \<open>is_state_cover_assignment M1 V\<close> \<open>preserves_divergence M1 M2 (V ` reachable_states M1)\<close> \<open>V ` reachable_states M1 \<subseteq> set (fst TGxy)\<close> a3 a4 a6 \<open>V (t_source t) @ [(t_input t, t_output t)] \<in> L M2\<close> \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGxy)\<close> \<open>convergence_graph_insert_invar M1 M2 cg_lookup cg_insert\<close> \<open>L M1 \<inter> set T' = L M2 \<inter> set T'\<close>
[PROOF STATE]
proof (prove)
using this:
\<forall>T G m t. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (establish_convergence M1 V T G cg_insert cg_lookup m t)) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (establish_convergence M1 V T G cg_insert cg_lookup m t))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<in> L M2 \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (establish_convergence M1 V T G cg_insert cg_lookup m t)) = L M2 \<inter> Prefix_Tree.set (fst (establish_convergence M1 V T G cg_insert cg_lookup m t)) \<longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T \<longrightarrow> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence M1 V T G cg_insert cg_lookup m t)))
observable M1
observable M2
minimal M1
minimal M2
size_r M1 \<le> m
FSM.size M2 \<le> m
FSM.inputs M2 = FSM.inputs M1
FSM.outputs M2 = FSM.outputs M1
is_state_cover_assignment M1 V
preserves_divergence M1 M2 (V ` reachable_states M1)
V ` reachable_states M1 \<subseteq> Prefix_Tree.set (fst TGxy)
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1
V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t)
V (t_source t) @ [(t_input t, t_output t)] \<in> L M2
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGxy)
convergence_graph_insert_invar M1 M2 cg_lookup cg_insert
L M1 \<inter> Prefix_Tree.set T' = L M2 \<inter> Prefix_Tree.set T'

goal (1 subgoal):
 1. converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)) &&& convergence_graph_lookup_invar M1 M2 cg_lookup G'
[PROOF STEP]
using \<open>set T1 \<subseteq> set (fst TGxy)\<close>
[PROOF STATE]
proof (prove)
using this:
\<forall>T G m t. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (establish_convergence M1 V T G cg_insert cg_lookup m t)) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (establish_convergence M1 V T G cg_insert cg_lookup m t))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<in> L M2 \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (establish_convergence M1 V T G cg_insert cg_lookup m t)) = L M2 \<inter> Prefix_Tree.set (fst (establish_convergence M1 V T G cg_insert cg_lookup m t)) \<longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T \<longrightarrow> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence M1 V T G cg_insert cg_lookup m t)))
observable M1
observable M2
minimal M1
minimal M2
size_r M1 \<le> m
FSM.size M2 \<le> m
FSM.inputs M2 = FSM.inputs M1
FSM.outputs M2 = FSM.outputs M1
is_state_cover_assignment M1 V
preserves_divergence M1 M2 (V ` reachable_states M1)
V ` reachable_states M1 \<subseteq> Prefix_Tree.set (fst TGxy)
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1
V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t)
V (t_source t) @ [(t_input t, t_output t)] \<in> L M2
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGxy)
convergence_graph_insert_invar M1 M2 cg_lookup cg_insert
L M1 \<inter> Prefix_Tree.set T' = L M2 \<inter> Prefix_Tree.set T'
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst TGxy)

goal (1 subgoal):
 1. converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)) &&& convergence_graph_lookup_invar M1 M2 cg_lookup G'
[PROOF STEP]
unfolding T' G'
[PROOF STATE]
proof (prove)
using this:
\<forall>T G m t. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (establish_convergence M1 V T G cg_insert cg_lookup m t)) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (establish_convergence M1 V T G cg_insert cg_lookup m t))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> size_r M1 \<le> m \<longrightarrow> FSM.size M2 \<le> m \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1) \<longrightarrow> V ` reachable_states M1 \<subseteq> Prefix_Tree.set T \<longrightarrow> t \<in> FSM.transitions M1 \<longrightarrow> t_source t \<in> reachable_states M1 \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t) \<longrightarrow> V (t_source t) @ [(t_input t, t_output t)] \<in> L M2 \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (establish_convergence M1 V T G cg_insert cg_lookup m t)) = L M2 \<inter> Prefix_Tree.set (fst (establish_convergence M1 V T G cg_insert cg_lookup m t)) \<longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T \<longrightarrow> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence M1 V T G cg_insert cg_lookup m t)))
observable M1
observable M2
minimal M1
minimal M2
size_r M1 \<le> m
FSM.size M2 \<le> m
FSM.inputs M2 = FSM.inputs M1
FSM.outputs M2 = FSM.outputs M1
is_state_cover_assignment M1 V
preserves_divergence M1 M2 (V ` reachable_states M1)
V ` reachable_states M1 \<subseteq> Prefix_Tree.set (fst TGxy)
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1
V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t)
V (t_source t) @ [(t_input t, t_output t)] \<in> L M2
convergence_graph_lookup_invar M1 M2 cg_lookup (snd TGxy)
convergence_graph_insert_invar M1 M2 cg_lookup cg_insert
L M1 \<inter> Prefix_Tree.set (fst (establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t)) = L M2 \<inter> Prefix_Tree.set (fst (establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t))
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst TGxy)

goal (1 subgoal):
 1. converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t))
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
convergence_graph_lookup_invar M1 M2 cg_lookup G'

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
have "w @ [((t_input t), (t_output t))] \<in> set T'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. w @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T'
[PROOF STEP]
using \<open>w @ [((t_input t), (t_output t))] \<in> set (fst TGxy)\<close>
[PROOF STATE]
proof (prove)
using this:
w @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst TGxy)

goal (1 subgoal):
 1. w @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T'
[PROOF STEP]
using T' \<open>Prefix_Tree.set (fst TGxy) \<subseteq> Prefix_Tree.set (fst (T', G'))\<close>
[PROOF STATE]
proof (prove)
using this:
w @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst TGxy)
T' = fst (establish_convergence M1 V (fst TGxy) (snd TGxy) cg_insert cg_lookup m t)
Prefix_Tree.set (fst TGxy) \<subseteq> Prefix_Tree.set (fst (T', G'))

goal (1 subgoal):
 1. w @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
w @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T'

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
have p1: "(\<exists>\<alpha> \<beta>.
                converge M1 \<alpha> (V (t_source t)) \<and>
                converge M2 \<alpha> (V (t_source t)) \<and>
                converge M1 \<beta> (V (t_target t)) \<and>
                converge M2 \<beta> (V (t_target t)) \<and>
                \<alpha> @ [(t_input t, t_output t)] \<in> set T' \<and>
                \<beta> \<in> set T')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T'
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T'
[PROOF STEP]
have "V (t_source t) \<in> L M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V (t_source t) \<in> L M1
[PROOF STEP]
using state_cover_assignment_after(1)[OF assms(1) \<open>is_state_cover_assignment M1 V\<close> \<open>t_source t \<in> reachable_states M1\<close>]
[PROOF STATE]
proof (prove)
using this:
V (t_source t) \<in> L M1

goal (1 subgoal):
 1. V (t_source t) \<in> L M1
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
V (t_source t) \<in> L M1

goal (1 subgoal):
 1. \<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T'
[PROOF STEP]
have "V (t_target t) \<in> L M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V (t_target t) \<in> L M1
[PROOF STEP]
using state_cover_assignment_after(1)[OF assms(1) \<open>is_state_cover_assignment M1 V\<close> reachable_states_next[OF \<open>t_source t \<in> reachable_states M1\<close> \<open>t \<in> transitions M1\<close>]]
[PROOF STATE]
proof (prove)
using this:
t_source t = t_source t \<Longrightarrow> V (t_target t) \<in> L M1

goal (1 subgoal):
 1. V (t_target t) \<in> L M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
V (t_target t) \<in> L M1

goal (1 subgoal):
 1. \<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T'
[PROOF STEP]
note \<open>converge M1 w (V (t_source t))\<close> and \<open>converge M2 w (V (t_source t))\<close>
[PROOF STATE]
proof (state)
this:
converge M1 w (V (t_source t))
converge M2 w (V (t_source t))

goal (1 subgoal):
 1. \<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T'
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
converge M1 w (V (t_source t))
converge M2 w (V (t_source t))

goal (1 subgoal):
 1. \<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T'
[PROOF STEP]
have "converge M1 (V (t_target t)) (V (t_target t))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. converge M1 (V (t_target t)) (V (t_target t))
[PROOF STEP]
using \<open>V (t_target t) \<in> L M1\<close>
[PROOF STATE]
proof (prove)
using this:
V (t_target t) \<in> L M1

goal (1 subgoal):
 1. converge M1 (V (t_target t)) (V (t_target t))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M1 (V (t_target t)) (V (t_target t))

goal (1 subgoal):
 1. \<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T'
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
converge M1 (V (t_target t)) (V (t_target t))

goal (1 subgoal):
 1. \<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T'
[PROOF STEP]
have "converge M2 (V (t_target t)) (V (t_target t))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. converge M2 (V (t_target t)) (V (t_target t))
[PROOF STEP]
using reachable_states_next[OF \<open>t_source t \<in> reachable_states M1\<close> \<open>t \<in> transitions M1\<close>] \<open>V (t_target t) \<in> L M1\<close> \<open>L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1\<close>
[PROOF STATE]
proof (prove)
using this:
t_source t = t_source t \<Longrightarrow> t_target t \<in> reachable_states M1
V (t_target t) \<in> L M1
L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1

goal (1 subgoal):
 1. converge M2 (V (t_target t)) (V (t_target t))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M2 (V (t_target t)) (V (t_target t))

goal (1 subgoal):
 1. \<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T'
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
converge M2 (V (t_target t)) (V (t_target t))

goal (1 subgoal):
 1. \<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T'
[PROOF STEP]
note \<open>w @ [(t_input t, t_output t)] \<in> set T'\<close>
[PROOF STATE]
proof (state)
this:
w @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T'

goal (1 subgoal):
 1. \<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T'
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
w @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T'

goal (1 subgoal):
 1. \<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T'
[PROOF STEP]
have "V (t_target t) \<in> set T'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V (t_target t) \<in> Prefix_Tree.set T'
[PROOF STEP]
using \<open>V ` reachable_states M1 \<subseteq> set T\<close> \<open>set T \<subseteq> set T'\<close> reachable_states_next[OF \<open>t_source t \<in> reachable_states M1\<close> \<open>t \<in> transitions M1\<close>]
[PROOF STATE]
proof (prove)
using this:
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T
Prefix_Tree.set T \<subseteq> Prefix_Tree.set T'
t_source t = t_source t \<Longrightarrow> t_target t \<in> reachable_states M1

goal (1 subgoal):
 1. V (t_target t) \<in> Prefix_Tree.set T'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
V (t_target t) \<in> Prefix_Tree.set T'

goal (1 subgoal):
 1. \<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T'
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
converge M1 w (V (t_source t))
converge M2 w (V (t_source t))
converge M1 (V (t_target t)) (V (t_target t))
converge M2 (V (t_target t)) (V (t_target t))
w @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T'
V (t_target t) \<in> Prefix_Tree.set T'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
converge M1 w (V (t_source t))
converge M2 w (V (t_source t))
converge M1 (V (t_target t)) (V (t_target t))
converge M2 (V (t_target t)) (V (t_target t))
w @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T'
V (t_target t) \<in> Prefix_Tree.set T'

goal (1 subgoal):
 1. \<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T'

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
have p3: "convergence_graph_lookup_invar M1 M2 cg_lookup G''"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup G''
[PROOF STEP]
unfolding G''
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (cg_merge G' (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)))
[PROOF STEP]
using cg_merge_invar[OF \<open>convergence_graph_lookup_invar M1 M2 cg_lookup G'\<close>]
            state_cover_transition_converges[OF assms(1) \<open>is_state_cover_assignment M1 V\<close> a3 a4]
            \<open>converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))\<close>
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>converge M1 ?\<gamma> ?\<gamma>'; converge M2 ?\<gamma> ?\<gamma>'\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (cg_merge G' ?\<gamma> ?\<gamma>')
converge M1 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (cg_merge G' (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup G''

goal (1 subgoal):
 1. \<And>t T G. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (T, G) t)); convergence_graph_lookup_invar M1 M2 cg_lookup G; t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1; V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
show "covers_unverified_transition t (verify_transition (T,G) t)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
using p1 p2 p3
[PROOF STATE]
proof (prove)
using this:
\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T'
converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
convergence_graph_lookup_invar M1 M2 cg_lookup G''

goal (1 subgoal):
 1. covers_unverified_transition t (verify_transition (T, G) t)
[PROOF STEP]
unfolding \<open>verify_transition (T,G) t = (T',G'')\<close> fst_conv snd_conv covers_unverified_transition
[PROOF STATE]
proof (prove)
using this:
\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T'
converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
convergence_graph_lookup_invar M1 M2 cg_lookup G''

goal (1 subgoal):
 1. case (T', G'') of (T', G') \<Rightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T') \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup G'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
covers_unverified_transition t (verify_transition (T, G) t)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (?T, ?G) ?t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (?T, ?G) ?t)); convergence_graph_lookup_invar M1 M2 cg_lookup ?G; ?t \<in> FSM.transitions M1; t_source ?t \<in> reachable_states M1; V (t_source ?t) @ [(t_input ?t, t_output ?t)] \<noteq> V (t_target ?t); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set ?T\<rbrakk> \<Longrightarrow> covers_unverified_transition ?t (verify_transition (?T, ?G) ?t)

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have verify_transition_foldl_invar_1: "\<And> ts . list.set ts \<subseteq> list.set unverified_transitions \<Longrightarrow>
                set T1 \<subseteq> set (fst (foldl verify_transition (T1, G1) ts)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) ts))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ts. list.set ts \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>ts. list.set ts \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
fix ts
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>ts. list.set ts \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
assume "list.set ts \<subseteq> list.set unverified_transitions"
[PROOF STATE]
proof (state)
this:
list.set ts \<subseteq> list.set unverified_transitions

goal (1 subgoal):
 1. \<And>ts. list.set ts \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
list.set ts \<subseteq> list.set unverified_transitions
[PROOF STEP]
show "set T1 \<subseteq> set (fst (foldl verify_transition (T1, G1) ts)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) ts))"
[PROOF STATE]
proof (prove)
using this:
list.set ts \<subseteq> list.set unverified_transitions

goal (1 subgoal):
 1. Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
proof (induction ts rule: rev_induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. list.set [] \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) [])) \<and> finite_tree (fst (foldl verify_transition (T1, G1) []))
 2. \<And>x xs. \<lbrakk>list.set xs \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions\<rbrakk> \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) \<and> finite_tree (fst (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
list.set [] \<subseteq> list.set unverified_transitions

goal (2 subgoals):
 1. list.set [] \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) [])) \<and> finite_tree (fst (foldl verify_transition (T1, G1) []))
 2. \<And>x xs. \<lbrakk>list.set xs \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions\<rbrakk> \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) \<and> finite_tree (fst (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
list.set [] \<subseteq> list.set unverified_transitions
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
list.set [] \<subseteq> list.set unverified_transitions

goal (1 subgoal):
 1. Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) [])) \<and> finite_tree (fst (foldl verify_transition (T1, G1) []))
[PROOF STEP]
using T1_finite
[PROOF STATE]
proof (prove)
using this:
list.set [] \<subseteq> list.set unverified_transitions
finite_tree T1

goal (1 subgoal):
 1. Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) [])) \<and> finite_tree (fst (foldl verify_transition (T1, G1) []))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) [])) \<and> finite_tree (fst (foldl verify_transition (T1, G1) []))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>list.set xs \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions\<rbrakk> \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) \<and> finite_tree (fst (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>list.set xs \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions\<rbrakk> \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) \<and> finite_tree (fst (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
case (snoc t ts)
[PROOF STATE]
proof (state)
this:
list.set ts \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) ts))
list.set (ts @ [t]) \<subseteq> list.set unverified_transitions

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>list.set xs \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions\<rbrakk> \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) \<and> finite_tree (fst (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
list.set ts \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) ts))
list.set (ts @ [t]) \<subseteq> list.set unverified_transitions
[PROOF STEP]
have "t \<in> transitions M1" and "t_source t \<in> reachable_states M1"
[PROOF STATE]
proof (prove)
using this:
list.set ts \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) ts))
list.set (ts @ [t]) \<subseteq> list.set unverified_transitions

goal (1 subgoal):
 1. t \<in> FSM.transitions M1 &&& t_source t \<in> reachable_states M1
[PROOF STEP]
unfolding unverified_transitions_alt_def
[PROOF STATE]
proof (prove)
using this:
list.set ts \<subseteq> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) \<noteq> V (t_source t) @ [(t_input t, t_output t)]} \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) ts))
list.set (ts @ [t]) \<subseteq> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) \<noteq> V (t_source t) @ [(t_input t, t_output t)]}

goal (1 subgoal):
 1. t \<in> FSM.transitions M1 &&& t_source t \<in> reachable_states M1
[PROOF STEP]
by force+
[PROOF STATE]
proof (state)
this:
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>list.set xs \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions\<rbrakk> \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) \<and> finite_tree (fst (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
have p1: "list.set ts \<subseteq> list.set unverified_transitions"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list.set ts \<subseteq> list.set unverified_transitions
[PROOF STEP]
using snoc.prems(1)
[PROOF STATE]
proof (prove)
using this:
list.set (ts @ [t]) \<subseteq> list.set unverified_transitions

goal (1 subgoal):
 1. list.set ts \<subseteq> list.set unverified_transitions
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
list.set ts \<subseteq> list.set unverified_transitions

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>list.set xs \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions\<rbrakk> \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) \<and> finite_tree (fst (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
have "set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> set (fst (foldl verify_transition (T1, G1) (ts@[t])))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))
[PROOF STEP]
using verify_transition_retains_testsuite
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (verify_transition (?T, ?G) ?t))

goal (1 subgoal):
 1. Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))
[PROOF STEP]
unfolding foldl_append foldl.simps
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (verify_transition (?T, ?G) ?t))

goal (1 subgoal):
 1. Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (verify_transition (foldl verify_transition (T1, G1) ts) t))
[PROOF STEP]
by (metis eq_fst_iff)
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>list.set xs \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions\<rbrakk> \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) \<and> finite_tree (fst (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
have **: "Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))"
       and ***: "finite_tree (fst (foldl verify_transition (T1, G1) ts))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) &&& finite_tree (fst (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
using snoc.IH[OF p1]
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) ts))

goal (1 subgoal):
 1. Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) &&& finite_tree (fst (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))
finite_tree (fst (foldl verify_transition (T1, G1) ts))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>list.set xs \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions\<rbrakk> \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) \<and> finite_tree (fst (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
have "Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts@[t])))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))
[PROOF STEP]
using ** verify_transition_retains_testsuite \<open>set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> set (fst (foldl verify_transition (T1, G1) (ts@[t])))\<close>
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (verify_transition (?T, ?G) ?t))
Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))

goal (1 subgoal):
 1. Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>list.set xs \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions\<rbrakk> \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) \<and> finite_tree (fst (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>list.set xs \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions\<rbrakk> \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) \<and> finite_tree (fst (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
have "finite_tree (fst (foldl verify_transition (T1, G1) (ts@[t])))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite_tree (fst (foldl verify_transition (T1, G1) (ts @ [t])))
[PROOF STEP]
using verify_transition_retains_finiteness[OF ***, of "snd (foldl verify_transition (T1, G1) ts)"]
[PROOF STATE]
proof (prove)
using this:
finite_tree (fst (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) ?t))

goal (1 subgoal):
 1. finite_tree (fst (foldl verify_transition (T1, G1) (ts @ [t])))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
finite_tree (fst (foldl verify_transition (T1, G1) (ts @ [t])))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>list.set xs \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions\<rbrakk> \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) \<and> finite_tree (fst (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))
finite_tree (fst (foldl verify_transition (T1, G1) (ts @ [t])))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))
finite_tree (fst (foldl verify_transition (T1, G1) (ts @ [t])))

goal (1 subgoal):
 1. Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t]))) \<and> finite_tree (fst (foldl verify_transition (T1, G1) (ts @ [t])))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t]))) \<and> finite_tree (fst (foldl verify_transition (T1, G1) (ts @ [t])))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) ts))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
list.set ?ts \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ?ts)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) ?ts))

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
list.set ?ts \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ?ts)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) ?ts))
[PROOF STEP]
have T2_invar_1: "set T1 \<subseteq> set T2"
        and T2_finite : "finite_tree T2"
[PROOF STATE]
proof (prove)
using this:
list.set ?ts \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ?ts)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) ?ts))

goal (1 subgoal):
 1. Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T2 &&& finite_tree T2
[PROOF STEP]
unfolding TG2 G2 T2 \<open>TG1 = (T1,G1)\<close>
[PROOF STATE]
proof (prove)
using this:
list.set ?ts \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ?ts)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) ?ts))

goal (1 subgoal):
 1. Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) unverified_transitions)) &&& finite_tree (fst (foldl verify_transition (T1, G1) unverified_transitions))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T2
finite_tree T2

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have verify_transition_foldl_invar_2: "\<And> ts . list.set ts \<subseteq> list.set unverified_transitions \<Longrightarrow>
                L M1 \<inter> set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> set (fst (foldl verify_transition (T1, G1) ts)) \<Longrightarrow>
                convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ts. \<lbrakk>list.set ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>ts. \<lbrakk>list.set ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
fix ts
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>ts. \<lbrakk>list.set ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
assume "list.set ts \<subseteq> list.set unverified_transitions"
              and "L M1 \<inter> set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> set (fst (foldl verify_transition (T1, G1) ts))"
[PROOF STATE]
proof (state)
this:
list.set ts \<subseteq> list.set unverified_transitions
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))

goal (1 subgoal):
 1. \<And>ts. \<lbrakk>list.set ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
list.set ts \<subseteq> list.set unverified_transitions
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
show "convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts))"
[PROOF STATE]
proof (prove)
using this:
list.set ts \<subseteq> list.set unverified_transitions
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
proof (induction ts rule: rev_induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>list.set [] \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) []))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) []))
 2. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
list.set [] \<subseteq> list.set unverified_transitions
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) []))

goal (2 subgoals):
 1. \<lbrakk>list.set [] \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) []))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) []))
 2. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
list.set [] \<subseteq> list.set unverified_transitions
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) []))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
list.set [] \<subseteq> list.set unverified_transitions
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) []))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) []))
[PROOF STEP]
using G1_invar
[PROOF STATE]
proof (prove)
using this:
list.set [] \<subseteq> list.set unverified_transitions
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) []))
L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1 \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G1

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) []))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) []))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
case (snoc t ts)
[PROOF STATE]
proof (state)
this:
\<lbrakk>list.set ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts))
list.set (ts @ [t]) \<subseteq> list.set unverified_transitions
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>list.set ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts))
list.set (ts @ [t]) \<subseteq> list.set unverified_transitions
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))
[PROOF STEP]
have "t \<in> transitions M1" and "t_source t \<in> reachable_states M1" and "((V (t_source t)) @ [(t_input t,t_output t)]) \<noteq> (V (t_target t))"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>list.set ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts))
list.set (ts @ [t]) \<subseteq> list.set unverified_transitions
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))

goal (1 subgoal):
 1. t \<in> FSM.transitions M1 &&& t_source t \<in> reachable_states M1 &&& V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t)
[PROOF STEP]
unfolding unverified_transitions_alt_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>list.set ts \<subseteq> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) \<noteq> V (t_source t) @ [(t_input t, t_output t)]}; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts))
list.set (ts @ [t]) \<subseteq> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) \<noteq> V (t_source t) @ [(t_input t, t_output t)]}
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))

goal (1 subgoal):
 1. t \<in> FSM.transitions M1 &&& t_source t \<in> reachable_states M1 &&& V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t)
[PROOF STEP]
by force+
[PROOF STATE]
proof (state)
this:
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1
V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t)

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
have p1: "list.set ts \<subseteq> list.set unverified_transitions"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list.set ts \<subseteq> list.set unverified_transitions
[PROOF STEP]
using snoc.prems(1)
[PROOF STATE]
proof (prove)
using this:
list.set (ts @ [t]) \<subseteq> list.set unverified_transitions

goal (1 subgoal):
 1. list.set ts \<subseteq> list.set unverified_transitions
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
list.set ts \<subseteq> list.set unverified_transitions

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
have "set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> set (fst (foldl verify_transition (T1, G1) (ts@[t])))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))
[PROOF STEP]
using verify_transition_retains_testsuite
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (verify_transition (?T, ?G) ?t))

goal (1 subgoal):
 1. Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))
[PROOF STEP]
unfolding foldl_append foldl.simps
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (verify_transition (?T, ?G) ?t))

goal (1 subgoal):
 1. Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (verify_transition (foldl verify_transition (T1, G1) ts) t))
[PROOF STEP]
by (metis eq_fst_iff)
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))
[PROOF STEP]
have p2: "L M1 \<inter> set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> set (fst (foldl verify_transition (T1, G1) ts))"
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
using snoc.prems(2)
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
have *:"convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
using snoc.IH[OF p1 p2]
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
have **: "Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
using verify_transition_foldl_invar_1[OF p1]
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) ts))

goal (1 subgoal):
 1. Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
have "covers_unverified_transition t (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. covers_unverified_transition t (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t)
[PROOF STEP]
using verify_transition_cover_prop[OF _ * \<open>t \<in> transitions M1\<close> \<open>t_source t \<in> reachable_states M1\<close> \<open>((V (t_source t)) @ [(t_input t,t_output t)]) \<noteq> (V (t_target t))\<close> **] snoc.prems(2)
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t)) \<Longrightarrow> covers_unverified_transition t (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t)
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))

goal (1 subgoal):
 1. covers_unverified_transition t (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t)
[PROOF STEP]
unfolding prod.collapse
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (verify_transition (foldl verify_transition (T1, G1) ts) t)) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (foldl verify_transition (T1, G1) ts) t)) \<Longrightarrow> covers_unverified_transition t (verify_transition (foldl verify_transition (T1, G1) ts) t)
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))

goal (1 subgoal):
 1. covers_unverified_transition t (verify_transition (foldl verify_transition (T1, G1) ts) t)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
covers_unverified_transition t (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t)

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
covers_unverified_transition t (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t)
[PROOF STEP]
have "convergence_graph_lookup_invar M1 M2 cg_lookup (snd (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t))"
[PROOF STATE]
proof (prove)
using this:
covers_unverified_transition t (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t)

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t))
[PROOF STEP]
unfolding covers_unverified_transition
[PROOF STATE]
proof (prove)
using this:
case verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t of (T', G') \<Rightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T') \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup G'

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t))
[PROOF STEP]
have "convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (ts@[t])))"
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (ts @ [t])))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (ts @ [t])))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (ts @ [t])))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
have "Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts@[t])))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))
[PROOF STEP]
using ** verify_transition_retains_testsuite \<open>set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> set (fst (foldl verify_transition (T1, G1) (ts@[t])))\<close>
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (verify_transition (?T, ?G) ?t))
Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))

goal (1 subgoal):
 1. Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) xs)); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (xs @ [x])))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (ts @ [t])))
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (ts @ [t])))
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t])))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (ts @ [t])))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (ts @ [t])))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>list.set ?ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ?ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ?ts))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ?ts))

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>list.set ?ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ?ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ?ts))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ?ts))
[PROOF STEP]
have T2_invar_2: "L M1 \<inter> set T2 = L M2 \<inter> set T2 \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G2"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>list.set ?ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ?ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ?ts))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ?ts))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set T2 = L M2 \<inter> Prefix_Tree.set T2 \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G2
[PROOF STEP]
unfolding TG2 G2 T2 \<open>TG1 = (T1,G1)\<close>
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>list.set ?ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ?ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ?ts))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ?ts))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) unverified_transitions)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) unverified_transitions)) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) unverified_transitions))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set T2 = L M2 \<inter> Prefix_Tree.set T2 \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G2

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have T2_cover: "\<And> t . L M1 \<inter> set T2 = L M2 \<inter> set T2 \<Longrightarrow> t \<in> list.set unverified_transitions \<Longrightarrow> covers_unverified_transition t (T2,G2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>t. \<lbrakk>L M1 \<inter> Prefix_Tree.set T2 = L M2 \<inter> Prefix_Tree.set T2; t \<in> list.set unverified_transitions\<rbrakk> \<Longrightarrow> covers_unverified_transition t (T2, G2)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>t. \<lbrakk>L M1 \<inter> Prefix_Tree.set T2 = L M2 \<inter> Prefix_Tree.set T2; t \<in> list.set unverified_transitions\<rbrakk> \<Longrightarrow> covers_unverified_transition t (T2, G2)
[PROOF STEP]
have "\<And> t ts . t \<in> list.set ts \<Longrightarrow> list.set ts \<subseteq> list.set unverified_transitions \<Longrightarrow> L M1 \<inter> set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> set (fst (foldl verify_transition (T1, G1) ts)) \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) ts)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>t ts. \<lbrakk>t \<in> list.set ts; list.set ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) ts)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>t ts. \<lbrakk>t \<in> list.set ts; list.set ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) ts)
[PROOF STEP]
fix t ts
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>t ts. \<lbrakk>t \<in> list.set ts; list.set ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) ts)
[PROOF STEP]
assume "t \<in> list.set ts" and "list.set ts \<subseteq> list.set unverified_transitions" and "L M1 \<inter> set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> set (fst (foldl verify_transition (T1, G1) ts))"
[PROOF STATE]
proof (state)
this:
t \<in> list.set ts
list.set ts \<subseteq> list.set unverified_transitions
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))

goal (1 subgoal):
 1. \<And>t ts. \<lbrakk>t \<in> list.set ts; list.set ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) ts)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
t \<in> list.set ts
list.set ts \<subseteq> list.set unverified_transitions
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
show "covers_unverified_transition t (foldl verify_transition (T1, G1) ts)"
[PROOF STATE]
proof (prove)
using this:
t \<in> list.set ts
list.set ts \<subseteq> list.set unverified_transitions
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))

goal (1 subgoal):
 1. covers_unverified_transition t (foldl verify_transition (T1, G1) ts)
[PROOF STEP]
proof (induction ts rule: rev_induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>t \<in> list.set []; list.set [] \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) []))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) [])
 2. \<And>x xs. \<lbrakk>\<lbrakk>t \<in> list.set xs; list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) xs); t \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (xs @ [x]))
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
t \<in> list.set []
list.set [] \<subseteq> list.set unverified_transitions
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) []))

goal (2 subgoals):
 1. \<lbrakk>t \<in> list.set []; list.set [] \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) []))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) [])
 2. \<And>x xs. \<lbrakk>\<lbrakk>t \<in> list.set xs; list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) xs); t \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (xs @ [x]))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
t \<in> list.set []
list.set [] \<subseteq> list.set unverified_transitions
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) []))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
t \<in> list.set []
list.set [] \<subseteq> list.set unverified_transitions
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) []))

goal (1 subgoal):
 1. covers_unverified_transition t (foldl verify_transition (T1, G1) [])
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
covers_unverified_transition t (foldl verify_transition (T1, G1) [])

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>t \<in> list.set xs; list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) xs); t \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (xs @ [x]))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>t \<in> list.set xs; list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) xs); t \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (xs @ [x]))
[PROOF STEP]
case (snoc t' ts)
[PROOF STATE]
proof (state)
this:
\<lbrakk>t \<in> list.set ts; list.set ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) ts)
t \<in> list.set (ts @ [t'])
list.set (ts @ [t']) \<subseteq> list.set unverified_transitions
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t']))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>t \<in> list.set xs; list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) xs); t \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (xs @ [x]))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>t \<in> list.set ts; list.set ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) ts)
t \<in> list.set (ts @ [t'])
list.set (ts @ [t']) \<subseteq> list.set unverified_transitions
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t']))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))
[PROOF STEP]
have "t \<in> transitions M1" and "t_source t \<in> reachable_states M1" and "((V (t_source t)) @ [(t_input t,t_output t)]) \<noteq> (V (t_target t))"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>t \<in> list.set ts; list.set ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) ts)
t \<in> list.set (ts @ [t'])
list.set (ts @ [t']) \<subseteq> list.set unverified_transitions
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t']))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))

goal (1 subgoal):
 1. t \<in> FSM.transitions M1 &&& t_source t \<in> reachable_states M1 &&& V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t)
[PROOF STEP]
unfolding unverified_transitions_alt_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>t \<in> list.set ts; list.set ts \<subseteq> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) \<noteq> V (t_source t) @ [(t_input t, t_output t)]}; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) ts)
t \<in> list.set (ts @ [t'])
list.set (ts @ [t']) \<subseteq> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) \<noteq> V (t_source t) @ [(t_input t, t_output t)]}
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t']))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))

goal (1 subgoal):
 1. t \<in> FSM.transitions M1 &&& t_source t \<in> reachable_states M1 &&& V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t)
[PROOF STEP]
by force+
[PROOF STATE]
proof (state)
this:
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1
V (t_source t) @ [(t_input t, t_output t)] \<noteq> V (t_target t)

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>t \<in> list.set xs; list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) xs); t \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (xs @ [x]))
[PROOF STEP]
have "t' \<in> transitions M1" and "t_source t' \<in> reachable_states M1" and "((V (t_source t')) @ [(t_input t',t_output t')]) \<noteq> (V (t_target t'))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. t' \<in> FSM.transitions M1 &&& t_source t' \<in> reachable_states M1 &&& V (t_source t') @ [(t_input t', t_output t')] \<noteq> V (t_target t')
[PROOF STEP]
using snoc.prems(2)
[PROOF STATE]
proof (prove)
using this:
list.set (ts @ [t']) \<subseteq> list.set unverified_transitions

goal (1 subgoal):
 1. t' \<in> FSM.transitions M1 &&& t_source t' \<in> reachable_states M1 &&& V (t_source t') @ [(t_input t', t_output t')] \<noteq> V (t_target t')
[PROOF STEP]
unfolding unverified_transitions_alt_def
[PROOF STATE]
proof (prove)
using this:
list.set (ts @ [t']) \<subseteq> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) \<noteq> V (t_source t) @ [(t_input t, t_output t)]}

goal (1 subgoal):
 1. t' \<in> FSM.transitions M1 &&& t_source t' \<in> reachable_states M1 &&& V (t_source t') @ [(t_input t', t_output t')] \<noteq> V (t_target t')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
t' \<in> FSM.transitions M1
t_source t' \<in> reachable_states M1
V (t_source t') @ [(t_input t', t_output t')] \<noteq> V (t_target t')

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>t \<in> list.set xs; list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) xs); t \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (xs @ [x]))
[PROOF STEP]
have "set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> set (fst (foldl verify_transition (T1, G1) (ts@[t'])))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))
[PROOF STEP]
using verify_transition_retains_testsuite
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (verify_transition (?T, ?G) ?t))

goal (1 subgoal):
 1. Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))
[PROOF STEP]
unfolding foldl_append foldl.simps
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (verify_transition (?T, ?G) ?t))

goal (1 subgoal):
 1. Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (verify_transition (foldl verify_transition (T1, G1) ts) t'))
[PROOF STEP]
by (metis eq_fst_iff)
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>t \<in> list.set xs; list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) xs); t \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (xs @ [x]))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))
[PROOF STEP]
have "L M1 \<inter> set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> set (fst (foldl verify_transition (T1, G1) ts))"
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
using snoc.prems(3)
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t']))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>t \<in> list.set xs; list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) xs); t \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (xs @ [x]))
[PROOF STEP]
have *: "L M1 \<inter> Prefix_Tree.set (fst (verify_transition (foldl verify_transition (T1, G1) ts) t')) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (foldl verify_transition (T1, G1) ts) t'))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (verify_transition (foldl verify_transition (T1, G1) ts) t')) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (foldl verify_transition (T1, G1) ts) t'))
[PROOF STEP]
using snoc.prems(3)
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t']))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (verify_transition (foldl verify_transition (T1, G1) ts) t')) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (foldl verify_transition (T1, G1) ts) t'))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (verify_transition (foldl verify_transition (T1, G1) ts) t')) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (foldl verify_transition (T1, G1) ts) t'))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>t \<in> list.set xs; list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) xs); t \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (xs @ [x]))
[PROOF STEP]
have "L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
using \<open>set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> set (fst (foldl verify_transition (T1, G1) (ts@[t'])))\<close> snoc.prems(3)
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t']))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>t \<in> list.set xs; list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) xs); t \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (xs @ [x]))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
have "convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts)) \<and> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))"
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts)) \<and> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
using snoc.prems(2) verify_transition_foldl_invar_1[of ts] verify_transition_foldl_invar_2[of ts]
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))
list.set (ts @ [t']) \<subseteq> list.set unverified_transitions
list.set ts \<subseteq> list.set unverified_transitions \<Longrightarrow> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<and> finite_tree (fst (foldl verify_transition (T1, G1) ts))
\<lbrakk>list.set ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))\<rbrakk> \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts)) \<and> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts)) \<and> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>t \<in> list.set xs; list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) xs); t \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (xs @ [x]))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts)) \<and> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
have covers_t': "covers_unverified_transition t' (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t')"
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts)) \<and> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))

goal (1 subgoal):
 1. covers_unverified_transition t' (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t')
[PROOF STEP]
using verify_transition_cover_prop[OF _ _ \<open>t' \<in> transitions M1\<close> \<open>t_source t' \<in> reachable_states M1\<close> \<open>((V (t_source t')) @ [(t_input t',t_output t')]) \<noteq> (V (t_target t'))\<close>, of "(fst (foldl verify_transition (T1, G1) ts))" "(snd (foldl verify_transition (T1, G1) ts))" ]
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts)) \<and> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))
\<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t')) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t')); convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts)); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))\<rbrakk> \<Longrightarrow> covers_unverified_transition t' (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t')

goal (1 subgoal):
 1. covers_unverified_transition t' (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t')
[PROOF STEP]
unfolding prod.collapse
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts)) \<and> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))
\<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (foldl verify_transition (T1, G1) ts) t')) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (foldl verify_transition (T1, G1) ts) t')); convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts)); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))\<rbrakk> \<Longrightarrow> covers_unverified_transition t' (verify_transition (foldl verify_transition (T1, G1) ts) t')

goal (1 subgoal):
 1. covers_unverified_transition t' (verify_transition (foldl verify_transition (T1, G1) ts) t')
[PROOF STEP]
using *
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts)) \<and> Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))
\<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (verify_transition (foldl verify_transition (T1, G1) ts) t')) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (foldl verify_transition (T1, G1) ts) t')); convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) ts)); Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))\<rbrakk> \<Longrightarrow> covers_unverified_transition t' (verify_transition (foldl verify_transition (T1, G1) ts) t')
L M1 \<inter> Prefix_Tree.set (fst (verify_transition (foldl verify_transition (T1, G1) ts) t')) = L M2 \<inter> Prefix_Tree.set (fst (verify_transition (foldl verify_transition (T1, G1) ts) t'))

goal (1 subgoal):
 1. covers_unverified_transition t' (verify_transition (foldl verify_transition (T1, G1) ts) t')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
covers_unverified_transition t' (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t')

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>t \<in> list.set xs; list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) xs); t \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (xs @ [x]))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
covers_unverified_transition t' (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t')
[PROOF STEP]
have "convergence_graph_lookup_invar M1 M2 cg_lookup (snd (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t'))"
[PROOF STATE]
proof (prove)
using this:
covers_unverified_transition t' (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t')

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t'))
[PROOF STEP]
unfolding covers_unverified_transition
[PROOF STATE]
proof (prove)
using this:
case verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t' of (T', G') \<Rightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t')) \<and> converge M2 \<alpha> (V (t_source t')) \<and> converge M1 \<beta> (V (t_target t')) \<and> converge M2 \<beta> (V (t_target t')) \<and> \<alpha> @ [(t_input t', t_output t')] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T') \<and> converge M2 (V (t_source t') @ [(t_input t', t_output t')]) (V (t_target t')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup G'

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t'))
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t'))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>t \<in> list.set xs; list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) xs); t \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (xs @ [x]))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t'))
[PROOF STEP]
have "convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (ts@[t'])))"
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t'))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (ts @ [t'])))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (ts @ [t'])))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>t \<in> list.set xs; list.set xs \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) xs))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) xs); t \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (xs @ [x])))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (xs @ [x]))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))
[PROOF STEP]
proof (cases "t = t'")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. t = t' \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))
 2. t \<noteq> t' \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
t = t'

goal (2 subgoals):
 1. t = t' \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))
 2. t \<noteq> t' \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
t = t'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
t = t'

goal (1 subgoal):
 1. covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))
[PROOF STEP]
using covers_t'
[PROOF STATE]
proof (prove)
using this:
t = t'
covers_unverified_transition t' (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) t')

goal (1 subgoal):
 1. covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))

goal (1 subgoal):
 1. t \<noteq> t' \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. t \<noteq> t' \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
t \<noteq> t'

goal (1 subgoal):
 1. t \<noteq> t' \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
t \<noteq> t'
[PROOF STEP]
have "t \<in> list.set ts"
[PROOF STATE]
proof (prove)
using this:
t \<noteq> t'

goal (1 subgoal):
 1. t \<in> list.set ts
[PROOF STEP]
using snoc.prems(1)
[PROOF STATE]
proof (prove)
using this:
t \<noteq> t'
t \<in> list.set (ts @ [t'])

goal (1 subgoal):
 1. t \<in> list.set ts
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
t \<in> list.set ts

goal (1 subgoal):
 1. t \<noteq> t' \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))
[PROOF STEP]
have "list.set ts \<subseteq> list.set (unverified_transitions)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list.set ts \<subseteq> list.set unverified_transitions
[PROOF STEP]
using snoc.prems(2)
[PROOF STATE]
proof (prove)
using this:
list.set (ts @ [t']) \<subseteq> list.set unverified_transitions

goal (1 subgoal):
 1. list.set ts \<subseteq> list.set unverified_transitions
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
list.set ts \<subseteq> list.set unverified_transitions

goal (1 subgoal):
 1. t \<noteq> t' \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))
[PROOF STEP]
have "covers_unverified_transition t (foldl verify_transition (T1, G1) ts)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. covers_unverified_transition t (foldl verify_transition (T1, G1) ts)
[PROOF STEP]
using snoc.IH[OF \<open>t \<in> list.set ts\<close>] snoc.prems(2) \<open>L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))\<close>
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>list.set ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))\<rbrakk> \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) ts)
list.set (ts @ [t']) \<subseteq> list.set unverified_transitions
L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))

goal (1 subgoal):
 1. covers_unverified_transition t (foldl verify_transition (T1, G1) ts)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
covers_unverified_transition t (foldl verify_transition (T1, G1) ts)

goal (1 subgoal):
 1. t \<noteq> t' \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
covers_unverified_transition t (foldl verify_transition (T1, G1) ts)
[PROOF STEP]
have "covers_unverified_transition t (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts))"
[PROOF STATE]
proof (prove)
using this:
covers_unverified_transition t (foldl verify_transition (T1, G1) ts)

goal (1 subgoal):
 1. covers_unverified_transition t (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
covers_unverified_transition t (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts))

goal (1 subgoal):
 1. t \<noteq> t' \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
covers_unverified_transition t (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts))
[PROOF STEP]
have "(\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and>
                            converge M2 \<alpha> (V (t_source t)) \<and>
                            converge M1 \<beta> (V (t_target t)) \<and>
                            converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<and> \<beta> \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))) \<and>
                            converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))"
[PROOF STATE]
proof (prove)
using this:
covers_unverified_transition t (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts))

goal (1 subgoal):
 1. (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<and> \<beta> \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
unfolding covers_unverified_transition
[PROOF STATE]
proof (prove)
using this:
case (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) of (T', G') \<Rightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T') \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup G'

goal (1 subgoal):
 1. (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<and> \<beta> \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<and> \<beta> \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))

goal (1 subgoal):
 1. t \<noteq> t' \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<and> \<beta> \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))

goal (1 subgoal):
 1. t \<noteq> t' \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))
[PROOF STEP]
have "set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> set (fst (foldl verify_transition (T1, G1) (ts@[t'])))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))
[PROOF STEP]
using verify_transition_retains_testsuite[of "(fst (foldl verify_transition (T1, G1) ts))" "(snd (foldl verify_transition (T1, G1) ts))"]
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (verify_transition (fst (foldl verify_transition (T1, G1) ts), snd (foldl verify_transition (T1, G1) ts)) ?t))

goal (1 subgoal):
 1. Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))
[PROOF STEP]
unfolding prod.collapse
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (verify_transition (foldl verify_transition (T1, G1) ts) ?t))

goal (1 subgoal):
 1. Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))

goal (1 subgoal):
 1. t \<noteq> t' \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<and> \<beta> \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))
[PROOF STEP]
have "(\<exists>\<alpha> \<beta>.
                            converge M1 \<alpha> (V (t_source t)) \<and>
                            converge M2 \<alpha> (V (t_source t)) \<and>
                            converge M1 \<beta> (V (t_target t)) \<and>
                            converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts@[t']))) \<and> \<beta> \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts@[t'])))) \<and>
                            converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))"
[PROOF STATE]
proof (prove)
using this:
(\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<and> \<beta> \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts))) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ts)) \<subseteq> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))

goal (1 subgoal):
 1. (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t']))) \<and> \<beta> \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t']))) \<and> \<beta> \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))

goal (1 subgoal):
 1. t \<noteq> t' \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t']))) \<and> \<beta> \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
have "covers_unverified_transition t (fst (foldl verify_transition (T1, G1) (ts@[t'])), snd (foldl verify_transition (T1, G1) (ts@[t'])))"
[PROOF STATE]
proof (prove)
using this:
(\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t']))) \<and> \<beta> \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))

goal (1 subgoal):
 1. covers_unverified_transition t (fst (foldl verify_transition (T1, G1) (ts @ [t'])), snd (foldl verify_transition (T1, G1) (ts @ [t'])))
[PROOF STEP]
unfolding covers_unverified_transition
[PROOF STATE]
proof (prove)
using this:
(\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t']))) \<and> \<beta> \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))

goal (1 subgoal):
 1. case (fst (foldl verify_transition (T1, G1) (ts @ [t'])), snd (foldl verify_transition (T1, G1) (ts @ [t']))) of (T', G') \<Rightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T') \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup G'
[PROOF STEP]
using \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (ts@[t'])))\<close>
[PROOF STATE]
proof (prove)
using this:
(\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t']))) \<and> \<beta> \<in> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) (ts @ [t'])))) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl verify_transition (T1, G1) (ts @ [t'])))

goal (1 subgoal):
 1. case (fst (foldl verify_transition (T1, G1) (ts @ [t'])), snd (foldl verify_transition (T1, G1) (ts @ [t']))) of (T', G') \<Rightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T') \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup G'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
covers_unverified_transition t (fst (foldl verify_transition (T1, G1) (ts @ [t'])), snd (foldl verify_transition (T1, G1) (ts @ [t'])))

goal (1 subgoal):
 1. t \<noteq> t' \<Longrightarrow> covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
covers_unverified_transition t (fst (foldl verify_transition (T1, G1) (ts @ [t'])), snd (foldl verify_transition (T1, G1) (ts @ [t'])))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
covers_unverified_transition t (fst (foldl verify_transition (T1, G1) (ts @ [t'])), snd (foldl verify_transition (T1, G1) (ts @ [t'])))

goal (1 subgoal):
 1. covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
covers_unverified_transition t (foldl verify_transition (T1, G1) (ts @ [t']))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
covers_unverified_transition t (foldl verify_transition (T1, G1) ts)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>?t \<in> list.set ?ts; list.set ?ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ?ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ?ts))\<rbrakk> \<Longrightarrow> covers_unverified_transition ?t (foldl verify_transition (T1, G1) ?ts)

goal (1 subgoal):
 1. \<And>t. \<lbrakk>L M1 \<inter> Prefix_Tree.set T2 = L M2 \<inter> Prefix_Tree.set T2; t \<in> list.set unverified_transitions\<rbrakk> \<Longrightarrow> covers_unverified_transition t (T2, G2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>?t \<in> list.set ?ts; list.set ?ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ?ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ?ts))\<rbrakk> \<Longrightarrow> covers_unverified_transition ?t (foldl verify_transition (T1, G1) ?ts)
[PROOF STEP]
show "\<And> t . L M1 \<inter> set T2 = L M2 \<inter> set T2 \<Longrightarrow> t \<in> list.set unverified_transitions \<Longrightarrow> covers_unverified_transition t (T2,G2)"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?t \<in> list.set ?ts; list.set ?ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ?ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ?ts))\<rbrakk> \<Longrightarrow> covers_unverified_transition ?t (foldl verify_transition (T1, G1) ?ts)

goal (1 subgoal):
 1. \<And>t. \<lbrakk>L M1 \<inter> Prefix_Tree.set T2 = L M2 \<inter> Prefix_Tree.set T2; t \<in> list.set unverified_transitions\<rbrakk> \<Longrightarrow> covers_unverified_transition t (T2, G2)
[PROOF STEP]
unfolding TG2 T2 G2 \<open>TG1 = (T1,G1)\<close>
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?t \<in> list.set ?ts; list.set ?ts \<subseteq> list.set unverified_transitions; L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ?ts)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) ?ts))\<rbrakk> \<Longrightarrow> covers_unverified_transition ?t (foldl verify_transition (T1, G1) ?ts)

goal (1 subgoal):
 1. \<And>t. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) unverified_transitions)) = L M2 \<inter> Prefix_Tree.set (fst (foldl verify_transition (T1, G1) unverified_transitions)); t \<in> list.set unverified_transitions\<rbrakk> \<Longrightarrow> covers_unverified_transition t (fst (foldl verify_transition (T1, G1) unverified_transitions), snd (foldl verify_transition (T1, G1) unverified_transitions))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set T2 = L M2 \<inter> Prefix_Tree.set T2; ?t \<in> list.set unverified_transitions\<rbrakk> \<Longrightarrow> covers_unverified_transition ?t (T2, G2)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set T2 = L M2 \<inter> Prefix_Tree.set T2; ?t \<in> list.set unverified_transitions\<rbrakk> \<Longrightarrow> covers_unverified_transition ?t (T2, G2)

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
(* properties of T3 derived from those of T1 and T2 and the assumption that T3 is passed by M2 *)
[PROOF STATE]
proof (state)
this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set T2 = L M2 \<inter> Prefix_Tree.set T2; ?t \<in> list.set unverified_transitions\<rbrakk> \<Longrightarrow> covers_unverified_transition ?t (T2, G2)

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have verify_undefined_io_pair_retains_testsuite: "\<And> qxy T . set T \<subseteq> set (verify_undefined_io_pair T qxy)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>qxy T. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (verify_undefined_io_pair T qxy)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>qxy T. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (verify_undefined_io_pair T qxy)
[PROOF STEP]
fix qxy :: "('a \<times> 'b \<times> 'c)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>qxy T. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (verify_undefined_io_pair T qxy)
[PROOF STEP]
fix T
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>qxy T. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (verify_undefined_io_pair T qxy)
[PROOF STEP]
obtain q x y where "qxy = (q,x,y)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>q x y. qxy = (q, x, y) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using prod.exhaust
[PROOF STATE]
proof (prove)
using this:
(\<And>x1 x2. ?y = (x1, x2) \<Longrightarrow> ?P) \<Longrightarrow> ?P

goal (1 subgoal):
 1. (\<And>q x y. qxy = (q, x, y) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
qxy = (q, x, y)

goal (1 subgoal):
 1. \<And>qxy T. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (verify_undefined_io_pair T qxy)
[PROOF STEP]
show \<open>set T \<subseteq> set (verify_undefined_io_pair T qxy)\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (verify_undefined_io_pair T qxy)
[PROOF STEP]
unfolding \<open>qxy = (q,x,y)\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y))
[PROOF STEP]
using \<open>verifies_io_pair append_io_pair M1 M2 cg_insert cg_lookup\<close>
[PROOF STATE]
proof (prove)
using this:
verifies_io_pair append_io_pair M1 M2 cg_insert cg_lookup

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y))
[PROOF STEP]
unfolding verifies_io_pair_def verify_undefined_io_pair case_prod_conv
[PROOF STATE]
proof (prove)
using this:
\<forall>V T G q x y. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1 \<longrightarrow> q \<in> reachable_states M1 \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) = L M2 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<longrightarrow> (\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y))) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (append_io_pair M1 V T G cg_insert cg_lookup q x y)))

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (append_io_pair M1 V T (snd TG2) cg_insert cg_lookup q x y))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (verify_undefined_io_pair T qxy)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (verify_undefined_io_pair ?T ?qxy)

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have verify_undefined_io_pair_folding_retains_testsuite: "\<And> qxys T . set T \<subseteq> set (foldl verify_undefined_io_pair T qxys)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>qxys T. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>qxys T. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)
[PROOF STEP]
fix qxys T
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>qxys T. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)
[PROOF STEP]
show "set T \<subseteq> set (foldl verify_undefined_io_pair T qxys)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)
[PROOF STEP]
using verify_undefined_io_pair_retains_testsuite
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (verify_undefined_io_pair ?T ?qxy)

goal (1 subgoal):
 1. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)
[PROOF STEP]
by (induction qxys rule: rev_induct; force)
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair ?T ?qxys)

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have verify_undefined_io_pair_retains_finiteness: "\<And> qxy T . finite_tree T \<Longrightarrow> finite_tree (verify_undefined_io_pair T qxy)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>qxy T. finite_tree T \<Longrightarrow> finite_tree (verify_undefined_io_pair T qxy)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>qxy T. finite_tree T \<Longrightarrow> finite_tree (verify_undefined_io_pair T qxy)
[PROOF STEP]
fix qxy :: "('a \<times> 'b \<times> 'c)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>qxy T. finite_tree T \<Longrightarrow> finite_tree (verify_undefined_io_pair T qxy)
[PROOF STEP]
fix T :: "('b\<times>'c) prefix_tree"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>qxy T. finite_tree T \<Longrightarrow> finite_tree (verify_undefined_io_pair T qxy)
[PROOF STEP]
assume "finite_tree T"
[PROOF STATE]
proof (state)
this:
finite_tree T

goal (1 subgoal):
 1. \<And>qxy T. finite_tree T \<Longrightarrow> finite_tree (verify_undefined_io_pair T qxy)
[PROOF STEP]
obtain q x y where "qxy = (q,x,y)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>q x y. qxy = (q, x, y) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using prod.exhaust
[PROOF STATE]
proof (prove)
using this:
(\<And>x1 x2. ?y = (x1, x2) \<Longrightarrow> ?P) \<Longrightarrow> ?P

goal (1 subgoal):
 1. (\<And>q x y. qxy = (q, x, y) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
qxy = (q, x, y)

goal (1 subgoal):
 1. \<And>qxy T. finite_tree T \<Longrightarrow> finite_tree (verify_undefined_io_pair T qxy)
[PROOF STEP]
show \<open>finite_tree (verify_undefined_io_pair T qxy)\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite_tree (verify_undefined_io_pair T qxy)
[PROOF STEP]
unfolding \<open>qxy = (q,x,y)\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite_tree (verify_undefined_io_pair T (q, x, y))
[PROOF STEP]
using \<open>verifies_io_pair append_io_pair M1 M2 cg_insert cg_lookup\<close> \<open>finite_tree T\<close>
[PROOF STATE]
proof (prove)
using this:
verifies_io_pair append_io_pair M1 M2 cg_insert cg_lookup
finite_tree T

goal (1 subgoal):
 1. finite_tree (verify_undefined_io_pair T (q, x, y))
[PROOF STEP]
unfolding verifies_io_pair_def verify_undefined_io_pair case_prod_conv
[PROOF STATE]
proof (prove)
using this:
\<forall>V T G q x y. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1 \<longrightarrow> q \<in> reachable_states M1 \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) = L M2 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<longrightarrow> (\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y))) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (append_io_pair M1 V T G cg_insert cg_lookup q x y)))
finite_tree T

goal (1 subgoal):
 1. finite_tree (fst (append_io_pair M1 V T (snd TG2) cg_insert cg_lookup q x y))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
finite_tree (verify_undefined_io_pair T qxy)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
finite_tree ?T \<Longrightarrow> finite_tree (verify_undefined_io_pair ?T ?qxy)

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have verify_undefined_io_pair_folding_retains_finiteness: "\<And> qxys T . finite_tree T \<Longrightarrow> finite_tree (foldl verify_undefined_io_pair T qxys)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>qxys T. finite_tree T \<Longrightarrow> finite_tree (foldl verify_undefined_io_pair T qxys)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>qxys T. finite_tree T \<Longrightarrow> finite_tree (foldl verify_undefined_io_pair T qxys)
[PROOF STEP]
fix qxys
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>qxys T. finite_tree T \<Longrightarrow> finite_tree (foldl verify_undefined_io_pair T qxys)
[PROOF STEP]
fix T :: "('b\<times>'c) prefix_tree"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>qxys T. finite_tree T \<Longrightarrow> finite_tree (foldl verify_undefined_io_pair T qxys)
[PROOF STEP]
assume "finite_tree T"
[PROOF STATE]
proof (state)
this:
finite_tree T

goal (1 subgoal):
 1. \<And>qxys T. finite_tree T \<Longrightarrow> finite_tree (foldl verify_undefined_io_pair T qxys)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
finite_tree T
[PROOF STEP]
show "finite_tree (foldl verify_undefined_io_pair T qxys)"
[PROOF STATE]
proof (prove)
using this:
finite_tree T

goal (1 subgoal):
 1. finite_tree (foldl verify_undefined_io_pair T qxys)
[PROOF STEP]
using verify_undefined_io_pair_retains_finiteness
[PROOF STATE]
proof (prove)
using this:
finite_tree T
finite_tree ?T \<Longrightarrow> finite_tree (verify_undefined_io_pair ?T ?qxy)

goal (1 subgoal):
 1. finite_tree (foldl verify_undefined_io_pair T qxys)
[PROOF STEP]
by (induction qxys rule: rev_induct; force)
[PROOF STATE]
proof (state)
this:
finite_tree (foldl verify_undefined_io_pair T qxys)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
finite_tree ?T \<Longrightarrow> finite_tree (foldl verify_undefined_io_pair ?T ?qxys)

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have "set T2 \<subseteq> set T3"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T2 \<subseteq> Prefix_Tree.set T3
[PROOF STEP]
unfolding T3 T2
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (fst TG2) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) undefined_io_pairs)
[PROOF STEP]
proof (induction undefined_io_pairs rule: rev_induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. Prefix_Tree.set (fst TG2) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) [])
 2. \<And>x xs. Prefix_Tree.set (fst TG2) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) xs) \<Longrightarrow> Prefix_Tree.set (fst TG2) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) (xs @ [x]))
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:

goal (2 subgoals):
 1. Prefix_Tree.set (fst TG2) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) [])
 2. \<And>x xs. Prefix_Tree.set (fst TG2) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) xs) \<Longrightarrow> Prefix_Tree.set (fst TG2) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) (xs @ [x]))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (fst TG2) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) [])
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst TG2) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) [])

goal (1 subgoal):
 1. \<And>x xs. Prefix_Tree.set (fst TG2) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) xs) \<Longrightarrow> Prefix_Tree.set (fst TG2) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) (xs @ [x]))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x xs. Prefix_Tree.set (fst TG2) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) xs) \<Longrightarrow> Prefix_Tree.set (fst TG2) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) (xs @ [x]))
[PROOF STEP]
case (snoc x xs)
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst TG2) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) xs)

goal (1 subgoal):
 1. \<And>x xs. Prefix_Tree.set (fst TG2) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) xs) \<Longrightarrow> Prefix_Tree.set (fst TG2) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) (xs @ [x]))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set (fst TG2) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) xs)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TG2) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) xs)

goal (1 subgoal):
 1. Prefix_Tree.set (fst TG2) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) (xs @ [x]))
[PROOF STEP]
using verify_undefined_io_pair_retains_testsuite[of "(foldl verify_undefined_io_pair (fst TG2) xs)" x]
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (fst TG2) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) xs)
Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) xs) \<subseteq> Prefix_Tree.set (verify_undefined_io_pair (foldl verify_undefined_io_pair (fst TG2) xs) x)

goal (1 subgoal):
 1. Prefix_Tree.set (fst TG2) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) (xs @ [x]))
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst TG2) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) (xs @ [x]))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T2 \<subseteq> Prefix_Tree.set T3

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set T2 \<subseteq> Prefix_Tree.set T3
[PROOF STEP]
have passes_T2: "((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS)) \<Longrightarrow> L M1 \<inter> set T2 = L M2 \<inter> set T2"
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T2 \<subseteq> Prefix_Tree.set T3

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 \<inter> Prefix_Tree.set T2 = L M2 \<inter> Prefix_Tree.set T2
[PROOF STEP]
using \<open>((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS)) \<Longrightarrow> (L M1 \<inter> set T3 = L M2 \<inter> set T3)\<close>
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T2 \<subseteq> Prefix_Tree.set T3
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 \<inter> Prefix_Tree.set T3 = L M2 \<inter> Prefix_Tree.set T3

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 \<inter> Prefix_Tree.set T2 = L M2 \<inter> Prefix_Tree.set T2
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 \<inter> Prefix_Tree.set T2 = L M2 \<inter> Prefix_Tree.set T2

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have "set T1 \<subseteq> set T3"
  and  G2_invar: "((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS)) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T3 &&& (L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G2)
[PROOF STEP]
using T2_invar_1 T2_invar_2[OF passes_T2] \<open>set T2 \<subseteq> set T3\<close>
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T2
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G2
Prefix_Tree.set T2 \<subseteq> Prefix_Tree.set T3

goal (1 subgoal):
 1. Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T3 &&& (L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T3
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G2

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T3
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G2
[PROOF STEP]
have passes_T1: "((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS)) \<Longrightarrow> L M1 \<inter> set T1 = L M2 \<inter> set T1"
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T3
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G2

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1
[PROOF STEP]
using \<open>((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS)) \<Longrightarrow> L M1 \<inter> set T3 = L M2 \<inter> set T3\<close>
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T3
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G2
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 \<inter> Prefix_Tree.set T3 = L M2 \<inter> Prefix_Tree.set T3

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have T3_preserves_divergence : "((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS)) \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1)
[PROOF STEP]
using T1_V_div[OF passes_T1]
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1)

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1)

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have T3_state_cover : "V ` reachable_states M1 \<subseteq> set T3"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V ` reachable_states M1 \<subseteq> Prefix_Tree.set T3
[PROOF STEP]
using T1_state_cover \<open>set T1 \<subseteq> set T3\<close>
[PROOF STATE]
proof (prove)
using this:
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T1
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T3

goal (1 subgoal):
 1. V ` reachable_states M1 \<subseteq> Prefix_Tree.set T3
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T3

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have T3_covers_transitions : "((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS)) \<Longrightarrow> (\<And> t . t \<in> transitions M1 \<Longrightarrow> t_source t \<in> reachable_states M1 \<Longrightarrow>
          (\<exists>\<alpha> \<beta>.
            converge M1 \<alpha> (V (t_source t)) \<and>
            converge M2 \<alpha> (V (t_source t)) \<and>
            converge M1 \<beta> (V (t_target t)) \<and>
            converge M2 \<beta> (V (t_target t)) \<and>
            \<alpha> @ [(t_input t, t_output t)] \<in> set T3 \<and>
            \<beta> \<in> set T3)
          \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)))"
    (is "((L M1 \<inter> set ?TS') = (L M2 \<inter> set ?TS')) \<Longrightarrow> (\<And> t . t \<in> transitions M1 \<Longrightarrow> t_source t \<in> reachable_states M1 \<Longrightarrow> ?P1 t T3 \<and> ?P2 t)")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>t. \<lbrakk>t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1\<rbrakk> \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>t. \<lbrakk>t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1\<rbrakk> \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)))
[PROOF STEP]
fix t
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>t. \<lbrakk>t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1\<rbrakk> \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)))
[PROOF STEP]
assume "t \<in> transitions M1" and "t_source t \<in> reachable_states M1" and "((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS))"
[PROOF STATE]
proof (state)
this:
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>t. \<lbrakk>t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1\<rbrakk> \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
consider "t \<in> sc_covered_transitions" | "t \<in> list.set unverified_transitions"
[PROOF STATE]
proof (prove)
using this:
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)

goal (1 subgoal):
 1. \<lbrakk>t \<in> sc_covered_transitions \<Longrightarrow> thesis; t \<in> list.set unverified_transitions \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
unfolding sc_covered_transitions_alt_def unverified_transitions_alt_def
[PROOF STATE]
proof (prove)
using this:
t \<in> FSM.transitions M1
t_source t \<in> reachable_states M1
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)

goal (1 subgoal):
 1. \<lbrakk>t \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]} \<Longrightarrow> thesis; t \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) \<noteq> V (t_source t) @ [(t_input t, t_output t)]} \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>t \<in> sc_covered_transitions \<Longrightarrow> ?thesis; t \<in> list.set unverified_transitions \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>t. \<lbrakk>t \<in> FSM.transitions M1; t_source t \<in> reachable_states M1\<rbrakk> \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>t \<in> sc_covered_transitions \<Longrightarrow> ?thesis; t \<in> list.set unverified_transitions \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
[PROOF STEP]
show "?P1 t T3 \<and> ?P2 t"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>t \<in> sc_covered_transitions \<Longrightarrow> ?thesis; t \<in> list.set unverified_transitions \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
proof cases
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. t \<in> sc_covered_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
 2. t \<in> list.set unverified_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:
t \<in> sc_covered_transitions

goal (2 subgoals):
 1. t \<in> sc_covered_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
 2. t \<in> list.set unverified_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
have "(V (t_source t)) \<in> L M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V (t_source t) \<in> L M1
[PROOF STEP]
using state_cover_assignment_after[OF assms(1) \<open>is_state_cover_assignment M1 V\<close> \<open>t_source t \<in> reachable_states M1\<close>]
[PROOF STATE]
proof (prove)
using this:
V (t_source t) \<in> L M1
after_initial M1 (V (t_source t)) = t_source t

goal (1 subgoal):
 1. V (t_source t) \<in> L M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
V (t_source t) \<in> L M1

goal (2 subgoals):
 1. t \<in> sc_covered_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
 2. t \<in> list.set unverified_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V (t_source t) \<in> L M1
[PROOF STEP]
have p3: "converge M1 (V (t_source t)) (V (t_source t))"
[PROOF STATE]
proof (prove)
using this:
V (t_source t) \<in> L M1

goal (1 subgoal):
 1. converge M1 (V (t_source t)) (V (t_source t))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M1 (V (t_source t)) (V (t_source t))

goal (2 subgoals):
 1. t \<in> sc_covered_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
 2. t \<in> list.set unverified_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
have "(V (t_source t)) \<in> L M2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V (t_source t) \<in> L M2
[PROOF STEP]
using passes_T1[OF \<open>((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS))\<close>] T1_state_cover \<open>t_source t \<in> reachable_states M1\<close> \<open>(V (t_source t)) \<in> L M1\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T1
t_source t \<in> reachable_states M1
V (t_source t) \<in> L M1

goal (1 subgoal):
 1. V (t_source t) \<in> L M2
[PROOF STEP]
by (metis IntI image_subset_iff inf.cobounded1 subsetD)
[PROOF STATE]
proof (state)
this:
V (t_source t) \<in> L M2

goal (2 subgoals):
 1. t \<in> sc_covered_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
 2. t \<in> list.set unverified_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V (t_source t) \<in> L M2
[PROOF STEP]
have p4: "converge M2 (V (t_source t)) (V (t_source t))"
[PROOF STATE]
proof (prove)
using this:
V (t_source t) \<in> L M2

goal (1 subgoal):
 1. converge M2 (V (t_source t)) (V (t_source t))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M2 (V (t_source t)) (V (t_source t))

goal (2 subgoals):
 1. t \<in> sc_covered_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
 2. t \<in> list.set unverified_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
have "t_target t \<in> reachable_states M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. t_target t \<in> reachable_states M1
[PROOF STEP]
using reachable_states_next[OF \<open>t_source t \<in> reachable_states M1\<close> \<open>t \<in> transitions M1\<close>]
[PROOF STATE]
proof (prove)
using this:
t_source t = t_source t \<Longrightarrow> t_target t \<in> reachable_states M1

goal (1 subgoal):
 1. t_target t \<in> reachable_states M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
t_target t \<in> reachable_states M1

goal (2 subgoals):
 1. t \<in> sc_covered_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
 2. t \<in> list.set unverified_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
t_target t \<in> reachable_states M1
[PROOF STEP]
have "(V (t_target t)) \<in> L M1"
[PROOF STATE]
proof (prove)
using this:
t_target t \<in> reachable_states M1

goal (1 subgoal):
 1. V (t_target t) \<in> L M1
[PROOF STEP]
using state_cover_assignment_after[OF assms(1) \<open>is_state_cover_assignment M1 V\<close> ]
[PROOF STATE]
proof (prove)
using this:
t_target t \<in> reachable_states M1
?q \<in> reachable_states M1 \<Longrightarrow> V ?q \<in> L M1
?q \<in> reachable_states M1 \<Longrightarrow> after_initial M1 (V ?q) = ?q

goal (1 subgoal):
 1. V (t_target t) \<in> L M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
V (t_target t) \<in> L M1

goal (2 subgoals):
 1. t \<in> sc_covered_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
 2. t \<in> list.set unverified_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V (t_target t) \<in> L M1
[PROOF STEP]
have p5: "converge M1 (V (t_target t)) (V (t_target t))"
[PROOF STATE]
proof (prove)
using this:
V (t_target t) \<in> L M1

goal (1 subgoal):
 1. converge M1 (V (t_target t)) (V (t_target t))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M1 (V (t_target t)) (V (t_target t))

goal (2 subgoals):
 1. t \<in> sc_covered_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
 2. t \<in> list.set unverified_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
have "(V (t_target t)) \<in> L M2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V (t_target t) \<in> L M2
[PROOF STEP]
using passes_T1[OF \<open>((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS))\<close>] T1_state_cover \<open>t_target t \<in> reachable_states M1\<close> \<open>(V (t_target t)) \<in> L M1\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set T1 = L M2 \<inter> Prefix_Tree.set T1
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T1
t_target t \<in> reachable_states M1
V (t_target t) \<in> L M1

goal (1 subgoal):
 1. V (t_target t) \<in> L M2
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V (t_target t) \<in> L M2

goal (2 subgoals):
 1. t \<in> sc_covered_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
 2. t \<in> list.set unverified_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V (t_target t) \<in> L M2
[PROOF STEP]
have p6: "converge M2 (V (t_target t)) (V (t_target t))"
[PROOF STATE]
proof (prove)
using this:
V (t_target t) \<in> L M2

goal (1 subgoal):
 1. converge M2 (V (t_target t)) (V (t_target t))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M2 (V (t_target t)) (V (t_target t))

goal (2 subgoals):
 1. t \<in> sc_covered_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
 2. t \<in> list.set unverified_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
have p8: "(V (t_target t)) \<in> set T3"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V (t_target t) \<in> Prefix_Tree.set T3
[PROOF STEP]
using T3_state_cover \<open>t_target t \<in> reachable_states M1\<close>
[PROOF STATE]
proof (prove)
using this:
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T3
t_target t \<in> reachable_states M1

goal (1 subgoal):
 1. V (t_target t) \<in> Prefix_Tree.set T3
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
V (t_target t) \<in> Prefix_Tree.set T3

goal (2 subgoals):
 1. t \<in> sc_covered_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
 2. t \<in> list.set unverified_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V (t_target t) \<in> Prefix_Tree.set T3
[PROOF STEP]
have p7: "(V (t_source t)) @ [(t_input t, t_output t)] \<in> set T3"
[PROOF STATE]
proof (prove)
using this:
V (t_target t) \<in> Prefix_Tree.set T3

goal (1 subgoal):
 1. V (t_source t) @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3
[PROOF STEP]
using 1
[PROOF STATE]
proof (prove)
using this:
V (t_target t) \<in> Prefix_Tree.set T3
t \<in> sc_covered_transitions

goal (1 subgoal):
 1. V (t_source t) @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3
[PROOF STEP]
unfolding sc_covered_transitions_alt_def
[PROOF STATE]
proof (prove)
using this:
V (t_target t) \<in> Prefix_Tree.set T3
t \<in> {t \<in> FSM.transitions M1. t_source t \<in> reachable_states M1 \<and> V (t_target t) = V (t_source t) @ [(t_input t, t_output t)]}

goal (1 subgoal):
 1. V (t_source t) @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
V (t_source t) @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3

goal (2 subgoals):
 1. t \<in> sc_covered_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
 2. t \<in> list.set unverified_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
have "?P2 t"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
using T1_covered_transitions_conv[OF passes_T1[OF \<open>((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS))\<close>] 1]
[PROOF STATE]
proof (prove)
using this:
converge M2 (V (t_target t)) (V (t_source t) @ [(t_input t, t_output t)])

goal (1 subgoal):
 1. converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))

goal (2 subgoals):
 1. t \<in> sc_covered_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
 2. t \<in> list.set unverified_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))

goal (1 subgoal):
 1. (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
using p3 p4 p5 p6 p7 p8
[PROOF STATE]
proof (prove)
using this:
converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
converge M1 (V (t_source t)) (V (t_source t))
converge M2 (V (t_source t)) (V (t_source t))
converge M1 (V (t_target t)) (V (t_target t))
converge M2 (V (t_target t)) (V (t_target t))
V (t_source t) @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3
V (t_target t) \<in> Prefix_Tree.set T3

goal (1 subgoal):
 1. (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))

goal (1 subgoal):
 1. t \<in> list.set unverified_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. t \<in> list.set unverified_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:
t \<in> list.set unverified_transitions

goal (1 subgoal):
 1. t \<in> list.set unverified_transitions \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
using T2_cover[OF passes_T2[OF \<open>((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS))\<close>] 2] \<open>set T2 \<subseteq> set T3\<close>
[PROOF STATE]
proof (prove)
using this:
covers_unverified_transition t (T2, G2)
Prefix_Tree.set T2 \<subseteq> Prefix_Tree.set T3

goal (1 subgoal):
 1. (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
unfolding covers_unverified_transition
[PROOF STATE]
proof (prove)
using this:
case (T2, G2) of (T', G') \<Rightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T' \<and> \<beta> \<in> Prefix_Tree.set T') \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t)) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup G'
Prefix_Tree.set T2 \<subseteq> Prefix_Tree.set T3

goal (1 subgoal):
 1. (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source t)) \<and> converge M2 \<alpha> (V (t_source t)) \<and> converge M1 \<beta> (V (t_target t)) \<and> converge M2 \<beta> (V (t_target t)) \<and> \<alpha> @ [(t_input t, t_output t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m); ?t \<in> FSM.transitions M1; t_source ?t \<in> reachable_states M1\<rbrakk> \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source ?t)) \<and> converge M2 \<alpha> (V (t_source ?t)) \<and> converge M1 \<beta> (V (t_target ?t)) \<and> converge M2 \<beta> (V (t_target ?t)) \<and> \<alpha> @ [(t_input ?t, t_output ?t)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source ?t) @ [(t_input ?t, t_output ?t)]) (V (t_target ?t))

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have T3_covers_defined_io_pairs : "((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS)) \<Longrightarrow> (\<And> q x y q' . q \<in> reachable_states M1 \<Longrightarrow> h_obs M1 q x y = Some q' \<Longrightarrow>
          (\<exists>\<alpha> \<beta>.
            converge M1 \<alpha> (V q) \<and>
            converge M2 \<alpha> (V q) \<and>
            converge M1 \<beta> (V q') \<and>
            converge M2 \<beta> (V q') \<and>
            \<alpha> @ [(x,y)] \<in> set T3 \<and>
            \<beta> \<in> set T3)
          \<and> converge M1 (V q @ [(x,y)]) (V q') \<and> converge M2 (V q @ [(x,y)]) (V q'))"
    (is "((L M1 \<inter> set ?TS') = (L M2 \<inter> set ?TS')) \<Longrightarrow> (\<And> q x y q' . q \<in> reachable_states M1 \<Longrightarrow> h_obs M1 q x y = Some q' \<Longrightarrow> ?P q x y q')")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y q'. \<lbrakk>q \<in> reachable_states M1; FSM.h_obs M1 q x y = Some q'\<rbrakk> \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q'))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y q'. \<lbrakk>q \<in> reachable_states M1; FSM.h_obs M1 q x y = Some q'\<rbrakk> \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q'))
[PROOF STEP]
fix q x y q'
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y q'. \<lbrakk>q \<in> reachable_states M1; FSM.h_obs M1 q x y = Some q'\<rbrakk> \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q'))
[PROOF STEP]
assume "q \<in> reachable_states M1" and "h_obs M1 q x y = Some q'" and "((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS))"
[PROOF STATE]
proof (state)
this:
q \<in> reachable_states M1
FSM.h_obs M1 q x y = Some q'
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y q'. \<lbrakk>q \<in> reachable_states M1; FSM.h_obs M1 q x y = Some q'\<rbrakk> \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q'))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
q \<in> reachable_states M1
FSM.h_obs M1 q x y = Some q'
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have "(q,x,y,q') \<in> transitions M1" and "t_source (q,x,y,q') \<in> reachable_states M1"
[PROOF STATE]
proof (prove)
using this:
q \<in> reachable_states M1
FSM.h_obs M1 q x y = Some q'
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)

goal (1 subgoal):
 1. (q, x, y, q') \<in> FSM.transitions M1 &&& t_source (q, x, y, q') \<in> reachable_states M1
[PROOF STEP]
using h_obs_Some[OF assms(1)]
[PROOF STATE]
proof (prove)
using this:
q \<in> reachable_states M1
FSM.h_obs M1 q x y = Some q'
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
(FSM.h_obs M1 ?q ?x ?y = Some ?q') = ({q'. (?q, ?x, ?y, q') \<in> FSM.transitions M1} = {?q'})

goal (1 subgoal):
 1. (q, x, y, q') \<in> FSM.transitions M1 &&& t_source (q, x, y, q') \<in> reachable_states M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(q, x, y, q') \<in> FSM.transitions M1
t_source (q, x, y, q') \<in> reachable_states M1

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y q'. \<lbrakk>q \<in> reachable_states M1; FSM.h_obs M1 q x y = Some q'\<rbrakk> \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q'))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(q, x, y, q') \<in> FSM.transitions M1
t_source (q, x, y, q') \<in> reachable_states M1

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y q'. \<lbrakk>q \<in> reachable_states M1; FSM.h_obs M1 q x y = Some q'\<rbrakk> \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q'))
[PROOF STEP]
have "converge M1 (V q @ [(x,y)]) (V q')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. converge M1 (V q @ [(x, y)]) (V q')
[PROOF STEP]
using state_cover_transition_converges[OF assms(1) \<open>is_state_cover_assignment M1 V\<close> calculation]
[PROOF STATE]
proof (prove)
using this:
converge M1 (V (t_source (q, x, y, q')) @ [(t_input (q, x, y, q'), t_output (q, x, y, q'))]) (V (t_target (q, x, y, q')))

goal (1 subgoal):
 1. converge M1 (V q @ [(x, y)]) (V q')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M1 (V q @ [(x, y)]) (V q')

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y q'. \<lbrakk>q \<in> reachable_states M1; FSM.h_obs M1 q x y = Some q'\<rbrakk> \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q'))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(q, x, y, q') \<in> FSM.transitions M1
t_source (q, x, y, q') \<in> reachable_states M1
converge M1 (V q @ [(x, y)]) (V q')
[PROOF STEP]
show "?P q x y q'"
[PROOF STATE]
proof (prove)
using this:
(q, x, y, q') \<in> FSM.transitions M1
t_source (q, x, y, q') \<in> reachable_states M1
converge M1 (V q @ [(x, y)]) (V q')

goal (1 subgoal):
 1. (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')
[PROOF STEP]
using T3_covers_transitions[of "(q,x,y,q')", OF \<open>((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS))\<close>]
[PROOF STATE]
proof (prove)
using this:
(q, x, y, q') \<in> FSM.transitions M1
t_source (q, x, y, q') \<in> reachable_states M1
converge M1 (V q @ [(x, y)]) (V q')
\<lbrakk>(q, x, y, q') \<in> FSM.transitions M1; t_source (q, x, y, q') \<in> reachable_states M1\<rbrakk> \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V (t_source (q, x, y, q'))) \<and> converge M2 \<alpha> (V (t_source (q, x, y, q'))) \<and> converge M1 \<beta> (V (t_target (q, x, y, q'))) \<and> converge M2 \<beta> (V (t_target (q, x, y, q'))) \<and> \<alpha> @ [(t_input (q, x, y, q'), t_output (q, x, y, q'))] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V (t_source (q, x, y, q')) @ [(t_input (q, x, y, q'), t_output (q, x, y, q'))]) (V (t_target (q, x, y, q')))

goal (1 subgoal):
 1. (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')
[PROOF STEP]
unfolding fst_conv snd_conv
[PROOF STATE]
proof (prove)
using this:
(q, x, y, q') \<in> FSM.transitions M1
q \<in> reachable_states M1
converge M1 (V q @ [(x, y)]) (V q')
\<lbrakk>(q, x, y, q') \<in> FSM.transitions M1; q \<in> reachable_states M1\<rbrakk> \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M2 (V q @ [(x, y)]) (V q')

goal (1 subgoal):
 1. (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m); ?q \<in> reachable_states M1; FSM.h_obs M1 ?q ?x ?y = Some ?q'\<rbrakk> \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V ?q) \<and> converge M2 \<alpha> (V ?q) \<and> converge M1 \<beta> (V ?q') \<and> converge M2 \<beta> (V ?q') \<and> \<alpha> @ [(?x, ?y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M1 (V ?q @ [(?x, ?y)]) (V ?q') \<and> converge M2 (V ?q @ [(?x, ?y)]) (V ?q')

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
(* properties of T3 w.r.t. undefined io pairs *)
[PROOF STATE]
proof (state)
this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m); ?q \<in> reachable_states M1; FSM.h_obs M1 ?q ?x ?y = Some ?q'\<rbrakk> \<Longrightarrow> (\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V ?q) \<and> converge M2 \<alpha> (V ?q) \<and> converge M1 \<beta> (V ?q') \<and> converge M2 \<beta> (V ?q') \<and> \<alpha> @ [(?x, ?y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M1 (V ?q @ [(?x, ?y)]) (V ?q') \<and> converge M2 (V ?q @ [(?x, ?y)]) (V ?q')

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have rstates_io_set : "list.set rstates_io = {(q,(x,y)) . q \<in> reachable_states M1 \<and> x \<in> inputs M1 \<and> y \<in> outputs M1}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list.set rstates_io = {(q, x, y). q \<in> reachable_states M1 \<and> x \<in> FSM.inputs M1 \<and> y \<in> FSM.outputs M1}
[PROOF STEP]
unfolding rstates_io rstates
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list.set (List.product (reachable_states_as_list M1) (List.product (inputs_as_list M1) (outputs_as_list M1))) = {(q, x, y). q \<in> reachable_states M1 \<and> x \<in> FSM.inputs M1 \<and> y \<in> FSM.outputs M1}
[PROOF STEP]
using reachable_states_as_list_set[of M1] inputs_as_list_set[of M1] outputs_as_list_set[of M1]
[PROOF STATE]
proof (prove)
using this:
list.set (reachable_states_as_list M1) = reachable_states M1
list.set (inputs_as_list M1) = FSM.inputs M1
list.set (outputs_as_list M1) = FSM.outputs M1

goal (1 subgoal):
 1. list.set (List.product (reachable_states_as_list M1) (List.product (inputs_as_list M1) (outputs_as_list M1))) = {(q, x, y). q \<in> reachable_states M1 \<and> x \<in> FSM.inputs M1 \<and> y \<in> FSM.outputs M1}
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
list.set rstates_io = {(q, x, y). q \<in> reachable_states M1 \<and> x \<in> FSM.inputs M1 \<and> y \<in> FSM.outputs M1}

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
list.set rstates_io = {(q, x, y). q \<in> reachable_states M1 \<and> x \<in> FSM.inputs M1 \<and> y \<in> FSM.outputs M1}
[PROOF STEP]
have undefined_io_pairs_set : "list.set undefined_io_pairs = {(q,(x,y)) . q \<in> reachable_states M1 \<and> x \<in> inputs M1 \<and> y \<in> outputs M1 \<and> h_obs M1 q x y = None}"
[PROOF STATE]
proof (prove)
using this:
list.set rstates_io = {(q, x, y). q \<in> reachable_states M1 \<and> x \<in> FSM.inputs M1 \<and> y \<in> FSM.outputs M1}

goal (1 subgoal):
 1. list.set undefined_io_pairs = {(q, x, y). q \<in> reachable_states M1 \<and> x \<in> FSM.inputs M1 \<and> y \<in> FSM.outputs M1 \<and> FSM.h_obs M1 q x y = None}
[PROOF STEP]
unfolding undefined_io_pairs
[PROOF STATE]
proof (prove)
using this:
list.set rstates_io = {(q, x, y). q \<in> reachable_states M1 \<and> x \<in> FSM.inputs M1 \<and> y \<in> FSM.outputs M1}

goal (1 subgoal):
 1. list.set (filter (\<lambda>(q, x, y). FSM.h_obs M1 q x y = None) rstates_io) = {(q, x, y). q \<in> reachable_states M1 \<and> x \<in> FSM.inputs M1 \<and> y \<in> FSM.outputs M1 \<and> FSM.h_obs M1 q x y = None}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
list.set undefined_io_pairs = {(q, x, y). q \<in> reachable_states M1 \<and> x \<in> FSM.inputs M1 \<and> y \<in> FSM.outputs M1 \<and> FSM.h_obs M1 q x y = None}

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have verify_undefined_io_pair_prop : "((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS)) \<Longrightarrow> (\<And> q x y T . L M1 \<inter> set (verify_undefined_io_pair T (q,(x,y))) = L M2 \<inter> set (verify_undefined_io_pair T (q,(x,y))) \<Longrightarrow>
                                                    q \<in> reachable_states M1 \<Longrightarrow> x \<in> inputs M1 \<Longrightarrow> y \<in> outputs M1 \<Longrightarrow>
                                                    V ` reachable_states M1 \<subseteq> set T \<Longrightarrow>
                                                    \<exists> \<alpha>. converge M1 \<alpha> (V q) \<and>
                                                         converge M2 \<alpha> (V q) \<and>
                                                         \<alpha> \<in> set (verify_undefined_io_pair T (q,(x,y))) \<and>
                                                         \<alpha>@[(x,y)] \<in> set (verify_undefined_io_pair T (q,(x,y))))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y T. \<lbrakk>L M1 \<inter> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)) = L M2 \<inter> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)); q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y T. \<lbrakk>L M1 \<inter> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)) = L M2 \<inter> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)); q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)))
[PROOF STEP]
fix q x y T
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y T. \<lbrakk>L M1 \<inter> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)) = L M2 \<inter> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)); q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)))
[PROOF STEP]
assume "L M1 \<inter> set (verify_undefined_io_pair T (q,(x,y))) = L M2 \<inter> set (verify_undefined_io_pair T (q,(x,y)))"
       and "q \<in> reachable_states M1" and "x \<in> inputs M1" and "y \<in> outputs M1"
       and "V ` reachable_states M1 \<subseteq> set T"
       and "((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS))"
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)) = L M2 \<inter> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y))
q \<in> reachable_states M1
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y T. \<lbrakk>L M1 \<inter> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)) = L M2 \<inter> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)); q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)))
[PROOF STEP]
have " L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1
[PROOF STEP]
using T3_state_cover \<open>((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS)) \<Longrightarrow> L M1 \<inter> Prefix_Tree.set T3 = L M2 \<inter> Prefix_Tree.set T3\<close> \<open>((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS))\<close>
[PROOF STATE]
proof (prove)
using this:
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T3
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 \<inter> Prefix_Tree.set T3 = L M2 \<inter> Prefix_Tree.set T3
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)

goal (1 subgoal):
 1. L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y T. \<lbrakk>L M1 \<inter> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)) = L M2 \<inter> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)); q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)))
[PROOF STEP]
have "L M1 \<inter> set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y)) = L M2 \<inter> set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y)) = L M2 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y))
[PROOF STEP]
using \<open>L M1 \<inter> set (verify_undefined_io_pair T (q,(x,y))) = L M2 \<inter> set (verify_undefined_io_pair T (q,(x,y)))\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)) = L M2 \<inter> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y)) = L M2 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y))
[PROOF STEP]
unfolding verify_undefined_io_pair case_prod_conv combine_set G2
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T (snd TG2) cg_insert cg_lookup q x y)) = L M2 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T (snd TG2) cg_insert cg_lookup q x y))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T (snd TG2) cg_insert cg_lookup q x y)) = L M2 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T (snd TG2) cg_insert cg_lookup q x y))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y)) = L M2 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y T. \<lbrakk>L M1 \<inter> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)) = L M2 \<inter> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)); q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)))
[PROOF STEP]
have "(\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and>
          converge M2 \<alpha> (V q) \<and>
          \<alpha> \<in> set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y)) \<and>
          \<alpha> @ [(x, y)] \<in> set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y))
[PROOF STEP]
using assms(16)
[PROOF STATE]
proof (prove)
using this:
verifies_io_pair append_io_pair M1 M2 cg_insert cg_lookup

goal (1 subgoal):
 1. \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y))
[PROOF STEP]
unfolding verifies_io_pair_def
[PROOF STATE]
proof (prove)
using this:
\<forall>V T G q x y. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1 \<longrightarrow> q \<in> reachable_states M1 \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) = L M2 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<longrightarrow> (\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y))) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (append_io_pair M1 V T G cg_insert cg_lookup q x y)))

goal (1 subgoal):
 1. \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y))
[PROOF STEP]
using assms(1-4,7,8) \<open>is_state_cover_assignment M1 V\<close> \<open>L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1\<close>
            \<open>q \<in> reachable_states M1\<close> \<open>x \<in> inputs M1\<close> \<open>y \<in> outputs M1\<close>
            G2_invar[OF \<open>((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS))\<close>] \<open>convergence_graph_insert_invar M1 M2 cg_lookup cg_insert\<close>
            \<open>L M1 \<inter> set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y)) = L M2 \<inter> set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y))\<close>
[PROOF STATE]
proof (prove)
using this:
\<forall>V T G q x y. Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<and> (finite_tree T \<longrightarrow> finite_tree (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y))) \<and> (observable M1 \<longrightarrow> observable M2 \<longrightarrow> minimal M1 \<longrightarrow> minimal M2 \<longrightarrow> FSM.inputs M2 = FSM.inputs M1 \<longrightarrow> FSM.outputs M2 = FSM.outputs M1 \<longrightarrow> is_state_cover_assignment M1 V \<longrightarrow> L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1 \<longrightarrow> q \<in> reachable_states M1 \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup G \<longrightarrow> convergence_graph_insert_invar M1 M2 cg_lookup cg_insert \<longrightarrow> L M1 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) = L M2 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<longrightarrow> (\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G cg_insert cg_lookup q x y))) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (append_io_pair M1 V T G cg_insert cg_lookup q x y)))
observable M1
observable M2
minimal M1
minimal M2
FSM.inputs M2 = FSM.inputs M1
FSM.outputs M2 = FSM.outputs M1
is_state_cover_assignment M1 V
L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1
q \<in> reachable_states M1
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1
convergence_graph_lookup_invar M1 M2 cg_lookup G2
convergence_graph_insert_invar M1 M2 cg_lookup cg_insert
L M1 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y)) = L M2 \<inter> Prefix_Tree.set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y))

goal (1 subgoal):
 1. \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y T. \<lbrakk>L M1 \<inter> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)) = L M2 \<inter> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)); q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y))
[PROOF STEP]
show "\<exists> \<alpha>. converge M1 \<alpha> (V q) \<and>
               converge M2 \<alpha> (V q) \<and>
               \<alpha> \<in> set (verify_undefined_io_pair T (q,(x,y))) \<and>
               \<alpha>@[(x,y)] \<in> set (verify_undefined_io_pair T (q,(x,y)))"
[PROOF STATE]
proof (prove)
using this:
\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (fst (append_io_pair M1 V T G2 cg_insert cg_lookup q x y))

goal (1 subgoal):
 1. \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y))
[PROOF STEP]
unfolding verify_undefined_io_pair G2 case_prod_conv combine_set
[PROOF STATE]
proof (prove)
using this:
\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (fst (append_io_pair M1 V T (snd TG2) cg_insert cg_lookup q x y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (fst (append_io_pair M1 V T (snd TG2) cg_insert cg_lookup q x y))

goal (1 subgoal):
 1. \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (fst (append_io_pair M1 V T (snd TG2) cg_insert cg_lookup q x y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (fst (append_io_pair M1 V T (snd TG2) cg_insert cg_lookup q x y))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (verify_undefined_io_pair T (q, x, y))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m); L M1 \<inter> Prefix_Tree.set (verify_undefined_io_pair ?T (?q, ?x, ?y)) = L M2 \<inter> Prefix_Tree.set (verify_undefined_io_pair ?T (?q, ?x, ?y)); ?q \<in> reachable_states M1; ?x \<in> FSM.inputs M1; ?y \<in> FSM.outputs M1; V ` reachable_states M1 \<subseteq> Prefix_Tree.set ?T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V ?q) \<and> converge M2 \<alpha> (V ?q) \<and> \<alpha> \<in> Prefix_Tree.set (verify_undefined_io_pair ?T (?q, ?x, ?y)) \<and> \<alpha> @ [(?x, ?y)] \<in> Prefix_Tree.set (verify_undefined_io_pair ?T (?q, ?x, ?y))

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have T3_covers_undefined_io_pairs : "((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS)) \<Longrightarrow> (\<And> q x y . q \<in> reachable_states M1 \<Longrightarrow> x \<in> inputs M1 \<Longrightarrow> y \<in> outputs M1 \<Longrightarrow> h_obs M1 q x y = None \<Longrightarrow>
          (\<exists> \<alpha> .
               converge M1 \<alpha> (V q) \<and>
               converge M2 \<alpha> (V q) \<and>
               \<alpha> \<in> set T3\<and>
               \<alpha>@[(x,y)] \<in> set T3))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; FSM.h_obs M1 q x y = None\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; FSM.h_obs M1 q x y = None\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3)
[PROOF STEP]
fix q x y
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; FSM.h_obs M1 q x y = None\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3)
[PROOF STEP]
assume "q \<in> reachable_states M1" and "x \<in> inputs M1" and "y \<in> outputs M1" and "h_obs M1 q x y = None" and "((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS))"
[PROOF STATE]
proof (state)
this:
q \<in> reachable_states M1
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1
FSM.h_obs M1 q x y = None
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; FSM.h_obs M1 q x y = None\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3)
[PROOF STEP]
have "\<And> q x y qxys T . L M1 \<inter> set (foldl verify_undefined_io_pair T qxys) = L M2 \<inter> set (foldl verify_undefined_io_pair T qxys) \<Longrightarrow> (V ` reachable_states M1) \<subseteq> set T \<Longrightarrow> (q,(x,y)) \<in> list.set qxys \<Longrightarrow> list.set qxys \<subseteq> list.set undefined_io_pairs \<Longrightarrow>
              (\<exists> \<alpha> .
               converge M1 \<alpha> (V q) \<and>
               converge M2 \<alpha> (V q) \<and>
               \<alpha> \<in> set (foldl verify_undefined_io_pair T qxys)\<and>
               \<alpha>@[(x,y)] \<in> set (foldl verify_undefined_io_pair T qxys))"
      (is "\<And> q x y qxys T . ?P1 qxys T \<Longrightarrow> (V ` reachable_states M1) \<subseteq> set T \<Longrightarrow> (q,(x,y)) \<in> list.set qxys \<Longrightarrow> list.set qxys \<subseteq> list.set undefined_io_pairs \<Longrightarrow> ?P2 q x y qxys T")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q x y qxys T. \<lbrakk>L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; (q, x, y) \<in> list.set qxys; list.set qxys \<subseteq> list.set undefined_io_pairs\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>q x y qxys T. \<lbrakk>L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; (q, x, y) \<in> list.set qxys; list.set qxys \<subseteq> list.set undefined_io_pairs\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)
[PROOF STEP]
fix q x y qxys T
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>q x y qxys T. \<lbrakk>L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; (q, x, y) \<in> list.set qxys; list.set qxys \<subseteq> list.set undefined_io_pairs\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)
[PROOF STEP]
assume "?P1 qxys T" and "(q,(x,y)) \<in> list.set qxys" and "list.set qxys \<subseteq> list.set undefined_io_pairs" and "(V ` reachable_states M1) \<subseteq> set T"
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)
(q, x, y) \<in> list.set qxys
list.set qxys \<subseteq> list.set undefined_io_pairs
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T

goal (1 subgoal):
 1. \<And>q x y qxys T. \<lbrakk>L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys); V ` reachable_states M1 \<subseteq> Prefix_Tree.set T; (q, x, y) \<in> list.set qxys; list.set qxys \<subseteq> list.set undefined_io_pairs\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)
(q, x, y) \<in> list.set qxys
list.set qxys \<subseteq> list.set undefined_io_pairs
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T
[PROOF STEP]
show "?P2 q x y qxys T"
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)
(q, x, y) \<in> list.set qxys
list.set qxys \<subseteq> list.set undefined_io_pairs
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T

goal (1 subgoal):
 1. \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)
[PROOF STEP]
proof (induction qxys rule: rev_induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T []) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T []); (q, x, y) \<in> list.set []; list.set [] \<subseteq> list.set undefined_io_pairs; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T []) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T [])
 2. \<And>x xs. \<lbrakk>\<lbrakk>L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T xs) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T xs); (q, x, y) \<in> list.set xs; list.set xs \<subseteq> list.set undefined_io_pairs; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T xs) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T xs); L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])); (q, x, y) \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set undefined_io_pairs; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x]))
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T []) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T [])
(q, x, y) \<in> list.set []
list.set [] \<subseteq> list.set undefined_io_pairs
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T

goal (2 subgoals):
 1. \<lbrakk>L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T []) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T []); (q, x, y) \<in> list.set []; list.set [] \<subseteq> list.set undefined_io_pairs; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T []) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T [])
 2. \<And>x xs. \<lbrakk>\<lbrakk>L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T xs) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T xs); (q, x, y) \<in> list.set xs; list.set xs \<subseteq> list.set undefined_io_pairs; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T xs) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T xs); L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])); (q, x, y) \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set undefined_io_pairs; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x]))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T []) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T [])
(q, x, y) \<in> list.set []
list.set [] \<subseteq> list.set undefined_io_pairs
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T []) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T [])
(q, x, y) \<in> list.set []
list.set [] \<subseteq> list.set undefined_io_pairs
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T

goal (1 subgoal):
 1. \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T []) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T [])
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T []) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T [])

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T xs) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T xs); (q, x, y) \<in> list.set xs; list.set xs \<subseteq> list.set undefined_io_pairs; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T xs) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T xs); L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])); (q, x, y) \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set undefined_io_pairs; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x]))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T xs) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T xs); (q, x, y) \<in> list.set xs; list.set xs \<subseteq> list.set undefined_io_pairs; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T xs) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T xs); L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])); (q, x, y) \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set undefined_io_pairs; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x]))
[PROOF STEP]
case (snoc a qxys)
[PROOF STATE]
proof (state)
this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys); (q, x, y) \<in> list.set qxys; list.set qxys \<subseteq> list.set undefined_io_pairs; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)
L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
(q, x, y) \<in> list.set (qxys @ [a])
list.set (qxys @ [a]) \<subseteq> list.set undefined_io_pairs
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T xs) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T xs); (q, x, y) \<in> list.set xs; list.set xs \<subseteq> list.set undefined_io_pairs; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T xs) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T xs); L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])); (q, x, y) \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set undefined_io_pairs; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x]))
[PROOF STEP]
have "set (foldl verify_undefined_io_pair T qxys) \<subseteq> set (foldl verify_undefined_io_pair T (qxys@[a]))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
[PROOF STEP]
using verify_undefined_io_pair_retains_testsuite
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (verify_undefined_io_pair ?T ?qxy)

goal (1 subgoal):
 1. Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T xs) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T xs); (q, x, y) \<in> list.set xs; list.set xs \<subseteq> list.set undefined_io_pairs; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T xs) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T xs); L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])); (q, x, y) \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set undefined_io_pairs; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x]))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
[PROOF STEP]
have *:"L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)"
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)
[PROOF STEP]
using snoc.prems(1)
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T xs) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T xs); (q, x, y) \<in> list.set xs; list.set xs \<subseteq> list.set undefined_io_pairs; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T xs) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T xs); L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])); (q, x, y) \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set undefined_io_pairs; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x]))
[PROOF STEP]
have **: "V ` reachable_states M1 \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V ` reachable_states M1 \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)
[PROOF STEP]
using snoc.prems(4) verify_undefined_io_pair_folding_retains_testsuite
[PROOF STATE]
proof (prove)
using this:
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair ?T ?qxys)

goal (1 subgoal):
 1. V ` reachable_states M1 \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V ` reachable_states M1 \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>\<lbrakk>L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T xs) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T xs); (q, x, y) \<in> list.set xs; list.set xs \<subseteq> list.set undefined_io_pairs; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T xs) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T xs); L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])); (q, x, y) \<in> list.set (xs @ [x]); list.set (xs @ [x]) \<subseteq> list.set undefined_io_pairs; V ` reachable_states M1 \<subseteq> Prefix_Tree.set T\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (xs @ [x]))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
[PROOF STEP]
proof (cases "a = (q,(x,y))")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. a = (q, x, y) \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
 2. a \<noteq> (q, x, y) \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
a = (q, x, y)

goal (2 subgoals):
 1. a = (q, x, y) \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
 2. a \<noteq> (q, x, y) \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
a = (q, x, y)
[PROOF STEP]
have ***: "q \<in> reachable_states M1"
[PROOF STATE]
proof (prove)
using this:
a = (q, x, y)

goal (1 subgoal):
 1. q \<in> reachable_states M1
[PROOF STEP]
using snoc.prems(3)
[PROOF STATE]
proof (prove)
using this:
a = (q, x, y)
list.set (qxys @ [a]) \<subseteq> list.set undefined_io_pairs

goal (1 subgoal):
 1. q \<in> reachable_states M1
[PROOF STEP]
unfolding undefined_io_pairs_set
[PROOF STATE]
proof (prove)
using this:
a = (q, x, y)
list.set (qxys @ [a]) \<subseteq> {(q, x, y). q \<in> reachable_states M1 \<and> x \<in> FSM.inputs M1 \<and> y \<in> FSM.outputs M1 \<and> FSM.h_obs M1 q x y = None}

goal (1 subgoal):
 1. q \<in> reachable_states M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
q \<in> reachable_states M1

goal (2 subgoals):
 1. a = (q, x, y) \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
 2. a \<noteq> (q, x, y) \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
[PROOF STEP]
have "x \<in> inputs M1" and "y \<in> outputs M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<in> FSM.inputs M1 &&& y \<in> FSM.outputs M1
[PROOF STEP]
using snoc.prems(2,3)
[PROOF STATE]
proof (prove)
using this:
(q, x, y) \<in> list.set (qxys @ [a])
list.set (qxys @ [a]) \<subseteq> list.set undefined_io_pairs

goal (1 subgoal):
 1. x \<in> FSM.inputs M1 &&& y \<in> FSM.outputs M1
[PROOF STEP]
unfolding undefined_io_pairs_set
[PROOF STATE]
proof (prove)
using this:
(q, x, y) \<in> list.set (qxys @ [a])
list.set (qxys @ [a]) \<subseteq> {(q, x, y). q \<in> reachable_states M1 \<and> x \<in> FSM.inputs M1 \<and> y \<in> FSM.outputs M1 \<and> FSM.h_obs M1 q x y = None}

goal (1 subgoal):
 1. x \<in> FSM.inputs M1 &&& y \<in> FSM.outputs M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1

goal (2 subgoals):
 1. a = (q, x, y) \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
 2. a \<noteq> (q, x, y) \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
[PROOF STEP]
have ****: "L M1 \<inter> set (verify_undefined_io_pair (foldl verify_undefined_io_pair T qxys) (q,(x,y))) = L M2 \<inter> set (verify_undefined_io_pair (foldl verify_undefined_io_pair T qxys) (q,(x,y)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (verify_undefined_io_pair (foldl verify_undefined_io_pair T qxys) (q, x, y)) = L M2 \<inter> Prefix_Tree.set (verify_undefined_io_pair (foldl verify_undefined_io_pair T qxys) (q, x, y))
[PROOF STEP]
using snoc.prems(1)
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (verify_undefined_io_pair (foldl verify_undefined_io_pair T qxys) (q, x, y)) = L M2 \<inter> Prefix_Tree.set (verify_undefined_io_pair (foldl verify_undefined_io_pair T qxys) (q, x, y))
[PROOF STEP]
unfolding True
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [(q, x, y)])) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [(q, x, y)]))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (verify_undefined_io_pair (foldl verify_undefined_io_pair T qxys) (q, x, y)) = L M2 \<inter> Prefix_Tree.set (verify_undefined_io_pair (foldl verify_undefined_io_pair T qxys) (q, x, y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (verify_undefined_io_pair (foldl verify_undefined_io_pair T qxys) (q, x, y)) = L M2 \<inter> Prefix_Tree.set (verify_undefined_io_pair (foldl verify_undefined_io_pair T qxys) (q, x, y))

goal (2 subgoals):
 1. a = (q, x, y) \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
 2. a \<noteq> (q, x, y) \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
[PROOF STEP]
using verify_undefined_io_pair_prop[OF \<open>((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS))\<close> **** *** \<open>x \<in> inputs M1\<close> \<open>y \<in> outputs M1\<close> **]
[PROOF STATE]
proof (prove)
using this:
\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (verify_undefined_io_pair (foldl verify_undefined_io_pair T qxys) (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (verify_undefined_io_pair (foldl verify_undefined_io_pair T qxys) (q, x, y))

goal (1 subgoal):
 1. \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
[PROOF STEP]
unfolding True
[PROOF STATE]
proof (prove)
using this:
\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (verify_undefined_io_pair (foldl verify_undefined_io_pair T qxys) (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (verify_undefined_io_pair (foldl verify_undefined_io_pair T qxys) (q, x, y))

goal (1 subgoal):
 1. \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [(q, x, y)])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [(q, x, y)]))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))

goal (1 subgoal):
 1. a \<noteq> (q, x, y) \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. a \<noteq> (q, x, y) \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
a \<noteq> (q, x, y)

goal (1 subgoal):
 1. a \<noteq> (q, x, y) \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
a \<noteq> (q, x, y)
[PROOF STEP]
have "(q, x, y) \<in> list.set qxys" and "list.set qxys \<subseteq> list.set undefined_io_pairs"
[PROOF STATE]
proof (prove)
using this:
a \<noteq> (q, x, y)

goal (1 subgoal):
 1. (q, x, y) \<in> list.set qxys &&& list.set qxys \<subseteq> list.set undefined_io_pairs
[PROOF STEP]
using snoc.prems(2,3)
[PROOF STATE]
proof (prove)
using this:
a \<noteq> (q, x, y)
(q, x, y) \<in> list.set (qxys @ [a])
list.set (qxys @ [a]) \<subseteq> list.set undefined_io_pairs

goal (1 subgoal):
 1. (q, x, y) \<in> list.set qxys &&& list.set qxys \<subseteq> list.set undefined_io_pairs
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(q, x, y) \<in> list.set qxys
list.set qxys \<subseteq> list.set undefined_io_pairs

goal (1 subgoal):
 1. a \<noteq> (q, x, y) \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(q, x, y) \<in> list.set qxys
list.set qxys \<subseteq> list.set undefined_io_pairs
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(q, x, y) \<in> list.set qxys
list.set qxys \<subseteq> list.set undefined_io_pairs

goal (1 subgoal):
 1. \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
[PROOF STEP]
using snoc.IH[OF * _ _  snoc.prems(4)]
[PROOF STATE]
proof (prove)
using this:
(q, x, y) \<in> list.set qxys
list.set qxys \<subseteq> list.set undefined_io_pairs
\<lbrakk>(q, x, y) \<in> list.set qxys; list.set qxys \<subseteq> list.set undefined_io_pairs\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)

goal (1 subgoal):
 1. \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
[PROOF STEP]
using \<open>set (foldl verify_undefined_io_pair T qxys) \<subseteq> set (foldl verify_undefined_io_pair T (qxys@[a]))\<close>
[PROOF STATE]
proof (prove)
using this:
(q, x, y) \<in> list.set qxys
list.set qxys \<subseteq> list.set undefined_io_pairs
\<lbrakk>(q, x, y) \<in> list.set qxys; list.set qxys \<subseteq> list.set undefined_io_pairs\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)
Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) \<subseteq> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))

goal (1 subgoal):
 1. \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a])) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T (qxys @ [a]))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair T qxys)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair ?T ?qxys) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair ?T ?qxys); V ` reachable_states M1 \<subseteq> Prefix_Tree.set ?T; (?q, ?x, ?y) \<in> list.set ?qxys; list.set ?qxys \<subseteq> list.set undefined_io_pairs\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V ?q) \<and> converge M2 \<alpha> (V ?q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair ?T ?qxys) \<and> \<alpha> @ [(?x, ?y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair ?T ?qxys)

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; FSM.h_obs M1 q x y = None\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair ?T ?qxys) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair ?T ?qxys); V ` reachable_states M1 \<subseteq> Prefix_Tree.set ?T; (?q, ?x, ?y) \<in> list.set ?qxys; list.set ?qxys \<subseteq> list.set undefined_io_pairs\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V ?q) \<and> converge M2 \<alpha> (V ?q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair ?T ?qxys) \<and> \<alpha> @ [(?x, ?y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair ?T ?qxys)

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; FSM.h_obs M1 q x y = None\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3)
[PROOF STEP]
have "L M1 \<inter> set (foldl verify_undefined_io_pair T2 undefined_io_pairs) = L M2 \<inter> set (foldl verify_undefined_io_pair T2 undefined_io_pairs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T2 undefined_io_pairs) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T2 undefined_io_pairs)
[PROOF STEP]
using \<open>((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS)) \<Longrightarrow> L M1 \<inter> set T3 = L M2 \<inter> set T3\<close>  \<open>((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS))\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 \<inter> Prefix_Tree.set T3 = L M2 \<inter> Prefix_Tree.set T3
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T2 undefined_io_pairs) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T2 undefined_io_pairs)
[PROOF STEP]
unfolding T3 T2
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) undefined_io_pairs) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) undefined_io_pairs)
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) undefined_io_pairs) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) undefined_io_pairs)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T2 undefined_io_pairs) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T2 undefined_io_pairs)

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; FSM.h_obs M1 q x y = None\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T2 undefined_io_pairs) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T2 undefined_io_pairs)

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; FSM.h_obs M1 q x y = None\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3)
[PROOF STEP]
have "(V ` reachable_states M1) \<subseteq> set T2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V ` reachable_states M1 \<subseteq> Prefix_Tree.set T2
[PROOF STEP]
using T1_state_cover T2 T2_invar_1 passes_T2
[PROOF STATE]
proof (prove)
using this:
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T1
T2 = fst TG2
Prefix_Tree.set T1 \<subseteq> Prefix_Tree.set T2
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 \<inter> Prefix_Tree.set T2 = L M2 \<inter> Prefix_Tree.set T2

goal (1 subgoal):
 1. V ` reachable_states M1 \<subseteq> Prefix_Tree.set T2
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T2

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; FSM.h_obs M1 q x y = None\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T2

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; FSM.h_obs M1 q x y = None\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3)
[PROOF STEP]
have "(q,(x,y)) \<in> list.set undefined_io_pairs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (q, x, y) \<in> list.set undefined_io_pairs
[PROOF STEP]
unfolding undefined_io_pairs_set
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (q, x, y) \<in> {(q, x, y). q \<in> reachable_states M1 \<and> x \<in> FSM.inputs M1 \<and> y \<in> FSM.outputs M1 \<and> FSM.h_obs M1 q x y = None}
[PROOF STEP]
using \<open>q \<in> reachable_states M1\<close> \<open>x \<in> inputs M1\<close> \<open>y \<in> outputs M1\<close> \<open>h_obs M1 q x y = None\<close>
[PROOF STATE]
proof (prove)
using this:
q \<in> reachable_states M1
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1
FSM.h_obs M1 q x y = None

goal (1 subgoal):
 1. (q, x, y) \<in> {(q, x, y). q \<in> reachable_states M1 \<and> x \<in> FSM.inputs M1 \<and> y \<in> FSM.outputs M1 \<and> FSM.h_obs M1 q x y = None}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(q, x, y) \<in> list.set undefined_io_pairs

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; FSM.h_obs M1 q x y = None\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair ?T ?qxys) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair ?T ?qxys); V ` reachable_states M1 \<subseteq> Prefix_Tree.set ?T; (?q, ?x, ?y) \<in> list.set ?qxys; list.set ?qxys \<subseteq> list.set undefined_io_pairs\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V ?q) \<and> converge M2 \<alpha> (V ?q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair ?T ?qxys) \<and> \<alpha> @ [(?x, ?y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair ?T ?qxys)
L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T2 undefined_io_pairs) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T2 undefined_io_pairs)
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T2
(q, x, y) \<in> list.set undefined_io_pairs
[PROOF STEP]
show "(\<exists> \<alpha> .
               converge M1 \<alpha> (V q) \<and>
               converge M2 \<alpha> (V q) \<and>
               \<alpha> \<in> set T3\<and>
               \<alpha>@[(x,y)] \<in> set T3)"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair ?T ?qxys) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair ?T ?qxys); V ` reachable_states M1 \<subseteq> Prefix_Tree.set ?T; (?q, ?x, ?y) \<in> list.set ?qxys; list.set ?qxys \<subseteq> list.set undefined_io_pairs\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V ?q) \<and> converge M2 \<alpha> (V ?q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair ?T ?qxys) \<and> \<alpha> @ [(?x, ?y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair ?T ?qxys)
L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T2 undefined_io_pairs) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair T2 undefined_io_pairs)
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T2
(q, x, y) \<in> list.set undefined_io_pairs

goal (1 subgoal):
 1. \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3
[PROOF STEP]
unfolding T3 T2
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair ?T ?qxys) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair ?T ?qxys); V ` reachable_states M1 \<subseteq> Prefix_Tree.set ?T; (?q, ?x, ?y) \<in> list.set ?qxys; list.set ?qxys \<subseteq> list.set undefined_io_pairs\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V ?q) \<and> converge M2 \<alpha> (V ?q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair ?T ?qxys) \<and> \<alpha> @ [(?x, ?y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair ?T ?qxys)
L M1 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) undefined_io_pairs) = L M2 \<inter> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) undefined_io_pairs)
V ` reachable_states M1 \<subseteq> Prefix_Tree.set (fst TG2)
(q, x, y) \<in> list.set undefined_io_pairs

goal (1 subgoal):
 1. \<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) undefined_io_pairs) \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set (foldl verify_undefined_io_pair (fst TG2) undefined_io_pairs)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m); ?q \<in> reachable_states M1; ?x \<in> FSM.inputs M1; ?y \<in> FSM.outputs M1; FSM.h_obs M1 ?q ?x ?y = None\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V ?q) \<and> converge M2 \<alpha> (V ?q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(?x, ?y)] \<in> Prefix_Tree.set T3

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
(* obtain the transition cover contained in the test suite
      - this is the set of witnesses for the convergence of all transitions
        and the set of transitions added to cover undefined io
  *)
[PROOF STATE]
proof (state)
this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m); ?q \<in> reachable_states M1; ?x \<in> FSM.inputs M1; ?y \<in> FSM.outputs M1; FSM.h_obs M1 ?q ?x ?y = None\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. converge M1 \<alpha> (V ?q) \<and> converge M2 \<alpha> (V ?q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(?x, ?y)] \<in> Prefix_Tree.set T3

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
define TCfun where TCfun: "TCfun = (\<lambda> (q,(x,y)) . case h_obs M1 q x y of
                                None \<Rightarrow> {{\<alpha>, \<alpha>@[(x,y)]} | \<alpha> . converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> set T3 \<and> \<alpha>@[(x,y)] \<in> set T3} |
                                Some q' \<Rightarrow> {{\<alpha>,\<alpha>@[(x,y)], \<beta>} | \<alpha> \<beta> . converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x,y)] \<in> set T3 \<and> \<beta> \<in> set T3 \<and> converge M1 (V q @ [(x,y)]) (V q') \<and> converge M2 (V q @ [(x,y)]) (V q')})"
[PROOF STATE]
proof (state)
this:
TCfun = (\<lambda>(q, x, y). case FSM.h_obs M1 q x y of None \<Rightarrow> {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3} | Some q' \<Rightarrow> {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')})

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
define TC where TC: "TC = Set.insert [] (\<Union>(\<Union> (TCfun ` (reachable_states M1 \<times> (inputs M1 \<times> outputs M1)))))"
[PROOF STATE]
proof (state)
this:
TC = Set.insert [] (\<Union> (\<Union> (TCfun ` (reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1))))

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
(* establish that this transition cover is sufficient to prove equivalence by showing that it is
    - initialised
    - a proper transition cover
    - convergence preserving
  *)
[PROOF STATE]
proof (state)
this:
TC = Set.insert [] (\<Union> (\<Union> (TCfun ` (reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1))))

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have TCfun_nonempty: "((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS)) \<Longrightarrow> (\<And> q x y . q \<in> reachable_states M1 \<Longrightarrow> x \<in> inputs M1 \<Longrightarrow> y \<in> outputs M1 \<Longrightarrow> TCfun (q,(x,y)) \<noteq> {})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> TCfun (q, x, y) \<noteq> {})
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> TCfun (q, x, y) \<noteq> {})
[PROOF STEP]
fix q x y
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> TCfun (q, x, y) \<noteq> {})
[PROOF STEP]
assume *:"q \<in> reachable_states M1" and **:"x \<in> inputs M1" and ***:"y \<in> outputs M1" and "((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS))"
[PROOF STATE]
proof (state)
this:
q \<in> reachable_states M1
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> (\<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> TCfun (q, x, y) \<noteq> {})
[PROOF STEP]
show "TCfun (q,(x,y)) \<noteq> {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. TCfun (q, x, y) \<noteq> {}
[PROOF STEP]
proof (cases "h_obs M1 q x y")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. FSM.h_obs M1 q x y = None \<Longrightarrow> TCfun (q, x, y) \<noteq> {}
 2. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> TCfun (q, x, y) \<noteq> {}
[PROOF STEP]
case None
[PROOF STATE]
proof (state)
this:
FSM.h_obs M1 q x y = None

goal (2 subgoals):
 1. FSM.h_obs M1 q x y = None \<Longrightarrow> TCfun (q, x, y) \<noteq> {}
 2. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> TCfun (q, x, y) \<noteq> {}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
FSM.h_obs M1 q x y = None
[PROOF STEP]
have "TCfun (q,(x,y)) = {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> set T3 \<and> \<alpha> @ [(x, y)] \<in> set T3}"
[PROOF STATE]
proof (prove)
using this:
FSM.h_obs M1 q x y = None

goal (1 subgoal):
 1. TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3}
[PROOF STEP]
unfolding TCfun
[PROOF STATE]
proof (prove)
using this:
FSM.h_obs M1 q x y = None

goal (1 subgoal):
 1. (case (q, x, y) of (q, xa, y) \<Rightarrow> case FSM.h_obs M1 q xa y of None \<Rightarrow> {{\<alpha>, \<alpha> @ [(xa, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(xa, y)] \<in> Prefix_Tree.set T3} | Some q' \<Rightarrow> {{\<alpha>, \<alpha> @ [(xa, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(xa, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(xa, y)]) (V q') \<and> converge M2 (V q @ [(xa, y)]) (V q')}) = {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3}

goal (2 subgoals):
 1. FSM.h_obs M1 q x y = None \<Longrightarrow> TCfun (q, x, y) \<noteq> {}
 2. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> TCfun (q, x, y) \<noteq> {}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3}

goal (2 subgoals):
 1. FSM.h_obs M1 q x y = None \<Longrightarrow> TCfun (q, x, y) \<noteq> {}
 2. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> TCfun (q, x, y) \<noteq> {}
[PROOF STEP]
have "{{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> set T3 \<and> \<alpha> @ [(x, y)] \<in> set T3} \<noteq> {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3} \<noteq> {}
[PROOF STEP]
using T3_covers_undefined_io_pairs[OF \<open>((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS))\<close> * ** *** None]
[PROOF STATE]
proof (prove)
using this:
\<exists>\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3

goal (1 subgoal):
 1. {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3} \<noteq> {}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
{{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3} \<noteq> {}

goal (2 subgoals):
 1. FSM.h_obs M1 q x y = None \<Longrightarrow> TCfun (q, x, y) \<noteq> {}
 2. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> TCfun (q, x, y) \<noteq> {}
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3}
{{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3} \<noteq> {}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3}
{{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3} \<noteq> {}

goal (1 subgoal):
 1. TCfun (q, x, y) \<noteq> {}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
TCfun (q, x, y) \<noteq> {}

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> TCfun (q, x, y) \<noteq> {}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> TCfun (q, x, y) \<noteq> {}
[PROOF STEP]
case (Some q')
[PROOF STATE]
proof (state)
this:
FSM.h_obs M1 q x y = Some q'

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> TCfun (q, x, y) \<noteq> {}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
FSM.h_obs M1 q x y = Some q'
[PROOF STEP]
have "TCfun (q,(x,y)) = {{\<alpha>,\<alpha>@[(x,y)], \<beta>} | \<alpha> \<beta> . converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x,y)] \<in> set T3 \<and> \<beta> \<in> set T3 \<and> converge M1 (V q @ [(x,y)]) (V q') \<and> converge M2 (V q @ [(x,y)]) (V q')}"
[PROOF STATE]
proof (prove)
using this:
FSM.h_obs M1 q x y = Some q'

goal (1 subgoal):
 1. TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')}
[PROOF STEP]
using TCfun
[PROOF STATE]
proof (prove)
using this:
FSM.h_obs M1 q x y = Some q'
TCfun = (\<lambda>(q, x, y). case FSM.h_obs M1 q x y of None \<Rightarrow> {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3} | Some q' \<Rightarrow> {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')})

goal (1 subgoal):
 1. TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')}

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> TCfun (q, x, y) \<noteq> {}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')}

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> TCfun (q, x, y) \<noteq> {}
[PROOF STEP]
have "{{\<alpha>,\<alpha>@[(x,y)], \<beta>} | \<alpha> \<beta> . converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x,y)] \<in> set T3 \<and> \<beta> \<in> set T3 \<and> converge M1 (V q @ [(x,y)]) (V q') \<and> converge M2 (V q @ [(x,y)]) (V q')} \<noteq> {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')} \<noteq> {}
[PROOF STEP]
using T3_covers_defined_io_pairs[OF \<open>((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS))\<close> * Some]
[PROOF STATE]
proof (prove)
using this:
(\<exists>\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3) \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')

goal (1 subgoal):
 1. {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')} \<noteq> {}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
{{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')} \<noteq> {}

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> TCfun (q, x, y) \<noteq> {}
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')}
{{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')} \<noteq> {}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')}
{{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')} \<noteq> {}

goal (1 subgoal):
 1. TCfun (q, x, y) \<noteq> {}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
TCfun (q, x, y) \<noteq> {}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
TCfun (q, x, y) \<noteq> {}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m); ?q \<in> reachable_states M1; ?x \<in> FSM.inputs M1; ?y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> TCfun (?q, ?x, ?y) \<noteq> {}

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have TC_in_T3: "TC \<subseteq> set T3"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. TC \<subseteq> Prefix_Tree.set T3
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. x \<in> TC \<Longrightarrow> x \<in> Prefix_Tree.set T3
[PROOF STEP]
fix \<alpha>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. x \<in> TC \<Longrightarrow> x \<in> Prefix_Tree.set T3
[PROOF STEP]
assume "\<alpha> \<in> TC"
[PROOF STATE]
proof (state)
this:
\<alpha> \<in> TC

goal (1 subgoal):
 1. \<And>x. x \<in> TC \<Longrightarrow> x \<in> Prefix_Tree.set T3
[PROOF STEP]
show "\<alpha> \<in> set T3"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<alpha> \<in> Prefix_Tree.set T3
[PROOF STEP]
proof (cases "\<alpha> = []")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<alpha> = [] \<Longrightarrow> \<alpha> \<in> Prefix_Tree.set T3
 2. \<alpha> \<noteq> [] \<Longrightarrow> \<alpha> \<in> Prefix_Tree.set T3
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
\<alpha> = []

goal (2 subgoals):
 1. \<alpha> = [] \<Longrightarrow> \<alpha> \<in> Prefix_Tree.set T3
 2. \<alpha> \<noteq> [] \<Longrightarrow> \<alpha> \<in> Prefix_Tree.set T3
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<alpha> = []
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<alpha> = []

goal (1 subgoal):
 1. \<alpha> \<in> Prefix_Tree.set T3
[PROOF STEP]
using T3_state_cover \<open>is_state_cover_assignment M1 V\<close> reachable_states_initial[of M1]
[PROOF STATE]
proof (prove)
using this:
\<alpha> = []
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T3
is_state_cover_assignment M1 V
FSM.initial M1 \<in> reachable_states M1

goal (1 subgoal):
 1. \<alpha> \<in> Prefix_Tree.set T3
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<alpha> \<in> Prefix_Tree.set T3

goal (1 subgoal):
 1. \<alpha> \<noteq> [] \<Longrightarrow> \<alpha> \<in> Prefix_Tree.set T3
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<alpha> \<noteq> [] \<Longrightarrow> \<alpha> \<in> Prefix_Tree.set T3
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<alpha> \<noteq> []

goal (1 subgoal):
 1. \<alpha> \<noteq> [] \<Longrightarrow> \<alpha> \<in> Prefix_Tree.set T3
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<alpha> \<noteq> []
[PROOF STEP]
obtain q x y where "q \<in> reachable_states M1"
                        and "x \<in> inputs M1"
                        and "y \<in> outputs M1"
                        and "\<alpha> \<in> \<Union> (TCfun (q,(x,y)))"
[PROOF STATE]
proof (prove)
using this:
\<alpha> \<noteq> []

goal (1 subgoal):
 1. (\<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; \<alpha> \<in> \<Union> (TCfun (q, x, y))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<open>\<alpha> \<in> TC\<close>
[PROOF STATE]
proof (prove)
using this:
\<alpha> \<noteq> []
\<alpha> \<in> TC

goal (1 subgoal):
 1. (\<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; \<alpha> \<in> \<Union> (TCfun (q, x, y))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding TC
[PROOF STATE]
proof (prove)
using this:
\<alpha> \<noteq> []
\<alpha> \<in> Set.insert [] (\<Union> (\<Union> (TCfun ` (reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1))))

goal (1 subgoal):
 1. (\<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; \<alpha> \<in> \<Union> (TCfun (q, x, y))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
q \<in> reachable_states M1
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1
\<alpha> \<in> \<Union> (TCfun (q, x, y))

goal (1 subgoal):
 1. \<alpha> \<noteq> [] \<Longrightarrow> \<alpha> \<in> Prefix_Tree.set T3
[PROOF STEP]
show "\<alpha> \<in> set T3"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<alpha> \<in> Prefix_Tree.set T3
[PROOF STEP]
using \<open>\<alpha> \<in> \<Union> (TCfun (q,(x,y)))\<close> set_prefix[of "\<alpha>" "[(x,y)]" T3]
[PROOF STATE]
proof (prove)
using this:
\<alpha> \<in> \<Union> (TCfun (q, x, y))
\<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<Longrightarrow> \<alpha> \<in> Prefix_Tree.set T3

goal (1 subgoal):
 1. \<alpha> \<in> Prefix_Tree.set T3
[PROOF STEP]
unfolding TCfun
[PROOF STATE]
proof (prove)
using this:
\<alpha> \<in> \<Union> (case (q, x, y) of (q, xa, y) \<Rightarrow> case FSM.h_obs M1 q xa y of None \<Rightarrow> {{\<alpha>, \<alpha> @ [(xa, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(xa, y)] \<in> Prefix_Tree.set T3} | Some q' \<Rightarrow> {{\<alpha>, \<alpha> @ [(xa, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(xa, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(xa, y)]) (V q') \<and> converge M2 (V q @ [(xa, y)]) (V q')})
\<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<Longrightarrow> \<alpha> \<in> Prefix_Tree.set T3

goal (1 subgoal):
 1. \<alpha> \<in> Prefix_Tree.set T3
[PROOF STEP]
by (cases "h_obs M1 q x y";auto)
[PROOF STATE]
proof (state)
this:
\<alpha> \<in> Prefix_Tree.set T3

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<alpha> \<in> Prefix_Tree.set T3

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
TC \<subseteq> Prefix_Tree.set T3

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have TC_is_transition_cover : "((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS)) \<Longrightarrow> transition_cover M1 TC"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> transition_cover M1 TC
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> transition_cover M1 TC
[PROOF STEP]
assume "((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS))"
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> transition_cover M1 TC
[PROOF STEP]
have "\<And> q x y . q \<in> reachable_states M1 \<Longrightarrow> x \<in> inputs M1 \<Longrightarrow> y \<in> outputs M1 \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
fix q x y
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
assume "q \<in> reachable_states M1"
                   and "x \<in> inputs M1"
                   and "y \<in> outputs M1"
[PROOF STATE]
proof (state)
this:
q \<in> reachable_states M1
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1

goal (1 subgoal):
 1. \<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
q \<in> reachable_states M1
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1
[PROOF STEP]
have "(q,(x,y)) \<in> (reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1)"
[PROOF STATE]
proof (prove)
using this:
q \<in> reachable_states M1
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1

goal (1 subgoal):
 1. (q, x, y) \<in> reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(q, x, y) \<in> reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1

goal (1 subgoal):
 1. \<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
show "\<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
proof (cases "h_obs M1 q x y")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. FSM.h_obs M1 q x y = None \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
 2. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
case None
[PROOF STATE]
proof (state)
this:
FSM.h_obs M1 q x y = None

goal (2 subgoals):
 1. FSM.h_obs M1 q x y = None \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
 2. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
FSM.h_obs M1 q x y = None
[PROOF STEP]
have "TCfun (q,(x,y)) = {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> set T3 \<and> \<alpha> @ [(x, y)] \<in> set T3}"
[PROOF STATE]
proof (prove)
using this:
FSM.h_obs M1 q x y = None

goal (1 subgoal):
 1. TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3}
[PROOF STEP]
unfolding TCfun
[PROOF STATE]
proof (prove)
using this:
FSM.h_obs M1 q x y = None

goal (1 subgoal):
 1. (case (q, x, y) of (q, xa, y) \<Rightarrow> case FSM.h_obs M1 q xa y of None \<Rightarrow> {{\<alpha>, \<alpha> @ [(xa, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(xa, y)] \<in> Prefix_Tree.set T3} | Some q' \<Rightarrow> {{\<alpha>, \<alpha> @ [(xa, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(xa, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(xa, y)]) (V q') \<and> converge M2 (V q @ [(xa, y)]) (V q')}) = {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3}

goal (2 subgoals):
 1. FSM.h_obs M1 q x y = None \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
 2. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3}
[PROOF STEP]
obtain \<alpha> where "converge M1 \<alpha> (V q)" and "\<alpha> \<in> \<Union> (TCfun (q,(x,y))) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q,(x,y)))"
[PROOF STATE]
proof (prove)
using this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3}

goal (1 subgoal):
 1. (\<And>\<alpha>. \<lbrakk>converge M1 \<alpha> (V q); \<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using TCfun_nonempty[OF \<open>((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS))\<close> \<open>q \<in> reachable_states M1\<close> \<open>x \<in> inputs M1\<close> \<open>y \<in> outputs M1\<close>]
[PROOF STATE]
proof (prove)
using this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3}
TCfun (q, x, y) \<noteq> {}

goal (1 subgoal):
 1. (\<And>\<alpha>. \<lbrakk>converge M1 \<alpha> (V q); \<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M1 \<alpha> (V q)
\<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y))

goal (2 subgoals):
 1. FSM.h_obs M1 q x y = None \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
 2. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
converge M1 \<alpha> (V q)
\<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y))
[PROOF STEP]
have "after_initial M1 \<alpha> = q"
[PROOF STATE]
proof (prove)
using this:
converge M1 \<alpha> (V q)
\<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y))

goal (1 subgoal):
 1. after_initial M1 \<alpha> = q
[PROOF STEP]
using state_cover_assignment_after[OF assms(1) \<open>is_state_cover_assignment M1 V\<close> \<open>q \<in> reachable_states M1\<close>]
[PROOF STATE]
proof (prove)
using this:
converge M1 \<alpha> (V q)
\<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y))
V q \<in> L M1
after_initial M1 (V q) = q

goal (1 subgoal):
 1. after_initial M1 \<alpha> = q
[PROOF STEP]
using convergence_minimal[OF assms(3,1)]
[PROOF STATE]
proof (prove)
using this:
converge M1 \<alpha> (V q)
\<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y))
V q \<in> L M1
after_initial M1 (V q) = q
\<lbrakk>?\<alpha> \<in> L M1; ?\<beta> \<in> L M1\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> = (after_initial M1 ?\<alpha> = after_initial M1 ?\<beta>)

goal (1 subgoal):
 1. after_initial M1 \<alpha> = q
[PROOF STEP]
by (metis converge.elims(2))
[PROOF STATE]
proof (state)
this:
after_initial M1 \<alpha> = q

goal (2 subgoals):
 1. FSM.h_obs M1 q x y = None \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
 2. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
after_initial M1 \<alpha> = q
[PROOF STEP]
have "\<exists>\<alpha>. \<alpha> \<in> \<Union> (TCfun (q,(x,y))) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q,(x,y))) \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q"
[PROOF STATE]
proof (prove)
using this:
after_initial M1 \<alpha> = q

goal (1 subgoal):
 1. \<exists>\<alpha>. \<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
using \<open>\<alpha> \<in> \<Union> (TCfun (q,(x,y))) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q,(x,y)))\<close>
[PROOF STATE]
proof (prove)
using this:
after_initial M1 \<alpha> = q
\<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y))

goal (1 subgoal):
 1. \<exists>\<alpha>. \<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
using \<open>converge M1 \<alpha> (V q)\<close> converge.elims(2)
[PROOF STATE]
proof (prove)
using this:
after_initial M1 \<alpha> = q
\<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y))
converge M1 \<alpha> (V q)
\<lbrakk>converge ?x ?xa ?xb; \<And>M \<pi> \<tau>. \<lbrakk>?x = M; ?xa = \<pi>; ?xb = \<tau>; \<pi> \<in> L M \<and> \<tau> \<in> L M \<and> LS M (after_initial M \<pi>) = LS M (after_initial M \<tau>)\<rbrakk> \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P

goal (1 subgoal):
 1. \<exists>\<alpha>. \<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>\<alpha>. \<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q

goal (2 subgoals):
 1. FSM.h_obs M1 q x y = None \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
 2. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<exists>\<alpha>. \<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q

goal (2 subgoals):
 1. FSM.h_obs M1 q x y = None \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
 2. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
have "\<Union> (TCfun (q,(x,y))) \<subseteq> TC"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> (TCfun (q, x, y)) \<subseteq> TC
[PROOF STEP]
unfolding TC
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> (TCfun (q, x, y)) \<subseteq> Set.insert [] (\<Union> (\<Union> (TCfun ` (reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1))))
[PROOF STEP]
using \<open>(q,(x,y)) \<in> (reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1)\<close>
[PROOF STATE]
proof (prove)
using this:
(q, x, y) \<in> reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1

goal (1 subgoal):
 1. \<Union> (TCfun (q, x, y)) \<subseteq> Set.insert [] (\<Union> (\<Union> (TCfun ` (reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1))))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<Union> (TCfun (q, x, y)) \<subseteq> TC

goal (2 subgoals):
 1. FSM.h_obs M1 q x y = None \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
 2. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<exists>\<alpha>. \<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
\<Union> (TCfun (q, x, y)) \<subseteq> TC
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<exists>\<alpha>. \<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
\<Union> (TCfun (q, x, y)) \<subseteq> TC

goal (1 subgoal):
 1. \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
case (Some q')
[PROOF STATE]
proof (state)
this:
FSM.h_obs M1 q x y = Some q'

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
FSM.h_obs M1 q x y = Some q'
[PROOF STEP]
have "TCfun (q,(x,y)) = {{\<alpha>,\<alpha>@[(x,y)], \<beta>} | \<alpha> \<beta> . converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x,y)] \<in> set T3 \<and> \<beta> \<in> set T3 \<and> converge M1 (V q @ [(x,y)]) (V q') \<and> converge M2 (V q @ [(x,y)]) (V q')}"
[PROOF STATE]
proof (prove)
using this:
FSM.h_obs M1 q x y = Some q'

goal (1 subgoal):
 1. TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')}
[PROOF STEP]
using TCfun
[PROOF STATE]
proof (prove)
using this:
FSM.h_obs M1 q x y = Some q'
TCfun = (\<lambda>(q, x, y). case FSM.h_obs M1 q x y of None \<Rightarrow> {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3} | Some q' \<Rightarrow> {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')})

goal (1 subgoal):
 1. TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')}

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')}

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
obtain S where "S \<in> TCfun (q,(x,y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>S. S \<in> TCfun (q, x, y) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using TCfun_nonempty[OF \<open>((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS))\<close> \<open>q \<in> reachable_states M1\<close> \<open>x \<in> inputs M1\<close> \<open>y \<in> outputs M1\<close>]
[PROOF STATE]
proof (prove)
using this:
TCfun (q, x, y) \<noteq> {}

goal (1 subgoal):
 1. (\<And>S. S \<in> TCfun (q, x, y) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
S \<in> TCfun (q, x, y)

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')}
S \<in> TCfun (q, x, y)
[PROOF STEP]
obtain \<alpha> where "converge M1 \<alpha> (V q)" and "\<alpha> \<in> S \<and> \<alpha> @ [(x, y)] \<in> S"
[PROOF STATE]
proof (prove)
using this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')}
S \<in> TCfun (q, x, y)

goal (1 subgoal):
 1. (\<And>\<alpha>. \<lbrakk>converge M1 \<alpha> (V q); \<alpha> \<in> S \<and> \<alpha> @ [(x, y)] \<in> S\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M1 \<alpha> (V q)
\<alpha> \<in> S \<and> \<alpha> @ [(x, y)] \<in> S

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
converge M1 \<alpha> (V q)
\<alpha> \<in> S \<and> \<alpha> @ [(x, y)] \<in> S
[PROOF STEP]
have "after_initial M1 \<alpha> = q"
[PROOF STATE]
proof (prove)
using this:
converge M1 \<alpha> (V q)
\<alpha> \<in> S \<and> \<alpha> @ [(x, y)] \<in> S

goal (1 subgoal):
 1. after_initial M1 \<alpha> = q
[PROOF STEP]
using state_cover_assignment_after[OF assms(1) \<open>is_state_cover_assignment M1 V\<close> \<open>q \<in> reachable_states M1\<close>]
[PROOF STATE]
proof (prove)
using this:
converge M1 \<alpha> (V q)
\<alpha> \<in> S \<and> \<alpha> @ [(x, y)] \<in> S
V q \<in> L M1
after_initial M1 (V q) = q

goal (1 subgoal):
 1. after_initial M1 \<alpha> = q
[PROOF STEP]
using convergence_minimal[OF assms(3,1)]
[PROOF STATE]
proof (prove)
using this:
converge M1 \<alpha> (V q)
\<alpha> \<in> S \<and> \<alpha> @ [(x, y)] \<in> S
V q \<in> L M1
after_initial M1 (V q) = q
\<lbrakk>?\<alpha> \<in> L M1; ?\<beta> \<in> L M1\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> = (after_initial M1 ?\<alpha> = after_initial M1 ?\<beta>)

goal (1 subgoal):
 1. after_initial M1 \<alpha> = q
[PROOF STEP]
by (metis converge.elims(2))
[PROOF STATE]
proof (state)
this:
after_initial M1 \<alpha> = q

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
after_initial M1 \<alpha> = q

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
have "\<alpha> \<in> \<Union> (TCfun (q,(x,y))) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q,(x,y)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y))
[PROOF STEP]
using \<open>\<alpha> \<in> S \<and> \<alpha> @ [(x, y)] \<in> S\<close> \<open>S \<in> TCfun (q,(x,y))\<close>
[PROOF STATE]
proof (prove)
using this:
\<alpha> \<in> S \<and> \<alpha> @ [(x, y)] \<in> S
S \<in> TCfun (q, x, y)

goal (1 subgoal):
 1. \<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y))

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
after_initial M1 \<alpha> = q
\<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y))
[PROOF STEP]
have "\<exists>\<alpha>. \<alpha> \<in> \<Union> (TCfun (q,(x,y))) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q,(x,y))) \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q"
[PROOF STATE]
proof (prove)
using this:
after_initial M1 \<alpha> = q
\<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y))

goal (1 subgoal):
 1. \<exists>\<alpha>. \<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
using \<open>\<alpha> \<in> \<Union> (TCfun (q,(x,y))) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q,(x,y)))\<close>
[PROOF STATE]
proof (prove)
using this:
after_initial M1 \<alpha> = q
\<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y))
\<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y))

goal (1 subgoal):
 1. \<exists>\<alpha>. \<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
using \<open>converge M1 \<alpha> (V q)\<close> converge.elims(2)
[PROOF STATE]
proof (prove)
using this:
after_initial M1 \<alpha> = q
\<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y))
\<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y))
converge M1 \<alpha> (V q)
\<lbrakk>converge ?x ?xa ?xb; \<And>M \<pi> \<tau>. \<lbrakk>?x = M; ?xa = \<pi>; ?xb = \<tau>; \<pi> \<in> L M \<and> \<tau> \<in> L M \<and> LS M (after_initial M \<pi>) = LS M (after_initial M \<tau>)\<rbrakk> \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P

goal (1 subgoal):
 1. \<exists>\<alpha>. \<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>\<alpha>. \<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<exists>\<alpha>. \<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
have "\<Union> (TCfun (q,(x,y))) \<subseteq> TC"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> (TCfun (q, x, y)) \<subseteq> TC
[PROOF STEP]
unfolding TC
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> (TCfun (q, x, y)) \<subseteq> Set.insert [] (\<Union> (\<Union> (TCfun ` (reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1))))
[PROOF STEP]
using \<open>(q,(x,y)) \<in> (reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1)\<close>
[PROOF STATE]
proof (prove)
using this:
(q, x, y) \<in> reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1

goal (1 subgoal):
 1. \<Union> (TCfun (q, x, y)) \<subseteq> Set.insert [] (\<Union> (\<Union> (TCfun ` (reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1))))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<Union> (TCfun (q, x, y)) \<subseteq> TC

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<exists>\<alpha>. \<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
\<Union> (TCfun (q, x, y)) \<subseteq> TC
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<exists>\<alpha>. \<alpha> \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> @ [(x, y)] \<in> \<Union> (TCfun (q, x, y)) \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
\<Union> (TCfun (q, x, y)) \<subseteq> TC

goal (1 subgoal):
 1. \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>?q \<in> reachable_states M1; ?x \<in> FSM.inputs M1; ?y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(?x, ?y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = ?q

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> transition_cover M1 TC
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>?q \<in> reachable_states M1; ?x \<in> FSM.inputs M1; ?y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(?x, ?y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = ?q
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?q \<in> reachable_states M1; ?x \<in> FSM.inputs M1; ?y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(?x, ?y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = ?q

goal (1 subgoal):
 1. transition_cover M1 TC
[PROOF STEP]
unfolding transition_cover_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?q \<in> reachable_states M1; ?x \<in> FSM.inputs M1; ?y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(?x, ?y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = ?q

goal (1 subgoal):
 1. \<forall>q\<in>reachable_states M1. \<forall>x\<in>FSM.inputs M1. \<forall>y\<in>FSM.outputs M1. \<exists>\<alpha>. \<alpha> \<in> TC \<and> \<alpha> @ [(x, y)] \<in> TC \<and> \<alpha> \<in> L M1 \<and> after_initial M1 \<alpha> = q
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
transition_cover M1 TC

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> transition_cover M1 TC

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have TC_preserves_convergence: "preserves_convergence M1 M2 TC"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_convergence M1 M2 TC
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. preserves_convergence M1 M2 TC
[PROOF STEP]
have "\<And> \<alpha> \<beta> . \<alpha> \<in> L M1 \<inter> TC \<Longrightarrow> \<beta> \<in> L M1 \<inter> TC \<Longrightarrow> converge M1 \<alpha> \<beta> \<Longrightarrow> converge M2 \<alpha> \<beta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<alpha> \<in> L M1 \<inter> TC; \<beta> \<in> L M1 \<inter> TC; converge M1 \<alpha> \<beta>\<rbrakk> \<Longrightarrow> converge M2 \<alpha> \<beta>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<alpha> \<in> L M1 \<inter> TC; \<beta> \<in> L M1 \<inter> TC; converge M1 \<alpha> \<beta>\<rbrakk> \<Longrightarrow> converge M2 \<alpha> \<beta>
[PROOF STEP]
fix \<alpha> \<beta>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<alpha> \<in> L M1 \<inter> TC; \<beta> \<in> L M1 \<inter> TC; converge M1 \<alpha> \<beta>\<rbrakk> \<Longrightarrow> converge M2 \<alpha> \<beta>
[PROOF STEP]
assume "\<alpha> \<in> L M1 \<inter> TC"
                     "\<beta> \<in> L M1 \<inter> TC"
                     "converge M1 \<alpha> \<beta>"
[PROOF STATE]
proof (state)
this:
\<alpha> \<in> L M1 \<inter> TC
\<beta> \<in> L M1 \<inter> TC
converge M1 \<alpha> \<beta>

goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<alpha> \<in> L M1 \<inter> TC; \<beta> \<in> L M1 \<inter> TC; converge M1 \<alpha> \<beta>\<rbrakk> \<Longrightarrow> converge M2 \<alpha> \<beta>
[PROOF STEP]
have *: "\<And> \<alpha> . \<alpha> \<in> L M1 \<Longrightarrow> \<alpha> \<in> TC \<Longrightarrow> \<exists> q . q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<alpha>. \<lbrakk>\<alpha> \<in> L M1; \<alpha> \<in> TC\<rbrakk> \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<alpha>. \<lbrakk>\<alpha> \<in> L M1; \<alpha> \<in> TC\<rbrakk> \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
fix \<alpha>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<alpha>. \<lbrakk>\<alpha> \<in> L M1; \<alpha> \<in> TC\<rbrakk> \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
assume "\<alpha> \<in> L M1" and "\<alpha> \<in> TC"
[PROOF STATE]
proof (state)
this:
\<alpha> \<in> L M1
\<alpha> \<in> TC

goal (1 subgoal):
 1. \<And>\<alpha>. \<lbrakk>\<alpha> \<in> L M1; \<alpha> \<in> TC\<rbrakk> \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
show "\<exists> q . q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
proof (cases "\<alpha> = []")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<alpha> = [] \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 2. \<alpha> \<noteq> [] \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
\<alpha> = []

goal (2 subgoals):
 1. \<alpha> = [] \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 2. \<alpha> \<noteq> [] \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<alpha> = []
[PROOF STEP]
have "V (initial M1) = \<alpha>"
[PROOF STATE]
proof (prove)
using this:
\<alpha> = []

goal (1 subgoal):
 1. V (FSM.initial M1) = \<alpha>
[PROOF STEP]
using \<open>is_state_cover_assignment M1 V\<close> reachable_states_initial[of M1]
[PROOF STATE]
proof (prove)
using this:
\<alpha> = []
is_state_cover_assignment M1 V
FSM.initial M1 \<in> reachable_states M1

goal (1 subgoal):
 1. V (FSM.initial M1) = \<alpha>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
V (FSM.initial M1) = \<alpha>

goal (2 subgoals):
 1. \<alpha> = [] \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 2. \<alpha> \<noteq> [] \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V (FSM.initial M1) = \<alpha>
[PROOF STEP]
have "converge M1 \<alpha> (V (initial M1))" and "converge M2 \<alpha> (V (initial M1))"
[PROOF STATE]
proof (prove)
using this:
V (FSM.initial M1) = \<alpha>

goal (1 subgoal):
 1. converge M1 \<alpha> (V (FSM.initial M1)) &&& converge M2 \<alpha> (V (FSM.initial M1))
[PROOF STEP]
unfolding True
[PROOF STATE]
proof (prove)
using this:
V (FSM.initial M1) = []

goal (1 subgoal):
 1. converge M1 [] (V (FSM.initial M1)) &&& converge M2 [] (V (FSM.initial M1))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M1 \<alpha> (V (FSM.initial M1))
converge M2 \<alpha> (V (FSM.initial M1))

goal (2 subgoals):
 1. \<alpha> = [] \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 2. \<alpha> \<noteq> [] \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
converge M1 \<alpha> (V (FSM.initial M1))
converge M2 \<alpha> (V (FSM.initial M1))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
converge M1 \<alpha> (V (FSM.initial M1))
converge M2 \<alpha> (V (FSM.initial M1))

goal (1 subgoal):
 1. \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
using reachable_states_initial[of M1]
[PROOF STATE]
proof (prove)
using this:
converge M1 \<alpha> (V (FSM.initial M1))
converge M2 \<alpha> (V (FSM.initial M1))
FSM.initial M1 \<in> reachable_states M1

goal (1 subgoal):
 1. \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)

goal (1 subgoal):
 1. \<alpha> \<noteq> [] \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<alpha> \<noteq> [] \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<alpha> \<noteq> []

goal (1 subgoal):
 1. \<alpha> \<noteq> [] \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<alpha> \<noteq> []
[PROOF STEP]
have "\<alpha> \<in> (\<Union>(\<Union> (TCfun ` (reachable_states M1 \<times> (inputs M1 \<times> outputs M1)))))"
[PROOF STATE]
proof (prove)
using this:
\<alpha> \<noteq> []

goal (1 subgoal):
 1. \<alpha> \<in> \<Union> (\<Union> (TCfun ` (reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1)))
[PROOF STEP]
using \<open>\<alpha> \<in> TC\<close>
[PROOF STATE]
proof (prove)
using this:
\<alpha> \<noteq> []
\<alpha> \<in> TC

goal (1 subgoal):
 1. \<alpha> \<in> \<Union> (\<Union> (TCfun ` (reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1)))
[PROOF STEP]
unfolding TC
[PROOF STATE]
proof (prove)
using this:
\<alpha> \<noteq> []
\<alpha> \<in> Set.insert [] (\<Union> (\<Union> (TCfun ` (reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1))))

goal (1 subgoal):
 1. \<alpha> \<in> \<Union> (\<Union> (TCfun ` (reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<alpha> \<in> \<Union> (\<Union> (TCfun ` (reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1)))

goal (1 subgoal):
 1. \<alpha> \<noteq> [] \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<alpha> \<in> \<Union> (\<Union> (TCfun ` (reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1)))
[PROOF STEP]
obtain q x y where "q \<in> reachable_states M1"
                              and "x \<in> inputs M1"
                              and "y \<in> outputs M1"
                              and "\<alpha> \<in> \<Union> (TCfun (q,(x,y)))"
[PROOF STATE]
proof (prove)
using this:
\<alpha> \<in> \<Union> (\<Union> (TCfun ` (reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1)))

goal (1 subgoal):
 1. (\<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; \<alpha> \<in> \<Union> (TCfun (q, x, y))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding TC
[PROOF STATE]
proof (prove)
using this:
\<alpha> \<in> \<Union> (\<Union> (TCfun ` (reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1)))

goal (1 subgoal):
 1. (\<And>q x y. \<lbrakk>q \<in> reachable_states M1; x \<in> FSM.inputs M1; y \<in> FSM.outputs M1; \<alpha> \<in> \<Union> (TCfun (q, x, y))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
q \<in> reachable_states M1
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1
\<alpha> \<in> \<Union> (TCfun (q, x, y))

goal (1 subgoal):
 1. \<alpha> \<noteq> [] \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
show "\<exists> q . q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
proof (cases "h_obs M1 q x y")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. FSM.h_obs M1 q x y = None \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 2. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
case None
[PROOF STATE]
proof (state)
this:
FSM.h_obs M1 q x y = None

goal (2 subgoals):
 1. FSM.h_obs M1 q x y = None \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 2. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
FSM.h_obs M1 q x y = None
[PROOF STEP]
have "TCfun (q,(x,y)) = {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> set T3 \<and> \<alpha> @ [(x, y)] \<in> set T3}"
[PROOF STATE]
proof (prove)
using this:
FSM.h_obs M1 q x y = None

goal (1 subgoal):
 1. TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3}
[PROOF STEP]
unfolding TCfun
[PROOF STATE]
proof (prove)
using this:
FSM.h_obs M1 q x y = None

goal (1 subgoal):
 1. (case (q, x, y) of (q, xa, y) \<Rightarrow> case FSM.h_obs M1 q xa y of None \<Rightarrow> {{\<alpha>, \<alpha> @ [(xa, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(xa, y)] \<in> Prefix_Tree.set T3} | Some q' \<Rightarrow> {{\<alpha>, \<alpha> @ [(xa, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(xa, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(xa, y)]) (V q') \<and> converge M2 (V q @ [(xa, y)]) (V q')}) = {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3}

goal (2 subgoals):
 1. FSM.h_obs M1 q x y = None \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 2. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3}
[PROOF STEP]
obtain \<alpha>' where "\<alpha> \<in> {\<alpha>', \<alpha>' @ [(x, y)]}"
                             and "converge M1 \<alpha>' (V q)"
                             and "converge M2 \<alpha>' (V q)"
[PROOF STATE]
proof (prove)
using this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3}

goal (1 subgoal):
 1. (\<And>\<alpha>''. \<lbrakk>\<alpha> \<in> {\<alpha>'', \<alpha>'' @ [(x, y)]}; converge M1 \<alpha>'' (V q); converge M2 \<alpha>'' (V q)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<open>\<alpha> \<in> \<Union> (TCfun (q,(x,y)))\<close>
[PROOF STATE]
proof (prove)
using this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3}
\<alpha> \<in> \<Union> (TCfun (q, x, y))

goal (1 subgoal):
 1. (\<And>\<alpha>''. \<lbrakk>\<alpha> \<in> {\<alpha>'', \<alpha>'' @ [(x, y)]}; converge M1 \<alpha>'' (V q); converge M2 \<alpha>'' (V q)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<alpha> \<in> {\<alpha>', \<alpha>' @ [(x, y)]}
converge M1 \<alpha>' (V q)
converge M2 \<alpha>' (V q)

goal (2 subgoals):
 1. FSM.h_obs M1 q x y = None \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 2. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
have "[(x,y)] \<notin> LS M1 q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. [(x, y)] \<notin> LS M1 q
[PROOF STEP]
using None
[PROOF STATE]
proof (prove)
using this:
FSM.h_obs M1 q x y = None

goal (1 subgoal):
 1. [(x, y)] \<notin> LS M1 q
[PROOF STEP]
unfolding h_obs_None[OF assms(1)] LS_single_transition
[PROOF STATE]
proof (prove)
using this:
\<nexists>q'. (q, x, y, q') \<in> FSM.transitions M1

goal (1 subgoal):
 1. \<not> (\<exists>t\<in>FSM.transitions M1. t_source t = q \<and> t_input t = x \<and> t_output t = y)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
[(x, y)] \<notin> LS M1 q

goal (2 subgoals):
 1. FSM.h_obs M1 q x y = None \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 2. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
[(x, y)] \<notin> LS M1 q

goal (2 subgoals):
 1. FSM.h_obs M1 q x y = None \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 2. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
have "after_initial M1 \<alpha>' = q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. after_initial M1 \<alpha>' = q
[PROOF STEP]
using \<open>converge M1 \<alpha>' (V q)\<close>
[PROOF STATE]
proof (prove)
using this:
converge M1 \<alpha>' (V q)

goal (1 subgoal):
 1. after_initial M1 \<alpha>' = q
[PROOF STEP]
using state_cover_assignment_after[OF assms(1) \<open>is_state_cover_assignment M1 V\<close> \<open>q \<in> reachable_states M1\<close>]
[PROOF STATE]
proof (prove)
using this:
converge M1 \<alpha>' (V q)
V q \<in> L M1
after_initial M1 (V q) = q

goal (1 subgoal):
 1. after_initial M1 \<alpha>' = q
[PROOF STEP]
using convergence_minimal[OF assms(3,1) _ _]
[PROOF STATE]
proof (prove)
using this:
converge M1 \<alpha>' (V q)
V q \<in> L M1
after_initial M1 (V q) = q
\<lbrakk>?\<alpha> \<in> L M1; ?\<beta> \<in> L M1\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> = (after_initial M1 ?\<alpha> = after_initial M1 ?\<beta>)

goal (1 subgoal):
 1. after_initial M1 \<alpha>' = q
[PROOF STEP]
by (metis converge.elims(2))
[PROOF STATE]
proof (state)
this:
after_initial M1 \<alpha>' = q

goal (2 subgoals):
 1. FSM.h_obs M1 q x y = None \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 2. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
[(x, y)] \<notin> LS M1 q
after_initial M1 \<alpha>' = q
[PROOF STEP]
have "\<alpha>' @ [(x, y)] \<notin> L M1"
[PROOF STATE]
proof (prove)
using this:
[(x, y)] \<notin> LS M1 q
after_initial M1 \<alpha>' = q

goal (1 subgoal):
 1. \<alpha>' @ [(x, y)] \<notin> L M1
[PROOF STEP]
using after_language_iff[OF assms(1), of \<alpha>' "initial M1" "[(x,y)]"]  \<open>converge M1 \<alpha>' (V q)\<close>
[PROOF STATE]
proof (prove)
using this:
[(x, y)] \<notin> LS M1 q
after_initial M1 \<alpha>' = q
\<alpha>' \<in> L M1 \<Longrightarrow> ([(x, y)] \<in> LS M1 (after_initial M1 \<alpha>')) = (\<alpha>' @ [(x, y)] \<in> L M1)
converge M1 \<alpha>' (V q)

goal (1 subgoal):
 1. \<alpha>' @ [(x, y)] \<notin> L M1
[PROOF STEP]
by (meson converge.elims(2))
[PROOF STATE]
proof (state)
this:
\<alpha>' @ [(x, y)] \<notin> L M1

goal (2 subgoals):
 1. FSM.h_obs M1 q x y = None \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 2. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<alpha>' @ [(x, y)] \<notin> L M1
[PROOF STEP]
have "\<alpha>' = \<alpha>"
[PROOF STATE]
proof (prove)
using this:
\<alpha>' @ [(x, y)] \<notin> L M1

goal (1 subgoal):
 1. \<alpha>' = \<alpha>
[PROOF STEP]
using \<open>\<alpha> \<in> {\<alpha>', \<alpha>' @ [(x, y)]}\<close> \<open>\<alpha> \<in> L M1\<close>
[PROOF STATE]
proof (prove)
using this:
\<alpha>' @ [(x, y)] \<notin> L M1
\<alpha> \<in> {\<alpha>', \<alpha>' @ [(x, y)]}
\<alpha> \<in> L M1

goal (1 subgoal):
 1. \<alpha>' = \<alpha>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<alpha>' = \<alpha>

goal (2 subgoals):
 1. FSM.h_obs M1 q x y = None \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 2. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<alpha>' = \<alpha>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<alpha>' = \<alpha>

goal (1 subgoal):
 1. \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
using \<open>q \<in> reachable_states M1\<close> \<open>converge M1 \<alpha>' (V q)\<close> \<open>converge M2 \<alpha>' (V q)\<close>
[PROOF STATE]
proof (prove)
using this:
\<alpha>' = \<alpha>
q \<in> reachable_states M1
converge M1 \<alpha>' (V q)
converge M2 \<alpha>' (V q)

goal (1 subgoal):
 1. \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
case (Some q')
[PROOF STATE]
proof (state)
this:
FSM.h_obs M1 q x y = Some q'

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
FSM.h_obs M1 q x y = Some q'
[PROOF STEP]
have "q' \<in> reachable_states M1"
[PROOF STATE]
proof (prove)
using this:
FSM.h_obs M1 q x y = Some q'

goal (1 subgoal):
 1. q' \<in> reachable_states M1
[PROOF STEP]
unfolding h_obs_Some[OF assms(1)]
[PROOF STATE]
proof (prove)
using this:
{q'. (q, x, y, q') \<in> FSM.transitions M1} = {q'}

goal (1 subgoal):
 1. q' \<in> reachable_states M1
[PROOF STEP]
using reachable_states_next[OF \<open>q \<in> reachable_states M1\<close>, of "(q,x,y,q')"]
[PROOF STATE]
proof (prove)
using this:
{q'. (q, x, y, q') \<in> FSM.transitions M1} = {q'}
\<lbrakk>(q, x, y, q') \<in> FSM.transitions M1; t_source (q, x, y, q') = q\<rbrakk> \<Longrightarrow> t_target (q, x, y, q') \<in> reachable_states M1

goal (1 subgoal):
 1. q' \<in> reachable_states M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
q' \<in> reachable_states M1

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
have "TCfun (q,(x,y)) = {{\<alpha>,\<alpha>@[(x,y)], \<beta>} | \<alpha> \<beta> . converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x,y)] \<in> set T3 \<and> \<beta> \<in> set T3 \<and> converge M1 (V q @ [(x,y)]) (V q') \<and> converge M2 (V q @ [(x,y)]) (V q')}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')}
[PROOF STEP]
using Some TCfun
[PROOF STATE]
proof (prove)
using this:
FSM.h_obs M1 q x y = Some q'
TCfun = (\<lambda>(q, x, y). case FSM.h_obs M1 q x y of None \<Rightarrow> {{\<alpha>, \<alpha> @ [(x, y)]} |\<alpha>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> \<alpha> \<in> Prefix_Tree.set T3 \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3} | Some q' \<Rightarrow> {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')})

goal (1 subgoal):
 1. TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')}

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')}
[PROOF STEP]
obtain \<alpha>' \<beta> where "\<alpha> \<in> {\<alpha>',\<alpha>'@[(x,y)], \<beta>}"
                               and "converge M1 \<alpha>' (V q)"
                               and "converge M2 \<alpha>' (V q)"
                               and "converge M1 \<beta> (V q')"
                               and "converge M2 \<beta> (V q')"
                               and "converge M1 (V q @ [(x,y)]) (V q')"
                               and "converge M2 (V q @ [(x,y)]) (V q')"
[PROOF STATE]
proof (prove)
using this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')}

goal (1 subgoal):
 1. (\<And>\<alpha>'' \<beta>. \<lbrakk>\<alpha> \<in> {\<alpha>'', \<alpha>'' @ [(x, y)], \<beta>}; converge M1 \<alpha>'' (V q); converge M2 \<alpha>'' (V q); converge M1 \<beta> (V q'); converge M2 \<beta> (V q'); converge M1 (V q @ [(x, y)]) (V q'); converge M2 (V q @ [(x, y)]) (V q')\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<open>\<alpha> \<in> \<Union> (TCfun (q,(x,y)))\<close>
[PROOF STATE]
proof (prove)
using this:
TCfun (q, x, y) = {{\<alpha>, \<alpha> @ [(x, y)], \<beta>} |\<alpha> \<beta>. converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q) \<and> converge M1 \<beta> (V q') \<and> converge M2 \<beta> (V q') \<and> \<alpha> @ [(x, y)] \<in> Prefix_Tree.set T3 \<and> \<beta> \<in> Prefix_Tree.set T3 \<and> converge M1 (V q @ [(x, y)]) (V q') \<and> converge M2 (V q @ [(x, y)]) (V q')}
\<alpha> \<in> \<Union> (TCfun (q, x, y))

goal (1 subgoal):
 1. (\<And>\<alpha>'' \<beta>. \<lbrakk>\<alpha> \<in> {\<alpha>'', \<alpha>'' @ [(x, y)], \<beta>}; converge M1 \<alpha>'' (V q); converge M2 \<alpha>'' (V q); converge M1 \<beta> (V q'); converge M2 \<beta> (V q'); converge M1 (V q @ [(x, y)]) (V q'); converge M2 (V q @ [(x, y)]) (V q')\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<alpha> \<in> {\<alpha>', \<alpha>' @ [(x, y)], \<beta>}
converge M1 \<alpha>' (V q)
converge M2 \<alpha>' (V q)
converge M1 \<beta> (V q')
converge M2 \<beta> (V q')
converge M1 (V q @ [(x, y)]) (V q')
converge M2 (V q @ [(x, y)]) (V q')

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<alpha> \<in> {\<alpha>', \<alpha>' @ [(x, y)], \<beta>}
converge M1 \<alpha>' (V q)
converge M2 \<alpha>' (V q)
converge M1 \<beta> (V q')
converge M2 \<beta> (V q')
converge M1 (V q @ [(x, y)]) (V q')
converge M2 (V q @ [(x, y)]) (V q')
[PROOF STEP]
consider "\<alpha> = \<alpha>'" | "\<alpha> = \<alpha>'@[(x,y)]" | "\<alpha> = \<beta>"
[PROOF STATE]
proof (prove)
using this:
\<alpha> \<in> {\<alpha>', \<alpha>' @ [(x, y)], \<beta>}
converge M1 \<alpha>' (V q)
converge M2 \<alpha>' (V q)
converge M1 \<beta> (V q')
converge M2 \<beta> (V q')
converge M1 (V q @ [(x, y)]) (V q')
converge M2 (V q @ [(x, y)]) (V q')

goal (1 subgoal):
 1. \<lbrakk>\<alpha> = \<alpha>' \<Longrightarrow> thesis; \<alpha> = \<alpha>' @ [(x, y)] \<Longrightarrow> thesis; \<alpha> = \<beta> \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<alpha> = \<alpha>' \<Longrightarrow> ?thesis; \<alpha> = \<alpha>' @ [(x, y)] \<Longrightarrow> ?thesis; \<alpha> = \<beta> \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. \<And>a. FSM.h_obs M1 q x y = Some a \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>\<alpha> = \<alpha>' \<Longrightarrow> ?thesis; \<alpha> = \<alpha>' @ [(x, y)] \<Longrightarrow> ?thesis; \<alpha> = \<beta> \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<alpha> = \<alpha>' \<Longrightarrow> ?thesis; \<alpha> = \<alpha>' @ [(x, y)] \<Longrightarrow> ?thesis; \<alpha> = \<beta> \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
proof cases
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<alpha> = \<alpha>' \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 2. \<alpha> = \<alpha>' @ [(x, y)] \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 3. \<alpha> = \<beta> \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:
\<alpha> = \<alpha>'

goal (3 subgoals):
 1. \<alpha> = \<alpha>' \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 2. \<alpha> = \<alpha>' @ [(x, y)] \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 3. \<alpha> = \<beta> \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<alpha> = \<alpha>'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<alpha> = \<alpha>'

goal (1 subgoal):
 1. \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
using \<open>q \<in> reachable_states M1\<close> \<open>converge M1 \<alpha>' (V q)\<close> \<open>converge M2 \<alpha>' (V q)\<close>
[PROOF STATE]
proof (prove)
using this:
\<alpha> = \<alpha>'
q \<in> reachable_states M1
converge M1 \<alpha>' (V q)
converge M2 \<alpha>' (V q)

goal (1 subgoal):
 1. \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)

goal (2 subgoals):
 1. \<alpha> = \<alpha>' @ [(x, y)] \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 2. \<alpha> = \<beta> \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<alpha> = \<alpha>' @ [(x, y)] \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 2. \<alpha> = \<beta> \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:
\<alpha> = \<alpha>' @ [(x, y)]

goal (2 subgoals):
 1. \<alpha> = \<alpha>' @ [(x, y)] \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 2. \<alpha> = \<beta> \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
have "converge M1 (\<alpha>'@[(x,y)]) (V q @ [(x,y)])"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. converge M1 (\<alpha>' @ [(x, y)]) (V q @ [(x, y)])
[PROOF STEP]
using \<open>converge M1 \<alpha>' (V q)\<close>  \<open>converge M1 (V q @ [(x,y)]) (V q')\<close>
[PROOF STATE]
proof (prove)
using this:
converge M1 \<alpha>' (V q)
converge M1 (V q @ [(x, y)]) (V q')

goal (1 subgoal):
 1. converge M1 (\<alpha>' @ [(x, y)]) (V q @ [(x, y)])
[PROOF STEP]
using converge_append[OF assms(1), of "V q" \<alpha>' "[(x,y)]"]
[PROOF STATE]
proof (prove)
using this:
converge M1 \<alpha>' (V q)
converge M1 (V q @ [(x, y)]) (V q')
\<lbrakk>converge M1 (V q) \<alpha>'; V q @ [(x, y)] \<in> L M1; \<alpha>' \<in> L M1\<rbrakk> \<Longrightarrow> converge M1 (V q @ [(x, y)]) (\<alpha>' @ [(x, y)])

goal (1 subgoal):
 1. converge M1 (\<alpha>' @ [(x, y)]) (V q @ [(x, y)])
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M1 (\<alpha>' @ [(x, y)]) (V q @ [(x, y)])

goal (2 subgoals):
 1. \<alpha> = \<alpha>' @ [(x, y)] \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 2. \<alpha> = \<beta> \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
converge M1 (\<alpha>' @ [(x, y)]) (V q @ [(x, y)])
[PROOF STEP]
have "converge M1 (\<alpha>'@[(x,y)]) (V q')"
[PROOF STATE]
proof (prove)
using this:
converge M1 (\<alpha>' @ [(x, y)]) (V q @ [(x, y)])

goal (1 subgoal):
 1. converge M1 (\<alpha>' @ [(x, y)]) (V q')
[PROOF STEP]
using \<open>converge M1 \<beta> (V q')\<close> \<open>converge M1 (V q @ [(x,y)]) (V q')\<close>
[PROOF STATE]
proof (prove)
using this:
converge M1 (\<alpha>' @ [(x, y)]) (V q @ [(x, y)])
converge M1 \<beta> (V q')
converge M1 (V q @ [(x, y)]) (V q')

goal (1 subgoal):
 1. converge M1 (\<alpha>' @ [(x, y)]) (V q')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M1 (\<alpha>' @ [(x, y)]) (V q')

goal (2 subgoals):
 1. \<alpha> = \<alpha>' @ [(x, y)] \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 2. \<alpha> = \<beta> \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
have "converge M2 (\<alpha>'@[(x,y)]) (V q @ [(x,y)])"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. converge M2 (\<alpha>' @ [(x, y)]) (V q @ [(x, y)])
[PROOF STEP]
using \<open>converge M2 \<alpha>' (V q)\<close>  \<open>converge M2 (V q @ [(x,y)]) (V q')\<close>
[PROOF STATE]
proof (prove)
using this:
converge M2 \<alpha>' (V q)
converge M2 (V q @ [(x, y)]) (V q')

goal (1 subgoal):
 1. converge M2 (\<alpha>' @ [(x, y)]) (V q @ [(x, y)])
[PROOF STEP]
using converge_append[OF assms(2), of "V q" \<alpha>' "[(x,y)]"]
[PROOF STATE]
proof (prove)
using this:
converge M2 \<alpha>' (V q)
converge M2 (V q @ [(x, y)]) (V q')
\<lbrakk>converge M2 (V q) \<alpha>'; V q @ [(x, y)] \<in> L M2; \<alpha>' \<in> L M2\<rbrakk> \<Longrightarrow> converge M2 (V q @ [(x, y)]) (\<alpha>' @ [(x, y)])

goal (1 subgoal):
 1. converge M2 (\<alpha>' @ [(x, y)]) (V q @ [(x, y)])
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M2 (\<alpha>' @ [(x, y)]) (V q @ [(x, y)])

goal (2 subgoals):
 1. \<alpha> = \<alpha>' @ [(x, y)] \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 2. \<alpha> = \<beta> \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
converge M2 (\<alpha>' @ [(x, y)]) (V q @ [(x, y)])
[PROOF STEP]
have "converge M2 (\<alpha>'@[(x,y)]) (V q')"
[PROOF STATE]
proof (prove)
using this:
converge M2 (\<alpha>' @ [(x, y)]) (V q @ [(x, y)])

goal (1 subgoal):
 1. converge M2 (\<alpha>' @ [(x, y)]) (V q')
[PROOF STEP]
using \<open>converge M2 \<beta> (V q')\<close> \<open>converge M2 (V q @ [(x,y)]) (V q')\<close>
[PROOF STATE]
proof (prove)
using this:
converge M2 (\<alpha>' @ [(x, y)]) (V q @ [(x, y)])
converge M2 \<beta> (V q')
converge M2 (V q @ [(x, y)]) (V q')

goal (1 subgoal):
 1. converge M2 (\<alpha>' @ [(x, y)]) (V q')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M2 (\<alpha>' @ [(x, y)]) (V q')

goal (2 subgoals):
 1. \<alpha> = \<alpha>' @ [(x, y)] \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
 2. \<alpha> = \<beta> \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
using 2 \<open>q' \<in> reachable_states M1\<close> \<open>converge M1 (\<alpha>'@[(x,y)]) (V q')\<close> \<open>converge M2 (\<alpha>'@[(x,y)]) (V q')\<close>
[PROOF STATE]
proof (prove)
using this:
\<alpha> = \<alpha>' @ [(x, y)]
q' \<in> reachable_states M1
converge M1 (\<alpha>' @ [(x, y)]) (V q')
converge M2 (\<alpha>' @ [(x, y)]) (V q')

goal (1 subgoal):
 1. \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)

goal (1 subgoal):
 1. \<alpha> = \<beta> \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<alpha> = \<beta> \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
case 3
[PROOF STATE]
proof (state)
this:
\<alpha> = \<beta>

goal (1 subgoal):
 1. \<alpha> = \<beta> \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<alpha> = \<beta>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<alpha> = \<beta>

goal (1 subgoal):
 1. \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
using \<open>converge M1 \<beta> (V q')\<close> \<open>converge M2 \<beta> (V q')\<close> \<open>q' \<in> reachable_states M1\<close>
[PROOF STATE]
proof (prove)
using this:
\<alpha> = \<beta>
converge M1 \<beta> (V q')
converge M2 \<beta> (V q')
q' \<in> reachable_states M1

goal (1 subgoal):
 1. \<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>q. q \<in> reachable_states M1 \<and> converge M1 \<alpha> (V q) \<and> converge M2 \<alpha> (V q)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>?\<alpha> \<in> L M1; ?\<alpha> \<in> TC\<rbrakk> \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 ?\<alpha> (V q) \<and> converge M2 ?\<alpha> (V q)

goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<alpha> \<in> L M1 \<inter> TC; \<beta> \<in> L M1 \<inter> TC; converge M1 \<alpha> \<beta>\<rbrakk> \<Longrightarrow> converge M2 \<alpha> \<beta>
[PROOF STEP]
obtain q where "q \<in> reachable_states M1" and "converge M1 \<alpha> (V q)" and "converge M2 \<alpha> (V q)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>q. \<lbrakk>q \<in> reachable_states M1; converge M1 \<alpha> (V q); converge M2 \<alpha> (V q)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using * \<open>\<alpha> \<in> L M1 \<inter> TC\<close>
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?\<alpha> \<in> L M1; ?\<alpha> \<in> TC\<rbrakk> \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 ?\<alpha> (V q) \<and> converge M2 ?\<alpha> (V q)
\<alpha> \<in> L M1 \<inter> TC

goal (1 subgoal):
 1. (\<And>q. \<lbrakk>q \<in> reachable_states M1; converge M1 \<alpha> (V q); converge M2 \<alpha> (V q)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
q \<in> reachable_states M1
converge M1 \<alpha> (V q)
converge M2 \<alpha> (V q)

goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<alpha> \<in> L M1 \<inter> TC; \<beta> \<in> L M1 \<inter> TC; converge M1 \<alpha> \<beta>\<rbrakk> \<Longrightarrow> converge M2 \<alpha> \<beta>
[PROOF STEP]
obtain q' where "q' \<in> reachable_states M1" and "converge M1 \<beta> (V q')" and "converge M2 \<beta> (V q')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>q'. \<lbrakk>q' \<in> reachable_states M1; converge M1 \<beta> (V q'); converge M2 \<beta> (V q')\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using * \<open>\<beta> \<in> L M1 \<inter> TC\<close>
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?\<alpha> \<in> L M1; ?\<alpha> \<in> TC\<rbrakk> \<Longrightarrow> \<exists>q. q \<in> reachable_states M1 \<and> converge M1 ?\<alpha> (V q) \<and> converge M2 ?\<alpha> (V q)
\<beta> \<in> L M1 \<inter> TC

goal (1 subgoal):
 1. (\<And>q'. \<lbrakk>q' \<in> reachable_states M1; converge M1 \<beta> (V q'); converge M2 \<beta> (V q')\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
q' \<in> reachable_states M1
converge M1 \<beta> (V q')
converge M2 \<beta> (V q')

goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<alpha> \<in> L M1 \<inter> TC; \<beta> \<in> L M1 \<inter> TC; converge M1 \<alpha> \<beta>\<rbrakk> \<Longrightarrow> converge M2 \<alpha> \<beta>
[PROOF STEP]
have "converge M1 (V q) (V q')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. converge M1 (V q) (V q')
[PROOF STEP]
using \<open>converge M1 \<alpha> (V q)\<close> \<open>converge M1 \<beta> (V q')\<close> \<open>converge M1 \<alpha> \<beta>\<close>
[PROOF STATE]
proof (prove)
using this:
converge M1 \<alpha> (V q)
converge M1 \<beta> (V q')
converge M1 \<alpha> \<beta>

goal (1 subgoal):
 1. converge M1 (V q) (V q')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M1 (V q) (V q')

goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<alpha> \<in> L M1 \<inter> TC; \<beta> \<in> L M1 \<inter> TC; converge M1 \<alpha> \<beta>\<rbrakk> \<Longrightarrow> converge M2 \<alpha> \<beta>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
converge M1 (V q) (V q')
[PROOF STEP]
have "q = q'"
[PROOF STATE]
proof (prove)
using this:
converge M1 (V q) (V q')

goal (1 subgoal):
 1. q = q'
[PROOF STEP]
using convergence_minimal[OF assms(3,1), of "V q" "V q'"]
[PROOF STATE]
proof (prove)
using this:
converge M1 (V q) (V q')
\<lbrakk>V q \<in> L M1; V q' \<in> L M1\<rbrakk> \<Longrightarrow> converge M1 (V q) (V q') = (after_initial M1 (V q) = after_initial M1 (V q'))

goal (1 subgoal):
 1. q = q'
[PROOF STEP]
unfolding state_cover_assignment_after[OF assms(1) \<open>is_state_cover_assignment M1 V\<close> \<open>q \<in> reachable_states M1\<close>]
                  state_cover_assignment_after[OF assms(1) \<open>is_state_cover_assignment M1 V\<close> \<open>q' \<in> reachable_states M1\<close>]
[PROOF STATE]
proof (prove)
using this:
converge M1 (V q) (V q')
\<lbrakk>V q \<in> L M1; V q' \<in> L M1\<rbrakk> \<Longrightarrow> converge M1 (V q) (V q') = (q = q')

goal (1 subgoal):
 1. q = q'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
q = q'

goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<alpha> \<in> L M1 \<inter> TC; \<beta> \<in> L M1 \<inter> TC; converge M1 \<alpha> \<beta>\<rbrakk> \<Longrightarrow> converge M2 \<alpha> \<beta>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
q = q'
[PROOF STEP]
have "V q = V q'"
[PROOF STATE]
proof (prove)
using this:
q = q'

goal (1 subgoal):
 1. V q = V q'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
V q = V q'

goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<alpha> \<in> L M1 \<inter> TC; \<beta> \<in> L M1 \<inter> TC; converge M1 \<alpha> \<beta>\<rbrakk> \<Longrightarrow> converge M2 \<alpha> \<beta>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V q = V q'
[PROOF STEP]
show "converge M2 \<alpha> \<beta>"
[PROOF STATE]
proof (prove)
using this:
V q = V q'

goal (1 subgoal):
 1. converge M2 \<alpha> \<beta>
[PROOF STEP]
using \<open>converge M2 \<alpha> (V q)\<close> \<open>converge M2 \<beta> (V q')\<close>
[PROOF STATE]
proof (prove)
using this:
V q = V q'
converge M2 \<alpha> (V q)
converge M2 \<beta> (V q')

goal (1 subgoal):
 1. converge M2 \<alpha> \<beta>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M2 \<alpha> \<beta>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>?\<alpha> \<in> L M1 \<inter> TC; ?\<beta> \<in> L M1 \<inter> TC; converge M1 ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. preserves_convergence M1 M2 TC
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>?\<alpha> \<in> L M1 \<inter> TC; ?\<beta> \<in> L M1 \<inter> TC; converge M1 ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> converge M2 ?\<alpha> ?\<beta>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?\<alpha> \<in> L M1 \<inter> TC; ?\<beta> \<in> L M1 \<inter> TC; converge M1 ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. preserves_convergence M1 M2 TC
[PROOF STEP]
unfolding preserves_convergence.simps
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?\<alpha> \<in> L M1 \<inter> TC; ?\<beta> \<in> L M1 \<inter> TC; converge M1 ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. \<forall>\<alpha>\<in>L M1 \<inter> TC. \<forall>\<beta>\<in>L M1 \<inter> TC. converge M1 \<alpha> \<beta> \<longrightarrow> converge M2 \<alpha> \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
preserves_convergence M1 M2 TC

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
preserves_convergence M1 M2 TC

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
have "[] \<in> TC"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. [] \<in> TC
[PROOF STEP]
unfolding TC
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. [] \<in> Set.insert [] (\<Union> (\<Union> (TCfun ` (reachable_states M1 \<times> FSM.inputs M1 \<times> FSM.outputs M1))))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
[] \<in> TC

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
 2. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
show "((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS)) \<Longrightarrow> L M1 = L M2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
[PROOF STEP]
using initialised_convergence_preserving_transition_cover_is_complete[OF assms(1-4,7,8)
                                                                             \<open>((L M1 \<inter> set ?TS) = (L M2 \<inter> set ?TS)) \<Longrightarrow> L M1 \<inter> set T3 = L M2 \<inter> set T3\<close>
                                                                             TC_in_T3
                                                                             TC_is_transition_cover
                                                                             \<open>[] \<in> TC\<close>
                                                                             TC_preserves_convergence]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m); L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)\<rbrakk> \<Longrightarrow> L M1 = L M2

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2
[PROOF STEP]
by assumption
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) = L M2 \<inter> Prefix_Tree.set (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m) \<Longrightarrow> L M1 = L M2

goal (1 subgoal):
 1. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
show "finite_tree ?TS"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
using T2 T2_finite T3 verify_undefined_io_pair_folding_retains_finiteness
[PROOF STATE]
proof (prove)
using this:
T2 = fst TG2
finite_tree T2
T3 = foldl verify_undefined_io_pair (fst TG2) undefined_io_pairs
finite_tree ?T \<Longrightarrow> finite_tree (foldl verify_undefined_io_pair ?T ?qxys)

goal (1 subgoal):
 1. finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)
[PROOF STEP]
by (simp add: \<open>?TS = T3\<close>)
[PROOF STATE]
proof (state)
this:
finite_tree (spy_framework M1 get_state_cover separate_state_cover sort_unverified_transitions establish_convergence append_io_pair cg_initial cg_insert cg_lookup cg_merge m)

goal:
No subgoals!
[PROOF STEP]
qed