Proof step 1 from proof imfiniobackwardinv-implies-leqrefine-aux (conclusion) (back to tree)

imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV) ⊦ C_≤T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext))

System applied rule normalize

And obtained the following new goals

Proof step 2:
imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ C_≤T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)) ⊦

Rule argument

Additional information

Proof step 2 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ C_≤T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 3:
⊦ C_≤T_A(cioaut, aioaut) ↔ (∀ β. trace(cioaut)(β) → trace(aioaut)(β))
Proof step 4:
imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ∃ β. ¬(trace(IOAut(cstart, cstep, cext))(β) → trace(IOAut(astart, astep, aext))(β)) ⊦

Rule argument

spec: IOrefine-def, name: leq-def, seq: ⊦ C_≤T_A(cioaut, aioaut) ↔ (∀ β. trace(cioaut)(β) → trace(aioaut)(β)), subst:[cioaut, aioaut] → [IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)]; ['ca, 'cs, 'aa, 'as, 'e] → ['ca, 'cs, 'aa, 'as, 'e], <all paths>

Additional information

Used terms: IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)

Proof step 3 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ C_≤T_A(cioaut, aioaut) ↔ (∀ β. trace(cioaut)(β) → trace(aioaut)(β))

A spec-lemma

Proof step 4 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ∃ β. ¬(trace(IOAut(cstart, cstep, cext))(β) → trace(IOAut(astart, astep, aext))(β)) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 5:
imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), trace(IOAut(cstart, cstep, cext))(β), ¬ trace(IOAut(astart, astep, aext))(β) ⊦

Rule argument

Additional information

Proof step 5 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), trace(IOAut(cstart, cstep, cext))(β), ¬ trace(IOAut(astart, astep, aext))(β) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 6:
⊦ trace(IOAut(start, step, ext))(β) ↔ (∃ σ, α. β = ext !(α) ∧ exec(IOAut(start, step, ext))(σ, α))
Proof step 7:
imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace(IOAut(astart, astep, aext))(β), ∃ σ, α. β = cext !(α) ∧ exec(IOAut(cstart, cstep, cext))(σ, α) ⊦

Rule argument

spec: IOtrace, name: trace, seq:⊦ trace(IOAut(start, step, ext))(β) ↔ (∃ σ, α. β = ext !(α) ∧ exec(IOAut(start, step, ext))(σ, α)), subst:[start, step, ext, β] → [cstart, cstep, cext, β]; ['e, 's, 'a] → ['e, 'cs, 'ca], <all paths>

Additional information

Used terms: cstart, cstep, cext, β

Proof step 6 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ trace(IOAut(start, step, ext))(β) ↔ (∃ σ, α. β = ext !(α) ∧ exec(IOAut(start, step, ext))(σ, α))

A spec-lemma

Proof step 7 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace(IOAut(astart, astep, aext))(β), ∃ σ, α. β = cext !(α) ∧ exec(IOAut(cstart, cstep, cext))(σ, α) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 8:
cstart(cσ[0]), frag(IOAut(cstart, cstep, cext))(cσ, α), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace(IOAut(astart, astep, aext))(cext !(α)) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ IOAut(start, step, ext).start = start; (s) ⊦ exec(ioa)(σ, α) ↔ frag(ioa)(σ, α) ∧ ioa.start(σ[0]); (s)

Proof step 8 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

cstart(cσ[0]), frag(IOAut(cstart, cstep, cext))(cσ, α), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace(IOAut(astart, astep, aext))(cext !(α)) ⊦

User applied rule constructor cut

And obtained the following new goals

Proof step 9:
cσ = ⌜csl⌝ , cstart(cσ[0]), frag(IOAut(cstart, cstep, cext))(cσ, α), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace(IOAut(astart, astep, aext))(cext !(α)) ⊦
Proof step 26:
cσ = ⌜csf⌝ , cstart(cσ[0]), frag(IOAut(cstart, cstep, cext))(cσ, α), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace(IOAut(astart, astep, aext))(cext !(α)) ⊦

Rule argument

var: cσ

Additional information

Used simplifier rules: Stream('a) freely generated by ⌜ ⌝, ⌜ ⌝;;

Proof step 9 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

cσ = ⌜csl⌝ , cstart(cσ[0]), frag(IOAut(cstart, cstep, cext))(cσ, α), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace(IOAut(astart, astep, aext))(cext !(α)) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 10:
cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace*(IOAut(astart, astep, aext))(cext !(cal)) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ trace(ioa)(⌜el⌝ ) ↔ trace*(ioa)(el); (s) ⊦ ext !(⌜al⌝ ) = ⌜ext !(al)⌝ ; (s) ⊦ ⌜x⌝ .l = x; (s) ⊦ finp(σ) ↔ (∃ x. ⌜x⌝ = σ); (as) ⊦ ⌜x⌝ [n] = x[n]; (s) ⊦ frag(ioa)(⌜sl⌝ , α) ↔ frag*(ioa)(sl, α.l) ∧ finp(α); (s)

Proof step 10 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace*(IOAut(astart, astep, aext))(cext !(cal)) ⊦

User applied rule apply lemma

And obtained the following new goals

Proof step 11:
≤BI(cioaut, aioaut) ⊦ C_≤*T_A(cioaut, aioaut)
Proof step 12:
cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace*(IOAut(astart, astep, aext))(cext !(cal)), ¬ ≤BI(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)) ⊦
Proof step 17:
C_≤*T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace*(IOAut(astart, astep, aext))(cext !(cal)) ⊦

Rule argument

spec: <toplevel>, name:bwinv-leqstar, seq:≤BI(cioaut, aioaut) ⊦ C_≤*T_A(cioaut, aioaut), subst:[cioaut, aioaut] → [IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)]; ['ca, 'cs, 'aa, 'as, 'e] → ['ca, 'cs, 'aa, 'as, 'e]

Additional information

Used terms: IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)

Proof step 11 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

≤BI(cioaut, aioaut) ⊦ C_≤*T_A(cioaut, aioaut)

Lemma bwinv-leqstar

Proof step 12 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace*(IOAut(astart, astep, aext))(cext !(cal)), ¬ ≤BI(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 13:
⊦ ≤BI(cioaut, aioaut) ↔ (∃ t, aINV, cINV. bwsim(cioaut, aioaut, t, cINV, aINV))
Proof step 14:
cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace*(IOAut(astart, astep, aext))(cext !(cal)), ∀ t, aINV, cINV. ¬ bwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV) ⊦

Rule argument

spec: IOrefine-conds, name: backwardsiminv-def, seq: ⊦ ≤BI(cioaut, aioaut) ↔ (∃ t, aINV, cINV. bwsim(cioaut, aioaut, t, cINV, aINV)), subst:[cioaut, aioaut] → [IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)]; ['ca, 'cs, 'aa, 'as, 'e] → ['ca, 'cs, 'aa, 'as, 'e], <all paths>

Additional information

Used terms: IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)

Proof step 13 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ ≤BI(cioaut, aioaut) ↔ (∃ t, aINV, cINV. bwsim(cioaut, aioaut, t, cINV, aINV))

A spec-lemma

Proof step 14 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace*(IOAut(astart, astep, aext))(cext !(cal)), ∀ t, aINV, cINV. ¬ bwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV) ⊦

User applied rule all left

And obtained the following new goals

Proof step 15:
cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ bwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace*(IOAut(astart, astep, aext))(cext !(cal)) ⊦

Rule argument

pos: left 5 terms: t, aINV, cINV abort: F discard: T computed: F

Additional information

Used terms: t, aINV, cINV

Proof step 15 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ bwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace*(IOAut(astart, astep, aext))(cext !(cal)) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 16:
⊦ imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV) ↔ bwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass))

Rule argument

spec: IOrefine-conds, name: proofobls-imfinbackwardsim, seq:⊦ imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV) ↔ bwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)), subst:[cstep, astep, aext, t, cext, aINV, cINV, astart, cstart] → [cstep, astep, aext, t, cext, aINV, cINV, astart, cstart]; ['ca, 'cs, 'aa, 'as, 'e] → ['ca, 'cs, 'aa, 'as, 'e], <all paths>

Additional information

Used terms: cstep, cext, aext, t, astart, cstart, cINV, astep, aINV

Proof step 16 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV) ↔ bwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass))

A spec-lemma

Proof step 17 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

C_≤*T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace*(IOAut(astart, astep, aext))(cext !(cal)) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 18:
⊦ C_≤*T_A(cioaut, aioaut) ↔ (∀ el. trace*(cioaut)(el) → trace*(aioaut)(el))
Proof step 19:
cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace*(IOAut(astart, astep, aext))(cext !(cal)), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦

Rule argument

spec: IOrefine-def, name: leqstar-def, seq: ⊦ C_≤*T_A(cioaut, aioaut) ↔ (∀ el. trace*(cioaut)(el) → trace*(aioaut)(el)), subst:[cioaut, aioaut] → [IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)]; ['ca, 'cs, 'aa, 'as, 'e] → ['ca, 'cs, 'aa, 'as, 'e], <all paths>

Additional information

Used terms: IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)

Proof step 18 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ C_≤*T_A(cioaut, aioaut) ↔ (∀ el. trace*(cioaut)(el) → trace*(aioaut)(el))

A spec-lemma

Proof step 19 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace*(IOAut(astart, astep, aext))(cext !(cal)), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 20:
cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace*(IOAut(astart, astep, aext))(cext !(cal)), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦

Rule argument

Additional information

Proof step 20 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace*(IOAut(astart, astep, aext))(cext !(cal)), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦

User applied rule all left

And obtained the following new goals

Proof step 21:
cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace*(IOAut(astart, astep, aext))(cext !(cal)), trace*(IOAut(cstart, cstep, cext))(cext !(cal)) → trace*(IOAut(astart, astep, aext))(cext !(cal)) ⊦

Rule argument

pos: left 5 terms: cext !(cal) abort: F discard: T computed: T

Additional information

Used terms: cext !(cal)

Proof step 21 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace*(IOAut(astart, astep, aext))(cext !(cal)), trace*(IOAut(cstart, cstep, cext))(cext !(cal)) → trace*(IOAut(astart, astep, aext))(cext !(cal)) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 22:
cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace*(IOAut(astart, astep, aext))(cext !(cal)), ¬ trace*(IOAut(cstart, cstep, cext))(cext !(cal)) ⊦

Rule argument

Additional information

Proof step 22 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace*(IOAut(astart, astep, aext))(cext !(cal)), ¬ trace*(IOAut(cstart, cstep, cext))(cext !(cal)) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 23:
⊦ trace*(IOAut(start, step, ext))(el) ↔ (∃ sl, al. el = ext !(al) ∧ exec*(IOAut(start, step, ext))(sl, al))
Proof step 24:
cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace*(IOAut(astart, astep, aext))(cext !(cal)), ∀ sl, al. ¬(cext !(cal) = cext !(al) ∧ exec*(IOAut(cstart, cstep, cext))(sl, al)) ⊦

Rule argument

spec: IOtrace, name:fintrace, seq:⊦ trace*(IOAut(start, step, ext))(el) ↔ (∃ sl, al. el = ext !(al) ∧ exec*(IOAut(start, step, ext))(sl, al)), subst:[start, step, ext, el] → [cstart, cstep, cext, cext !(cal)]; ['e, 's, 'a] → ['e, 'cs, 'ca], <all paths>

Additional information

Used terms: cstart, cstep, cext, cext !(cal)

Proof step 23 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ trace*(IOAut(start, step, ext))(el) ↔ (∃ sl, al. el = ext !(al) ∧ exec*(IOAut(start, step, ext))(sl, al))

A spec-lemma

Proof step 24 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace*(IOAut(astart, astep, aext))(cext !(cal)), ∀ sl, al. ¬(cext !(cal) = cext !(al) ∧ exec*(IOAut(cstart, cstep, cext))(sl, al)) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 25:
cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace*(IOAut(astart, astep, aext))(cext !(cal)), ∀ sl, al. cext !(cal) ≠ cext !(al) ∨ ¬ frag*(IOAut(cstart, cstep, cext))(sl, al) ∨ ¬ cstart(sl[0]) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ IOAut(start, step, ext).start = start; (s) ⊦ exec*(ioa)(sl, al) ↔ frag*(ioa)(sl, al) ∧ ioa.start(sl[0]); (s)

Proof step 25 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace*(IOAut(astart, astep, aext))(cext !(cal)), ∀ sl, al. cext !(cal) ≠ cext !(al) ∨ ¬ frag*(IOAut(cstart, cstep, cext))(sl, al) ∨ ¬ cstart(sl[0]) ⊦

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

pos: left 5 terms: csl, cal

Additional information

Used terms: csl, cal

Proof step 26 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

cσ = ⌜csf⌝ , cstart(cσ[0]), frag(IOAut(cstart, cstep, cext))(cσ, α), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace(IOAut(astart, astep, aext))(cext !(α)) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 27:
cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ ⌜nf⌝ .f = nf; (s) ⊦ finp(σ) ↔ ¬(∃ nf. ⌜nf⌝ = σ); (ss) ⊦ ⌜nf⌝ [n] = nf(n); (s) ⊦ frag(ioa)(⌜sf⌝ , α) ↔ fragω(ioa)(sf, α.f) ∧ ¬ finp(α); (s)

Proof step 27 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 28:
⊦ imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV) ↔ bwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass))
Proof step 29:
bwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass) ⊦

Rule argument

spec: IOrefine-conds, name: proofobls-imfinbackwardsim, seq:⊦ imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV) ↔ bwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)), subst:[cstep, astep, aext, t, cext, aINV, cINV, astart, cstart] → [cstep, astep, aext, t, cext, aINV, cINV, astart, cstart]; ['ca, 'cs, 'aa, 'as, 'e] → ['ca, 'cs, 'aa, 'as, 'e], <all paths>

Additional information

Used terms: cstep, cext, aext, t, astart, cstart, cINV, astep, aINV

Proof step 28 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ imfinbwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV) ↔ bwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass))

A spec-lemma

Proof step 29 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

bwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 30:
⊦ bwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV) ↔ (∀ cs. cstart(cs) → cINV(cs)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)))
Proof step 31:
cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)) ⊦

Rule argument

spec: IOrefine-conds, name: proofobls-backwardsiminv, seq:⊦ bwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV) ↔ (∀ cs. cstart(cs) → cINV(cs)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as))), subst:[cstep, astep, aext, t, cext, aINV, cINV, astart, cstart] → [cstep, astep, aext, t, cext, aINV, cINV, astart, cstart]; ['ca, 'cs, 'aa, 'as, 'e] → ['ca, 'cs, 'aa, 'as, 'e], <all paths>

Additional information

Used terms: cstep, cext, aext, t, astart, cstart, cINV, astep, aINV

Proof step 30 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ bwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV) ↔ (∀ cs. cstart(cs) → cINV(cs)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)))

A spec-lemma

Proof step 31 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)) ⊦

User applied rule all left

And obtained the following new goals

Proof step 32:
cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cstart(csf(0)) → cINV(csf(0)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass) ⊦

Rule argument

pos: left 5 terms: csf(0) abort: F discard: T computed: T

Additional information

Used terms: csf(0)

Proof step 32 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cstart(csf(0)) → cINV(csf(0)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 33:
cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ ext !(a ') = (ext(a) = None ⊃ [];ext(a).get '); (s)

Proof step 33 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

User applied rule all left

And obtained the following new goals

Proof step 34:
cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(0)) → (∃ as. t(csf(0), as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)) ⊦

Rule argument

pos: left 10 terms: csf(0) abort: F discard: F computed: T

Additional information

Used terms: csf(0)

Proof step 34 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(0)) → (∃ as. t(csf(0), as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 35:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

Rule argument

Additional information

Proof step 35 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

User applied rule cut formula

And obtained the following new goals

Proof step 36:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦
Proof step 299:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)) ⊦ ∀ n. cINV(csf(n))

Rule argument

fma: ∀ n. cINV(csf(n))

Additional information

Used formulas: ∀ n. cINV(csf(n))

Proof step 36 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

User applied rule apply lemma

And obtained the following new goals

Proof step 37:
infgraph(g), finroot(g), finout(g), allreachable(g) ⊦ ∃ nf. isroot(g)(nf(0)) ∧ pathp(g)(⌜nf⌝ )
Proof step 38:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦ infgraph ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ∧ finroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ∧ finout ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ∧ allreachable ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1)))
Proof step 254:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∃ nf. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (nf(0)) ∧ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜nf⌝ ) ⊦

Rule argument

spec: Koenigs-Lemma-gen, name:KoenigsLemma, seq:infgraph(g), finroot(g), finout(g), allreachable(g) ⊦ ∃ nf. isroot(g)(nf(0)) ∧ pathp(g)(⌜nf⌝ ), subst:[g] → [ (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))]; ['a] → [('as, Nat)]

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))

Proof step 37 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

infgraph(g), finroot(g), finout(g), allreachable(g) ⊦ ∃ nf. isroot(g)(nf(0)) ∧ pathp(g)(⌜nf⌝ )

A spec-lemma

Proof step 38 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦ infgraph ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ∧ finroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ∧ finout ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ∧ allreachable ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1)))

User applied rule case distinction

And obtained the following new goals

Proof step 39:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ infgraph ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦
Proof step 67:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ finroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦
Proof step 117:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ finout ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦
Proof step 177:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ allreachable ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Rule argument

pos: right 1

Additional information

Proof step 39 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ infgraph ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 40:
⊦ infgraph(g) ↔ (∀ s. ∃ a. dom(g)(a) ∧ ¬ a ∈ s)
Proof step 41:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∃ s. ¬ (∃ a. dom ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ ¬ a ∈ s) ⊦

Rule argument

spec: Koenigs-Lemma-gen, name: infgraph-def, seq: ⊦ infgraph(g) ↔ (∀ s. ∃ a. dom(g)(a) ∧ ¬ a ∈ s), subst:[g] → [ (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))]; ['a] → [('as, Nat)], <all paths>

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))

Proof step 40 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ infgraph(g) ↔ (∀ s. ∃ a. dom(g)(a) ∧ ¬ a ∈ s)

A spec-lemma

Proof step 41 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∃ s. ¬ (∃ a. dom ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ ¬ a ∈ s) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 42:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

Rule argument

Additional information

Used simplifier rules: ⊦ dom(vs × es) = vs; (s) ⊦ ext !(a ') = (ext(a) = None ⊃ [];ext(a).get '); (s)

Proof step 42 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

User applied rule cut formula

And obtained the following new goals

Proof step 43:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∃ n. ∀ asn. asn ∈ asn-s → asn._2 < n ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s
Proof step 51:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s, ∃ n. ∀ asn. asn ∈ asn-s → asn._2 < n

Rule argument

fma: ∃ n. ∀ asn. asn ∈ asn-s → asn._2 < n

Additional information

Used formulas: ∃ n. ∀ asn. asn ∈ asn-s → asn._2 < n

Proof step 43 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∃ n. ∀ asn. asn ∈ asn-s → asn._2 < n ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 44:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ asn. asn ∈ asn-s → asn._2 < n, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

Rule argument

Additional information

Proof step 44 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ asn. asn ∈ asn-s → asn._2 < n, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

User applied rule all left

And obtained the following new goals

Proof step 45:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(n + 1)) → (∃ as. t(csf(n + 1), as) ∧ aINV(as)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 < n ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

Rule argument

pos: left 9 terms: csf(n + 1) abort: F discard: T computed: F

Additional information

Used terms: csf(n + 1)

Proof step 45 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(n + 1)) → (∃ as. t(csf(n + 1), as) ∧ aINV(as)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 < n ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 46:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(n + 1)) → t(csf(n + 1), as0) ∧ aINV(as0), ∀ asn. asn ∈ asn-s → asn._2 < n, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

Rule argument

Additional information

Proof step 46 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(n + 1)) → t(csf(n + 1), as0) ∧ aINV(as0), ∀ asn. asn ∈ asn-s → asn._2 < n, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

User applied rule case distinction

And obtained the following new goals

Proof step 47:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ cINV(csf(n + 1)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 < n ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s
Proof step 48:
aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 < n ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

Rule argument

pos: left 7

Additional information

Proof step 47 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ cINV(csf(n + 1)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 < n ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

pos: left 8 terms: n + 1

Additional information

Used terms: n + 1

Proof step 48 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 < n ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

User applied rule exists right

And obtained the following new goals

Proof step 49:
aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n + 1), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ asn. asn ∈ asn-s → asn._2 < n, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ t(csf((as0, n + 1)._2), (as0, n + 1)._1) ∧ aINV((as0, n + 1)._1) ∧ ¬ (as0, n + 1) ∈ asn-s

Rule argument

pos: right 1 terms: (as0, n + 1) abort: F discard: T computed: F

Additional information

Used terms: (as0, n + 1)

Proof step 49 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n + 1), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ asn. asn ∈ asn-s → asn._2 < n, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ t(csf((as0, n + 1)._2), (as0, n + 1)._1) ∧ aINV((as0, n + 1)._1) ∧ ¬ (as0, n + 1) ∈ asn-s

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 50:
# asn-s ≠ 0, asn-s ≠ ∅, aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n + 1), as0), t(csf(0), as), (as0, n + 1) ∈ asn-s, ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ asn. asn ∈ asn-s → asn._2 < n, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Rule argument

Additional information

Used simplifier rules: size-zero-01: ⊦ s ≠ ∅ → # s ≠ 0; (forward) from specification set-basic ne-01: ⊦ a ∈ s → s ≠ ∅; (forward) from specification set-basic

Proof step 50 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

# asn-s ≠ 0, asn-s ≠ ∅, aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n + 1), as0), t(csf(0), as), (as0, n + 1) ∈ asn-s, ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ asn. asn ∈ asn-s → asn._2 < n, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

pos: left 12 terms: (as0, n + 1)

Additional information

Used simplifier rules: ⊦ ¬ m + n < m; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic Used terms: (as0, n + 1)

Proof step 51 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s, ∃ n. ∀ asn. asn ∈ asn-s → asn._2 < n

User applied rule weakening

And obtained the following new goals

Proof step 52:
⊦ ∃ n. ∀ asn. asn ∈ asn-s → asn._2 < n

Rule argument

poslist: left 1, left 2, left 3, left 4, left 5, left 6, left 7, left 8, left 9, left 10, left 11, left 12, left 13, left 14, right 1

Additional information

Proof step 52 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ ∃ n. ∀ asn. asn ∈ asn-s → asn._2 < n

User applied rule structural induction

And obtained the following new goals

Proof step 53:
∃ n. ∀ asn. asn ∈ asn-s0 → asn._2 < n ⊦ ∃ n. ∀ asn0. asn0 ∈ asn-s0 ++ asn → asn0._2 < n

Rule argument

term: asn-s

Additional information

Used simplifier rules: Set('a) generated by ∅, ++;; ⊦ ¬ a ∈ ∅; (s)

Proof step 53 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

∃ n. ∀ asn. asn ∈ asn-s0 → asn._2 < n ⊦ ∃ n. ∀ asn0. asn0 ∈ asn-s0 ++ asn → asn0._2 < n

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 54:
∀ asn. asn ∈ asn-s0 → asn._2 < n ⊦ ∃ n0. ∀ asn0. asn0 = asn ∨ asn0 ∈ asn-s0 → asn0._2 < n0

Rule argument

Additional information

Used simplifier rules: ⊦ a ∈ s ++ b ↔ a = b ∨ a ∈ s; (s)

Proof step 54 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

∀ asn. asn ∈ asn-s0 → asn._2 < n ⊦ ∃ n0. ∀ asn0. asn0 = asn ∨ asn0 ∈ asn-s0 → asn0._2 < n0

User applied rule exists right

And obtained the following new goals

Proof step 55:
∀ asn. asn ∈ asn-s0 → asn._2 < n ⊦ ∀ asn0. asn0 = asn ∨ asn0 ∈ asn-s0 → asn0._2 < n, ∃ n0. ∀ asn0. asn0 = asn ∨ asn0 ∈ asn-s0 → asn0._2 < n0

Rule argument

pos: right 1 terms: n abort: F discard: F computed: T

Additional information

Used terms: n

Proof step 55 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

∀ asn. asn ∈ asn-s0 → asn._2 < n ⊦ ∀ asn0. asn0 = asn ∨ asn0 ∈ asn-s0 → asn0._2 < n, ∃ n0. ∀ asn0. asn0 = asn ∨ asn0 ∈ asn-s0 → asn0._2 < n0

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 56:
n ≤ asn0._2, ∀ asn. asn ∈ asn-s0 → asn._2 < n, asn0 = asn ∨ asn0 ∈ asn-s0 ⊦ ∃ n0. ∀ asn0. asn0 = asn ∨ asn0 ∈ asn-s0 → asn0._2 < n0

Rule argument

Additional information

Used simplifier rules: ⊦ m < n ↔ ¬ n ≤ m; (ss)

Proof step 56 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

n ≤ asn0._2, ∀ asn. asn ∈ asn-s0 → asn._2 < n, asn0 = asn ∨ asn0 ∈ asn-s0 ⊦ ∃ n0. ∀ asn0. asn0 = asn ∨ asn0 ∈ asn-s0 → asn0._2 < n0

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 57:
asn0 = (as, n0), n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, asn0 = asn ∨ asn0 ∈ asn-s0 ⊦ ∃ n0. ∀ asn0. asn0 = asn ∨ asn0 ∈ asn-s0 → asn0._2 < n0

Rule argument

term: asn0._2

Additional information

Used terms: as, n0

Proof step 57 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asn0 = (as, n0), n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, asn0 = asn ∨ asn0 ∈ asn-s0 ⊦ ∃ n0. ∀ asn0. asn0 = asn ∨ asn0 ∈ asn-s0 → asn0._2 < n0

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 58:
n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, (as, n0) = asn ∨ (as, n0) ∈ asn-s0 ⊦ ∃ n0. ∀ asn0. asn0 = asn ∨ asn0 ∈ asn-s0 → asn0._2 < n0

Rule argument

Additional information

Proof step 58 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, (as, n0) = asn ∨ (as, n0) ∈ asn-s0 ⊦ ∃ n0. ∀ asn0. asn0 = asn ∨ asn0 ∈ asn-s0 → asn0._2 < n0

User applied rule exists right

And obtained the following new goals

Proof step 59:
n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, (as, n0) = asn ∨ (as, n0) ∈ asn-s0 ⊦ ∀ asn0. asn0 = asn ∨ asn0 ∈ asn-s0 → asn0._2 < n0 + 1

Rule argument

pos: right 1 terms: n0 + 1 abort: F discard: T computed: F

Additional information

Used terms: n0 + 1

Proof step 59 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, (as, n0) = asn ∨ (as, n0) ∈ asn-s0 ⊦ ∀ asn0. asn0 = asn ∨ asn0 ∈ asn-s0 → asn0._2 < n0 + 1

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 60:
n < asn0._2, n0 < asn0._2, n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, (as, n0) = asn ∨ (as, n0) ∈ asn-s0, asn0 = asn ∨ asn0 ∈ asn-s0 ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ m < n → n ≠ 0; (s) fle-01: ⊦ m ≤ n ∧ n < n0 → m < n0; (forward) from specification nat f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m < n + 1 ↔ ¬ n < m; (s)

Proof step 60 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

n < asn0._2, n0 < asn0._2, n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, (as, n0) = asn ∨ (as, n0) ∈ asn-s0, asn0 = asn ∨ asn0 ∈ asn-s0 ⊦

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 61:
asn0 = (as0, n1), n0 < n1, n < n1, n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, asn0 = asn ∨ asn0 ∈ asn-s0, (as, n0) = asn ∨ (as, n0) ∈ asn-s0 ⊦

Rule argument

term: asn0._2

Additional information

Used terms: as0, n1

Proof step 61 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asn0 = (as0, n1), n0 < n1, n < n1, n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, asn0 = asn ∨ asn0 ∈ asn-s0, (as, n0) = asn ∨ (as, n0) ∈ asn-s0 ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 62:
n < n1, n0 < n1, n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, (as0, n1) = asn ∨ (as0, n1) ∈ asn-s0, (as, n0) = asn ∨ (as, n0) ∈ asn-s0 ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ m < n → n ≠ 0; (s) fle-01: ⊦ m ≤ n ∧ n < n0 → m < n0; (forward) from specification nat f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic

Proof step 62 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

n < n1, n0 < n1, n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, (as0, n1) = asn ∨ (as0, n1) ∈ asn-s0, (as, n0) = asn ∨ (as, n0) ∈ asn-s0 ⊦

User applied rule case distinction

And obtained the following new goals

Proof step 63:
(as0, n1) = asn, n0 < n1, n < n1, n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, (as, n0) = asn ∨ (as, n0) ∈ asn-s0 ⊦
Proof step 65:
n0 < n1, n < n1, (as0, n1) ∈ asn-s0, n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, (as, n0) = asn ∨ (as, n0) ∈ asn-s0 ⊦

Rule argument

pos: left 5

Additional information

Proof step 63 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as0, n1) = asn, n0 < n1, n < n1, n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, (as, n0) = asn ∨ (as, n0) ∈ asn-s0 ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 64:
# asn-s0 ≠ 0, (as, n0) ≠ (as0, n1), asn-s0 ≠ ∅, n < n1, n0 < n1, (as, n0) ∈ asn-s0, n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n ⊦

Rule argument

Additional information

Used simplifier rules: size-zero-01: ⊦ s ≠ ∅ → # s ≠ 0; (forward) from specification set-basic ne-01: ⊦ a ∈ s → s ≠ ∅; (forward) from specification set-basic ⊦ ¬ n < n; (s) lf-01: ⊦ m < n ∧ n = n0 → m < n0; (forward) from specification nat-basic lf-02: ⊦ m < n ∧ m = n0 → n0 < n; (forward) from specification nat-basic

Proof step 64 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

# asn-s0 ≠ 0, (as, n0) ≠ (as0, n1), asn-s0 ≠ ∅, n < n1, n0 < n1, (as, n0) ∈ asn-s0, n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n ⊦

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

pos: left 8 terms: (as, n0)

Additional information

Used simplifier rules: ⊦ m ≤ n → (n < m ↔ false); (s) Used terms: (as, n0)

Proof step 65 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

n0 < n1, n < n1, (as0, n1) ∈ asn-s0, n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, (as, n0) = asn ∨ (as, n0) ∈ asn-s0 ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 66:
# asn-s0 ≠ 0, asn-s0 ≠ ∅, n0 < n1, n < n1, (as0, n1) ∈ asn-s0, n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, (as, n0) = asn ∨ (as, n0) ∈ asn-s0 ⊦

Rule argument

Additional information

Used simplifier rules: size-zero-01: ⊦ s ≠ ∅ → # s ≠ 0; (forward) from specification set-basic ne-01: ⊦ a ∈ s → s ≠ ∅; (forward) from specification set-basic

Proof step 66 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

# asn-s0 ≠ 0, asn-s0 ≠ ∅, n0 < n1, n < n1, (as0, n1) ∈ asn-s0, n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, (as, n0) = asn ∨ (as, n0) ∈ asn-s0 ⊦

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

pos: left 7 terms: (as0, n1)

Additional information

Used simplifier rules: ⊦ m < n → ¬ n < m; (s) Used terms: (as0, n1)

Proof step 67 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ finroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 68:
⊦ finroot(g) ↔ (∃ s. ∀ a. isroot(g)(a) ↔ a ∈ s)
Proof step 69:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ s. ¬ (∀ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ↔ a ∈ s) ⊦

Rule argument

spec: Koenigs-Lemma-gen, name: finroot-def, seq: ⊦ finroot(g) ↔ (∃ s. ∀ a. isroot(g)(a) ↔ a ∈ s), subst:[g] → [ (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))]; ['a] → [('as, Nat)], <all paths>

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))

Proof step 68 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ finroot(g) ↔ (∃ s. ∀ a. isroot(g)(a) ↔ a ∈ s)

A spec-lemma

Proof step 69 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ s. ¬ (∀ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ↔ a ∈ s) ⊦

User applied rule cut formula

And obtained the following new goals

Proof step 70:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ s. ¬ (∀ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ↔ a ∈ s), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ ass. ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0) ⊦
Proof step 103:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ s. ¬ (∀ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ↔ a ∈ s), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∀ ass. ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0)

Rule argument

fma: ∀ ass. ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0)

Additional information

Used formulas: ∀ ass. ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0)

Proof step 70 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ s. ¬ (∀ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ↔ a ∈ s), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ ass. ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0) ⊦

User applied rule all left

And obtained the following new goals

Proof step 71:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(0)) → (∃ ass. ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass), ∀ ass. ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ s. ¬ (∀ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ↔ a ∈ s) ⊦

Rule argument

pos: left 13 terms: csf(0) abort: F discard: T computed: T

Additional information

Used terms: csf(0)

Proof step 71 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(0)) → (∃ ass. ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass), ∀ ass. ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ s. ¬ (∀ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ↔ a ∈ s) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 72:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ ass. ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0), ∀ s. ¬ (∀ asn. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn) ↔ asn ∈ s), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ ext !(a ') = (ext(a) = None ⊃ [];ext(a).get '); (s)

Proof step 72 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ ass. ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0), ∀ s. ¬ (∀ asn. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn) ↔ asn ∈ s), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦

User applied rule all left

And obtained the following new goals

Proof step 73:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ s. ¬ (∀ asn. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn) ↔ asn ∈ s), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0) ⊦

Rule argument

pos: left 14 terms: ass abort: F discard: T computed: T

Additional information

Used terms: ass

Proof step 73 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ s. ¬ (∀ asn. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn) ↔ asn ∈ s), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 74:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ s. ¬ (∀ asn. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn) ↔ asn ∈ s), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦

Rule argument

Additional information

Proof step 74 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ s. ¬ (∀ asn. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn) ↔ asn ∈ s), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦

User applied rule all left

And obtained the following new goals

Proof step 75:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s ⊦ ∀ asn. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn) ↔ asn ∈ asn-s

Rule argument

pos: left 16 terms: asn-s abort: F discard: T computed: T

Additional information

Used terms: asn-s

Proof step 75 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s ⊦ ∀ asn. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn) ↔ asn ∈ asn-s

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 76:
¬ ( isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn) ↔ asn ∈ asn-s), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦

Rule argument

Additional information

Proof step 76 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

¬ ( isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn) ↔ asn ∈ asn-s), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 77:
⊦ isroot(g)(b) ↔ dom(g)(b) ∧ (∀ a. ¬ edge(g)(a, b))
Proof step 78:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s ⊦ dom ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, asn)) ↔ asn ∈ asn-s

Rule argument

spec: infgraph-gen, name: isroot-def, seq: ⊦ isroot(g)(b) ↔ dom(g)(b) ∧ (∀ a. ¬ edge(g)(a, b)), subst:[g, b] → [ (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1)), asn]; ['a] → [('as, Nat)], <all paths>

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1)), asn

Proof step 77 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ isroot(g)(b) ↔ dom(g)(b) ∧ (∀ a. ¬ edge(g)(a, b))

A spec-lemma

Proof step 78 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s ⊦ dom ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, asn)) ↔ asn ∈ asn-s

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 79:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦ t(csf(asn._2), asn._1) ∧ aINV(asn._1) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, asn)) ↔ asn ∈ asn-s

Rule argument

Additional information

Used simplifier rules: ⊦ dom(vs × es) = vs; (s)

Proof step 79 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦ t(csf(asn._2), asn._1) ∧ aINV(asn._1) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, asn)) ↔ asn ∈ asn-s

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 80:
asn = (as0, n), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s ⊦ t(csf(n), as0) ∧ aINV(as0) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, asn)) ↔ asn ∈ asn-s

Rule argument

term: asn._2

Additional information

Used terms: as0, n

Proof step 80 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asn = (as0, n), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s ⊦ t(csf(n), as0) ∧ aINV(as0) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, asn)) ↔ asn ∈ asn-s

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 81:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦ t(csf(n), as0) ∧ aINV(as0) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n))) ↔ (as0, n) ∈ asn-s

Rule argument

Additional information

Proof step 81 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦ t(csf(n), as0) ∧ aINV(as0) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n))) ↔ (as0, n) ∈ asn-s

User applied rule case distinction

And obtained the following new goals

Proof step 82:
aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n) ∈ asn-s, ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)) ⊦
Proof step 97:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), (as0, n) ∈ asn-s, ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s ⊦ t(csf(n), as0) ∧ aINV(as0) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)))

Rule argument

pos: right 1

Additional information

Proof step 82 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n) ∈ asn-s, ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)) ⊦

User applied rule cut formula

And obtained the following new goals

Proof step 83:
n = 0, aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n) ∈ asn-s, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)), ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦
Proof step 87:
n ≠ 0, aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n) ∈ asn-s, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)), ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦

Rule argument

fma: n = 0

Additional information

Used formulas: n = 0

Proof step 83 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

n = 0, aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n) ∈ asn-s, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)), ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 84:
aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, 0) ∈ asn-s, ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)) ⊦

Rule argument

Additional information

Proof step 84 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, 0) ∈ asn-s, ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)) ⊦

User applied rule all left

And obtained the following new goals

Proof step 85:
as0 ∈ ass ↔ (as0, 0) ∈ asn-s, aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, 0) ∈ asn-s, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦

Rule argument

pos: left 19 terms: as0 abort: F discard: T computed: T

Additional information

Used terms: as0

Proof step 85 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

as0 ∈ ass ↔ (as0, 0) ∈ asn-s, aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, 0) ∈ asn-s, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 86:
aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, 0) ∈ asn-s, ¬ as0 ∈ ass, ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)) ⊦

Rule argument

Additional information

Proof step 86 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, 0) ∈ asn-s, ¬ as0 ∈ ass, ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)) ⊦

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

pos: left 11 terms: as0

Additional information

Used terms: as0

Proof step 87 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

n ≠ 0, aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n) ∈ asn-s, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)), ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦

User applied rule all left

And obtained the following new goals

Proof step 88:
n ≠ 0, aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n) ∈ asn-s, cINV(csf(n - 1)) ∧ cstep(csf(n - 1), caf(n - 1), csf(n)) ∧ t(csf(n), as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(caf(n - 1)) = None ⊃ [];cext(caf(n - 1)).get '), as0) ∧ t(csf(n - 1), as)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)) ⊦

Rule argument

pos: left 19 terms: csf(n - 1), caf(n - 1), csf(n), as0 abort: F discard: T computed: F

Additional information

Used terms: csf(n - 1), caf(n - 1), csf(n), as0

Proof step 88 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

n ≠ 0, aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n) ∈ asn-s, cINV(csf(n - 1)) ∧ cstep(csf(n - 1), caf(n - 1), csf(n)) ∧ t(csf(n), as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(caf(n - 1)) = None ⊃ [];cext(caf(n - 1)).get '), as0) ∧ t(csf(n - 1), as)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 89:
n ≠ 0, aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n) ∈ asn-s, cINV(csf(n - 1)) ∧ cstep(csf(n - 1), caf(n - 1), csf(n)) → aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n - 1)) = None ⊃ [];cext(caf(n - 1)).get '), as0) ∧ t(csf(n - 1), as1), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)), ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ n. cINV(csf(n)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦

Rule argument

Additional information

Proof step 89 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

n ≠ 0, aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n) ∈ asn-s, cINV(csf(n - 1)) ∧ cstep(csf(n - 1), caf(n - 1), csf(n)) → aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n - 1)) = None ⊃ [];cext(caf(n - 1)).get '), as0) ∧ t(csf(n - 1), as1), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)), ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ n. cINV(csf(n)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 90:
n = n0 + 1, n ≠ 0, aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n) ∈ asn-s, cINV(csf(n0)) ∧ cstep(csf(n0), caf(n0), csf(n)) → aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ∧ t(csf(n0), as1), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)) ⊦

Rule argument

spec: nat, name:elim-pred-c, seq:n ≠ 0 ⊦ m = n - 1 ↔ n = m + 1, subst:[n, m] → [n, n0]

Additional information

Used simplifier rules: n ≠ 0 ⊦ m = n - 1 ↔ n = m + 1; (elim) Used terms: n, n0

Proof step 90 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

n = n0 + 1, n ≠ 0, aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n) ∈ asn-s, cINV(csf(n0)) ∧ cstep(csf(n0), caf(n0), csf(n)) → aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ∧ t(csf(n0), as1), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 91:
aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 + 1), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n0 + 1) ∈ asn-s, cINV(csf(n0)) ∧ cstep(csf(n0), caf(n0), csf(n0 + 1)) → aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ∧ t(csf(n0), as1), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n0 + 1)), ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ n. cINV(csf(n)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m + 1 ≠ 0; (s)

Proof step 91 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 + 1), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n0 + 1) ∈ asn-s, cINV(csf(n0)) ∧ cstep(csf(n0), caf(n0), csf(n0 + 1)) → aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ∧ t(csf(n0), as1), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n0 + 1)), ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ n. cINV(csf(n)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦

User applied rule case distinction

And obtained the following new goals

Proof step 92:
aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n0 + 1) ∈ asn-s, ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n0 + 1)) ⊦ cINV(csf(n0)) ∧ cstep(csf(n0), caf(n0), csf(n0 + 1))
Proof step 94:
aINV(as), aINV(as0), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(0), as), t(csf(n0 + 1), as0), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n0 + 1) ∈ asn-s, ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n0 + 1)) ⊦

Rule argument

pos: left 10

Additional information

Proof step 92 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n0 + 1) ∈ asn-s, ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n0 + 1)) ⊦ cINV(csf(n0)) ∧ cstep(csf(n0), caf(n0), csf(n0 + 1))

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 93:
aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n0 + 1), as0), ¬ cINV(csf(n0)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n0 + 1) ∈ asn-s, ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n0 + 1)) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ ¬ step(sf(n), af(n), sf(n + 1)) → (fragω(IOAut(start, step, ext))(sf, af) ↔ false); (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic

Proof step 93 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n0 + 1), as0), ¬ cINV(csf(n0)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n0 + 1) ∈ asn-s, ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n0 + 1)) ⊦

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

pos: left 13 terms: n0

Additional information

Used terms: n0

Proof step 94 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), aINV(as0), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(0), as), t(csf(n0 + 1), as0), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n0 + 1) ∈ asn-s, ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n0 + 1)) ⊦

User applied rule all left

And obtained the following new goals

Proof step 95:
aINV(as1), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(n0 + 1), as0), t(csf(0), as), ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), (as0, n0 + 1)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n0 + 1) ∈ asn-s, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ n. cINV(csf(n)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦

Rule argument

pos: left 22 terms: (as1, n0) abort: F discard: T computed: F

Additional information

Used terms: (as1, n0)

Proof step 95 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as1), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(n0 + 1), as0), t(csf(0), as), ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), (as0, n0 + 1)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n0 + 1) ∈ asn-s, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ n. cINV(csf(n)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 96:
⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b)

Rule argument

spec: infgraph-gen-basic, name: edge-def, seq: ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b), subst:[vs, es, a, b] → [λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1), λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1), (as1, n0), (as0, n0 + 1)]; ['a] → [('as, Nat)], <all paths>

Additional information

Used simplifier rules: ⊦ m + n = m + n0 ↔ n = n0; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic Used terms: λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1), λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1), (as1, n0), (as0, n0 + 1)

Proof step 96 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b)

A spec-lemma

Proof step 97 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), (as0, n) ∈ asn-s, ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s ⊦ t(csf(n), as0) ∧ aINV(as0) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)))

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 98:
# asn-s ≠ 0, asn-s ≠ ∅, aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), (as0, n) ∈ asn-s, ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s ⊦ t(csf(n), as0) ∧ aINV(as0) ∧ ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn, (as0, n))

Rule argument

Additional information

Used simplifier rules: size-zero-01: ⊦ s ≠ ∅ → # s ≠ 0; (forward) from specification set-basic ne-01: ⊦ a ∈ s → s ≠ ∅; (forward) from specification set-basic

Proof step 98 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

# asn-s ≠ 0, asn-s ≠ ∅, aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), (as0, n) ∈ asn-s, ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s ⊦ t(csf(n), as0) ∧ aINV(as0) ∧ ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn, (as0, n))

User applied rule all left

And obtained the following new goals

Proof step 99:
# asn-s ≠ 0, asn-s ≠ ∅, aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), (as0, n) ∈ asn-s, ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), (as0, n) ∈ asn-s → (as0, n)._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦ t(csf(n), as0) ∧ aINV(as0) ∧ ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn, (as0, n))

Rule argument

pos: left 18 terms: (as0, n) abort: F discard: T computed: T

Additional information

Used terms: (as0, n)

Proof step 99 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

# asn-s ≠ 0, asn-s ≠ ∅, aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), (as0, n) ∈ asn-s, ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), (as0, n) ∈ asn-s → (as0, n)._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦ t(csf(n), as0) ∧ aINV(as0) ∧ ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn, (as0, n))

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 100:
# asn-s ≠ 0, asn-s ≠ ∅, aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), (as0, 0) ∈ asn-s, ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn, (as0, 0)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦ aINV(as0) ∧ t(csf(0), as0)

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m + 1 ≠ 0; (s) ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b); (ws)

Proof step 100 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

# asn-s ≠ 0, asn-s ≠ ∅, aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), (as0, 0) ∈ asn-s, ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn, (as0, 0)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦ aINV(as0) ∧ t(csf(0), as0)

User applied rule all left

And obtained the following new goals

Proof step 101:
as0 ∈ ass ↔ (as0, 0) ∈ asn-s, # asn-s ≠ 0, asn-s ≠ ∅, aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), (as0, 0) ∈ asn-s, ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn, (as0, 0)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦ aINV(as0) ∧ t(csf(0), as0)

Rule argument

pos: left 11 terms: as0 abort: F discard: T computed: T

Additional information

Used terms: as0

Proof step 101 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

as0 ∈ ass ↔ (as0, 0) ∈ asn-s, # asn-s ≠ 0, asn-s ≠ ∅, aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), (as0, 0) ∈ asn-s, ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn, (as0, 0)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦ aINV(as0) ∧ t(csf(0), as0)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 102:
# asn-s ≠ 0, # ass ≠ 0, asn-s ≠ ∅, ass ≠ ∅, aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), as0 ∈ ass, (as0, 0) ∈ asn-s, ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn, (as0, 0)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦ aINV(as0) ∧ t(csf(0), as0)

Rule argument

Additional information

Used simplifier rules: size-zero-01: ⊦ s ≠ ∅ → # s ≠ 0; (forward) from specification set-basic ne-01: ⊦ a ∈ s → s ≠ ∅; (forward) from specification set-basic

Proof step 102 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

# asn-s ≠ 0, # ass ≠ 0, asn-s ≠ ∅, ass ≠ ∅, aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), as0 ∈ ass, (as0, 0) ∈ asn-s, ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn, (as0, 0)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦ aINV(as0) ∧ t(csf(0), as0)

User applied rule all left

And closed the goal!

Rule argument

pos: left 14 terms: as0 abort: F discard: T computed: T

Additional information

Used terms: as0

Proof step 103 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ s. ¬ (∀ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ↔ a ∈ s), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∀ ass. ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 104:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ s. ¬ (∀ asn. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn) ↔ asn ∈ s) ⊦ ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0)

Rule argument

Additional information

Used simplifier rules: ⊦ ext !(a ') = (ext(a) = None ⊃ [];ext(a).get '); (s)

Proof step 104 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ s. ¬ (∀ asn. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn) ↔ asn ∈ s) ⊦ ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0)

User applied rule weakening

And obtained the following new goals

Proof step 105:
⊦ ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0)

Rule argument

poslist: left 1, left 2, left 3, left 4, left 5, left 6, left 7, left 8, left 9, left 10, left 11, left 12, left 13, left 14, left 15

Additional information

Proof step 105 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0)

User applied rule structural induction

And obtained the following new goals

Proof step 106:
⊦ ∃ asn-s. (∀ as. as ∈ ∅ ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0)
Proof step 108:
∃ asn-s. (∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0) ⊦ ∃ asn-s. (∀ as0. as0 ∈ ass0 ++ as ↔ (as0, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0)

Rule argument

term: ass

Additional information

Used simplifier rules: Set('a) generated by ∅, ++;;

Proof step 106 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ ∃ asn-s. (∀ as. as ∈ ∅ ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 107:
⊦ ∃ asn-s. (∀ as. ¬ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0)

Rule argument

Additional information

Used simplifier rules: ⊦ ¬ a ∈ ∅; (s)

Proof step 107 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ ∃ asn-s. (∀ as. ¬ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0)

User applied rule exists right

And closed the goal!

Rule argument

pos: right 1 terms: ∅ abort: F discard: T computed: F

Additional information

Used simplifier rules: ⊦ ¬ a ∈ ∅; (s) Used terms: ∅

Proof step 108 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

∃ asn-s. (∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0) ⊦ ∃ asn-s. (∀ as0. as0 ∈ ass0 ++ as ↔ (as0, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 109:
∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦ ∃ asn-s0. (∀ as0. as0 = as ∨ as0 ∈ ass0 ↔ (as0, 0) ∈ asn-s0) ∧ (∀ asn. asn ∈ asn-s0 → asn._2 = 0)

Rule argument

Additional information

Used simplifier rules: ⊦ a ∈ s ++ b ↔ a = b ∨ a ∈ s; (s)

Proof step 109 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦ ∃ asn-s0. (∀ as0. as0 = as ∨ as0 ∈ ass0 ↔ (as0, 0) ∈ asn-s0) ∧ (∀ asn. asn ∈ asn-s0 → asn._2 = 0)

User applied rule exists right

And obtained the following new goals

Proof step 110:
∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s ⊦ (∀ as0. as0 = as ∨ as0 ∈ ass0 ↔ (as0, 0) ∈ asn-s ++ (as, 0)) ∧ (∀ asn. asn ∈ asn-s ++ (as, 0) → asn._2 = 0)

Rule argument

pos: right 1 terms: asn-s ++ (as, 0) abort: F discard: T computed: F

Additional information

Used terms: asn-s ++ (as, 0)

Proof step 110 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s ⊦ (∀ as0. as0 = as ∨ as0 ∈ ass0 ↔ (as0, 0) ∈ asn-s ++ (as, 0)) ∧ (∀ asn. asn ∈ asn-s ++ (as, 0) → asn._2 = 0)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 111:
∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦ (as0 ≠ as → (as0 ∈ ass0 ↔ (as0, 0) ∈ asn-s)) ∧ (asn = (as, 0) ∨ asn ∈ asn-s → asn._2 = 0)

Rule argument

Additional information

Used simplifier rules: ⊦ a ∈ s ++ b ↔ a = b ∨ a ∈ s; (s)

Proof step 111 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦ (as0 ≠ as → (as0 ∈ ass0 ↔ (as0, 0) ∈ asn-s)) ∧ (asn = (as, 0) ∨ asn ∈ asn-s → asn._2 = 0)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 112:
asn = (as1, n), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s ⊦ (as0 ≠ as → (as0 ∈ ass0 ↔ (as0, 0) ∈ asn-s)) ∧ (asn = (as, 0) ∨ asn ∈ asn-s → n = 0)

Rule argument

term: asn._2

Additional information

Used terms: as1, n

Proof step 112 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asn = (as1, n), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s ⊦ (as0 ≠ as → (as0 ∈ ass0 ↔ (as0, 0) ∈ asn-s)) ∧ (asn = (as, 0) ∨ asn ∈ asn-s → n = 0)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 113:
∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦ (as0 ≠ as → (as0 ∈ ass0 ↔ (as0, 0) ∈ asn-s)) ∧ ((as1, n) = (as, 0) ∨ (as1, n) ∈ asn-s → n = 0)

Rule argument

Additional information

Proof step 113 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦ (as0 ≠ as → (as0 ∈ ass0 ↔ (as0, 0) ∈ asn-s)) ∧ ((as1, n) = (as, 0) ∨ (as1, n) ∈ asn-s → n = 0)

User applied rule case distinction

And obtained the following new goals

Proof step 114:
¬(as0 ∈ ass0 ↔ (as0, 0) ∈ asn-s), as0 ≠ as, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s ⊦
Proof step 115:
n ≠ 0, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s, (as1, n) = (as, 0) ∨ (as1, n) ∈ asn-s ⊦

Rule argument

pos: right 1

Additional information

Proof step 114 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

¬(as0 ∈ ass0 ↔ (as0, 0) ∈ asn-s), as0 ≠ as, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s ⊦

User applied rule all left

And closed the goal!

Rule argument

pos: left 4 terms: as0 abort: F discard: T computed: T

Additional information

Used terms: as0

Proof step 115 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

n ≠ 0, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s, (as1, n) = (as, 0) ∨ (as1, n) ∈ asn-s ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 116:
# asn-s ≠ 0, (as1, n) ≠ (as, 0), asn-s ≠ ∅, n ≠ 0, (as1, n) ∈ asn-s, ∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦

Rule argument

Additional information

Used simplifier rules: size-zero-01: ⊦ s ≠ ∅ → # s ≠ 0; (forward) from specification set-basic ne-01: ⊦ a ∈ s → s ≠ ∅; (forward) from specification set-basic

Proof step 116 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

# asn-s ≠ 0, (as1, n) ≠ (as, 0), asn-s ≠ ∅, n ≠ 0, (as1, n) ∈ asn-s, ∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

pos: left 7 terms: (as1, n)

Additional information

Used terms: (as1, n)

Proof step 117 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ finout ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 118:
⊦ finout(g) ↔ (∀ a. ∃ s. ∀ b. edge(g)(a, b) ↔ b ∈ s)
Proof step 119:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∃ a. ¬ (∃ s. ∀ b. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, b) ↔ b ∈ s) ⊦

Rule argument

spec: Koenigs-Lemma-gen, name: finout-def, seq: ⊦ finout(g) ↔ (∀ a. ∃ s. ∀ b. edge(g)(a, b) ↔ b ∈ s), subst:[g] → [ (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))]; ['a] → [('as, Nat)], <all paths>

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))

Proof step 118 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ finout(g) ↔ (∀ a. ∃ s. ∀ b. edge(g)(a, b) ↔ b ∈ s)

A spec-lemma

Proof step 119 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∃ a. ¬ (∃ s. ∀ b. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, b) ↔ b ∈ s) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 120:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn, asn0) ↔ asn0 ∈ s

Rule argument

Additional information

Used simplifier rules: ⊦ ext !(a ') = (ext(a) = None ⊃ [];ext(a).get '); (s)

Proof step 120 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn, asn0) ↔ asn0 ∈ s

User applied rule constructor cut

And obtained the following new goals

Proof step 121:
asn = (as1, n0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn, asn0) ↔ asn0 ∈ s

Rule argument

var: asn

Additional information

Proof step 121 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asn = (as1, n0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asn, asn0) ↔ asn0 ∈ s

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 122:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s

Rule argument

Additional information

Proof step 122 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s

User applied rule all left

And obtained the following new goals

Proof step 123:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(n0 + 1)) → (∃ ass. ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s

Rule argument

pos: left 12 terms: csf(n0 + 1) abort: F discard: F computed: F

Additional information

Used terms: csf(n0 + 1)

Proof step 123 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(n0 + 1)) → (∃ ass. ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 124:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(n0 + 1)) → (∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s

Rule argument

Additional information

Proof step 124 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(n0 + 1)) → (∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s

User applied rule case distinction

And obtained the following new goals

Proof step 125:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ cINV(csf(n0 + 1)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s
Proof step 126:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s

Rule argument

pos: left 7

Additional information

Proof step 125 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ cINV(csf(n0 + 1)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

pos: left 8 terms: n0 + 1

Additional information

Used terms: n0 + 1

Proof step 126 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s

User applied rule cut formula

And obtained the following new goals

Proof step 127:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∃ asn-s. ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s
Proof step 147:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s, ∃ asn-s. ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as)

Rule argument

fma: ∃ asn-s. ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as)

Additional information

Used formulas: ∃ asn-s. ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as)

Proof step 127 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∃ asn-s. ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 128:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s

Rule argument

Additional information

Used simplifier rules: ⊦ ext !(a ') = (ext(a) = None ⊃ [];ext(a).get '); (s)

Proof step 128 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s

User applied rule cut formula

And obtained the following new goals

Proof step 129:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s
Proof step 146:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s

Rule argument

fma: t(csf(n0), as1)

Additional information

Used formulas: t(csf(n0), as1)

Proof step 129 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s

User applied rule cut formula

And obtained the following new goals

Proof step 130:
aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0), as1), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s
Proof step 145:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0), as1), t(csf(0), as), ¬ aINV(as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s

Rule argument

fma: aINV(as1)

Additional information

Used formulas: aINV(as1)

Proof step 130 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0), as1), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s

User applied rule exists right

And obtained the following new goals

Proof step 131:
aINV(as1), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ asn-s

Rule argument

pos: right 1 terms: asn-s abort: F discard: T computed: T

Additional information

Used terms: asn-s

Proof step 131 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as1), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ asn-s

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 132:
¬ ( edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ asn-s), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0), as1), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ⊦

Rule argument

Additional information

Proof step 132 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

¬ ( edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ asn-s), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0), as1), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 133:
⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b)
Proof step 134:
¬ ( ( aINV((as1, n0)._1) ∧ aINV(asn0._1) ∧ asn0._2 = (as1, n0)._2 + 1 ∧ move(IOAut(astart, astep, aext))((as1, n0)._1, (cext(caf((as1, n0)._2)) = None ⊃ [];cext(caf((as1, n0)._2)).get '), asn0._1)) ∧ (t(csf((as1, n0)._2), (as1, n0)._1) ∧ aINV((as1, n0)._1)) ∧ t(csf(asn0._2), asn0._1) ∧ aINV(asn0._1) ↔ asn0 ∈ asn-s), aINV(as1), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Rule argument

spec: infgraph-gen-basic, name: edge-def, seq: ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b), subst:[vs, es, a, b] → [λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1), λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1), (as1, n0), asn0]; ['a] → [('as, Nat)], <all paths>

Additional information

Used terms: λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1), λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1), (as1, n0), asn0

Proof step 133 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b)

A spec-lemma

Proof step 134 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

¬ ( ( aINV((as1, n0)._1) ∧ aINV(asn0._1) ∧ asn0._2 = (as1, n0)._2 + 1 ∧ move(IOAut(astart, astep, aext))((as1, n0)._1, (cext(caf((as1, n0)._2)) = None ⊃ [];cext(caf((as1, n0)._2)).get '), asn0._1)) ∧ (t(csf((as1, n0)._2), (as1, n0)._1) ∧ aINV((as1, n0)._1)) ∧ t(csf(asn0._2), asn0._1) ∧ aINV(asn0._1) ↔ asn0 ∈ asn-s), aINV(as1), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 135:
¬ ( asn0._2 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), asn0._1) ∧ t(csf(asn0._2), asn0._1) ∧ aINV(asn0._1) ↔ asn0 ∈ asn-s), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0), as1), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ⊦

Rule argument

Additional information

Proof step 135 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

¬ ( asn0._2 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), asn0._1) ∧ t(csf(asn0._2), asn0._1) ∧ aINV(asn0._1) ↔ asn0 ∈ asn-s), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0), as1), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ⊦

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 136:
asn0 = (as0, n), ¬ (n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ∧ t(csf(n), as0) ∧ aINV(as0) ↔ asn0 ∈ asn-s), aINV(as1), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Rule argument

term: asn0._2

Additional information

Used terms: as0, n

Proof step 136 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asn0 = (as0, n), ¬ (n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ∧ t(csf(n), as0) ∧ aINV(as0) ↔ asn0 ∈ asn-s), aINV(as1), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 137:
¬ ( n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ∧ t(csf(n0 + 1), as0) ∧ aINV(as0) ↔ (as0, n) ∈ asn-s), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0), as1), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ⊦

Rule argument

Additional information

Proof step 137 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

¬ ( n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ∧ t(csf(n0 + 1), as0) ∧ aINV(as0) ↔ (as0, n) ∈ asn-s), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0), as1), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ⊦

User applied rule all left

And obtained the following new goals

Proof step 138:
(as0, n) ∈ asn-s ↔ as0 ∈ ass ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), ¬ ( n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ∧ t(csf(n0 + 1), as0) ∧ aINV(as0) ↔ (as0, n) ∈ asn-s), aINV(as1), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Rule argument

pos: left 19 terms: as0, n abort: F discard: F computed: T

Additional information

Used terms: as0, n

Proof step 138 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as0, n) ∈ asn-s ↔ as0 ∈ ass ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), ¬ ( n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ∧ t(csf(n0 + 1), as0) ∧ aINV(as0) ↔ (as0, n) ∈ asn-s), aINV(as1), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

User applied rule case distinction

And obtained the following new goals

Proof step 139:
¬ ( n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ∧ t(csf(n0 + 1), as0) ∧ aINV(as0) ↔ (as0, n) ∈ asn-s), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0), as1), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n) ∈ asn-s, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ⊦ as0 ∈ ass ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)
Proof step 141:
n = n0 + 1, ¬ ( n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ∧ t(csf(n0 + 1), as0) ∧ aINV(as0) ↔ (as0, n) ∈ asn-s), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), as0 ∈ ass, (as0, n) ∈ asn-s, ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ⊦

Rule argument

pos: left 1

Additional information

Proof step 139 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

¬ ( n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ∧ t(csf(n0 + 1), as0) ∧ aINV(as0) ↔ (as0, n) ∈ asn-s), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0), as1), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ (as0, n) ∈ asn-s, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ⊦ as0 ∈ ass ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 140:
aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0 + 1), as0), t(csf(n0), as1), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ as0 ∈ ass, ¬ (as0, n0 + 1) ∈ asn-s, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ⊦

Rule argument

Additional information

Proof step 140 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0 + 1), as0), t(csf(n0), as1), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ as0 ∈ ass, ¬ (as0, n0 + 1) ∈ asn-s, ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ⊦

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

pos: left 22 terms: as0

Additional information

Used terms: as0

Proof step 141 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

n = n0 + 1, ¬ ( n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ∧ t(csf(n0 + 1), as0) ∧ aINV(as0) ↔ (as0, n) ∈ asn-s), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), as0 ∈ ass, (as0, n) ∈ asn-s, ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 142:
# ass ≠ 0, # asn-s ≠ 0, asn-s ≠ ∅, ass ≠ ∅, aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), as0 ∈ ass, (as0, n0 + 1) ∈ asn-s, ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ⊦ t(csf(n0 + 1), as0) ∧ aINV(as0)

Rule argument

Additional information

Used simplifier rules: size-zero-01: ⊦ s ≠ ∅ → # s ≠ 0; (forward) from specification set-basic ne-01: ⊦ a ∈ s → s ≠ ∅; (forward) from specification set-basic

Proof step 142 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

# ass ≠ 0, # asn-s ≠ 0, asn-s ≠ ∅, ass ≠ ∅, aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), as0 ∈ ass, (as0, n0 + 1) ∈ asn-s, ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ⊦ t(csf(n0 + 1), as0) ∧ aINV(as0)

User applied rule all left

And obtained the following new goals

Proof step 143:
(as0, n0 + 1) ∈ asn-s ↔ as0 ∈ ass ∧ n0 + 1 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), # ass ≠ 0, # asn-s ≠ 0, asn-s ≠ ∅, ass ≠ ∅, aINV(as1), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(0), as), t(csf(n0), as1), (as0, n0 + 1) ∈ asn-s, as0 ∈ ass, ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ t(csf(n0 + 1), as0) ∧ aINV(as0)

Rule argument

pos: left 25 terms: as0, n0 + 1 abort: F discard: T computed: T

Additional information

Used terms: as0, n0 + 1

Proof step 143 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as0, n0 + 1) ∈ asn-s ↔ as0 ∈ ass ∧ n0 + 1 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), # ass ≠ 0, # asn-s ≠ 0, asn-s ≠ ∅, ass ≠ ∅, aINV(as1), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(0), as), t(csf(n0), as1), (as0, n0 + 1) ∈ asn-s, as0 ∈ ass, ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ t(csf(n0 + 1), as0) ∧ aINV(as0)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 144:
# ass ≠ 0, # asn-s ≠ 0, asn-s ≠ ∅, ass ≠ ∅, aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), as0 ∈ ass, (as0, n0 + 1) ∈ asn-s, ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass ⊦ t(csf(n0 + 1), as0) ∧ aINV(as0)

Rule argument

Additional information

Proof step 144 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

# ass ≠ 0, # asn-s ≠ 0, asn-s ≠ ∅, ass ≠ ∅, aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), as0 ∈ ass, (as0, n0 + 1) ∈ asn-s, ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass ⊦ t(csf(n0 + 1), as0) ∧ aINV(as0)

User applied rule all left

And closed the goal!

Rule argument

pos: left 24 terms: as0 abort: F discard: F computed: T

Additional information

Used terms: as0

Proof step 145 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0), as1), t(csf(0), as), ¬ aINV(as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s

User applied rule exists right

And closed the goal!

Rule argument

pos: right 1 terms: ∅ abort: F discard: T computed: F

Additional information

Used simplifier rules: ⊦ ¬ a ∈ ∅; (s) ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b); (ws) Used terms: ∅

Proof step 146 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s

User applied rule exists right

And closed the goal!

Rule argument

pos: right 1 terms: ∅ abort: F discard: T computed: F

Additional information

Used simplifier rules: ⊦ ¬ a ∈ ∅; (s) ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b); (ws) Used terms: ∅

Proof step 147 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ as. t(csf(n0 + 1), as) ∧ aINV(as) ↔ as ∈ ass, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ s. ∀ asn0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n0), asn0) ↔ asn0 ∈ s, ∃ asn-s. ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as)

User applied rule weakening

And obtained the following new goals

Proof step 148:
⊦ ∃ asn-s. ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as)

Rule argument

poslist: left 1, left 2, left 3, left 4, left 5, left 6, left 7, left 8, left 9, left 10, left 11, left 12, left 13, left 14, left 15, right 1

Additional information

Proof step 148 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ ∃ asn-s. ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as)

User applied rule structural induction

And obtained the following new goals

Proof step 149:
⊦ ∃ asn-s. ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ∅ ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as)
Proof step 151:
∀ n0, astart, astep, aext, as1, cext, caf. ∃ asn-s. ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as) ⊦ ∃ asn-s. ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass0 ++ as ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as0)

Rule argument

term: ass

Additional information

Used simplifier rules: Set('a) generated by ∅, ++;;

Proof step 149 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ ∃ asn-s. ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ∅ ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 150:
⊦ ∃ asn-s. ∀ as, n. ¬ (as, n) ∈ asn-s

Rule argument

Additional information

Used simplifier rules: ⊦ ¬ a ∈ ∅; (s)

Proof step 150 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ ∃ asn-s. ∀ as, n. ¬ (as, n) ∈ asn-s

User applied rule exists right

And closed the goal!

Rule argument

pos: right 1 terms: ∅ abort: F discard: T computed: F

Additional information

Used simplifier rules: ⊦ ¬ a ∈ ∅; (s) Used terms: ∅

Proof step 151 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

∀ n0, astart, astep, aext, as1, cext, caf. ∃ asn-s. ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as) ⊦ ∃ asn-s. ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass0 ++ as ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as0)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 152:
∀ n, astart0, astep0, aext0, as0, cext0, caf0. ∃ asn-s. ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart0, astep0, aext0))(as0, (cext0(caf0(n)) = None ⊃ [];cext0(caf0(n)).get '), as2) ⊦ ∃ asn-s. ∀ as0, n. (as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)

Rule argument

Additional information

Used simplifier rules: ⊦ ext !(a ') = (ext(a) = None ⊃ [];ext(a).get '); (s) ⊦ a ∈ s ++ b ↔ a = b ∨ a ∈ s; (s)

Proof step 152 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

∀ n, astart0, astep0, aext0, as0, cext0, caf0. ∃ asn-s. ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart0, astep0, aext0))(as0, (cext0(caf0(n)) = None ⊃ [];cext0(caf0(n)).get '), as2) ⊦ ∃ asn-s. ∀ as0, n. (as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)

User applied rule all left

And obtained the following new goals

Proof step 153:
∃ asn-s. ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ ∃ asn-s. ∀ as0, n. (as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)

Rule argument

pos: left 1 terms: n0, astart, astep, aext, as1, cext, caf abort: F discard: T computed: F

Additional information

Used terms: n0, astart, astep, aext, as1, cext, caf

Proof step 153 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

∃ asn-s. ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ ∃ asn-s. ∀ as0, n. (as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 154:
∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ ∃ asn-s. ∀ as0, n. (as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)

Rule argument

Additional information

Proof step 154 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ ∃ asn-s. ∀ as0, n. (as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)

User applied rule exists right

And obtained the following new goals

Proof step 155:
∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ ∀ as0, n. (as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), ∃ asn-s. ∀ as0, n. (as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)

Rule argument

pos: right 1 terms: asn-s abort: F discard: F computed: T

Additional information

Used terms: asn-s

Proof step 155 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ ∀ as0, n. (as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), ∃ asn-s. ∀ as0, n. (as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 156:
¬ ((as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)), ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ ∃ asn-s. ∀ as0, n. (as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)

Rule argument

Additional information

Proof step 156 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

¬ ((as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)), ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ ∃ asn-s. ∀ as0, n. (as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)

User applied rule exists right

And obtained the following new goals

Proof step 157:
¬ ((as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)), ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ ∀ as0, n. (as0, n) ∈ asn-s ++ (as, n0 + 1) ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)

Rule argument

pos: right 1 terms: asn-s ++ (as, n0 + 1) abort: F discard: T computed: F

Additional information

Used terms: asn-s ++ (as, n0 + 1)

Proof step 157 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

¬ ((as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)), ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ ∀ as0, n. (as0, n) ∈ asn-s ++ (as, n0 + 1) ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 158:
¬ ((as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)), ¬ ( (as2, n1) = (as, n0 + 1) ∨ (as2, n1) ∈ asn-s ↔ (as2 = as ∨ as2 ∈ ass0) ∧ n1 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2)), ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ a ∈ s ++ b ↔ a = b ∨ a ∈ s; (s)

Proof step 158 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

¬ ((as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)), ¬ ( (as2, n1) = (as, n0 + 1) ∨ (as2, n1) ∈ asn-s ↔ (as2 = as ∨ as2 ∈ ass0) ∧ n1 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2)), ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦

User applied rule case distinction

And obtained the following new goals

Proof step 159:
¬ ((as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)), ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), (as2, n1) = (as, n0 + 1) ∨ (as2, n1) ∈ asn-s ⊦ (as2 = as ∨ as2 ∈ ass0) ∧ n1 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2)
Proof step 171:
n1 = n0 + 1, (as2, n1) ≠ (as, n0 + 1), ¬ ((as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), ¬ (as2, n1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), as2 = as ∨ as2 ∈ ass0 ⊦

Rule argument

pos: left 2

Additional information

Proof step 159 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

¬ ((as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)), ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), (as2, n1) = (as, n0 + 1) ∨ (as2, n1) ∈ asn-s ⊦ (as2 = as ∨ as2 ∈ ass0) ∧ n1 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2)

User applied rule case distinction

And obtained the following new goals

Proof step 160:
(as2, n1) = (as, n0 + 1), ¬ ((as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)), ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ (as2 = as ∨ as2 ∈ ass0) ∧ n1 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2)
Proof step 166:
¬ ((as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)), (as2, n1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ (as2 = as ∨ as2 ∈ ass0) ∧ n1 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2)

Rule argument

pos: left 3

Additional information

Proof step 160 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as2, n1) = (as, n0 + 1), ¬ ((as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)), ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ (as2 = as ∨ as2 ∈ ass0) ∧ n1 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 161:
¬((as0, n) ∈ asn-s ↔ as0 ∈ ass0 ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)), ¬ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as), ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦

Rule argument

Additional information

Proof step 161 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

¬((as0, n) ∈ asn-s ↔ as0 ∈ ass0 ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)), ¬ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as), ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦

User applied rule case distinction

And obtained the following new goals

Proof step 162:
(as0, n) ∈ asn-s, ¬ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as), ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ as0 ∈ ass0 ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)
Proof step 164:
n = n0 + 1, move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), as0 ∈ ass0, ¬ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as), ¬ (as0, n) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦

Rule argument

pos: left 1

Additional information

Proof step 162 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as0, n) ∈ asn-s, ¬ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as), ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ as0 ∈ ass0 ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 163:
# asn-s ≠ 0, asn-s ≠ ∅, (as0, n) ∈ asn-s, ¬ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as), ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ as0 ∈ ass0 ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)

Rule argument

Additional information

Used simplifier rules: size-zero-01: ⊦ s ≠ ∅ → # s ≠ 0; (forward) from specification set-basic ne-01: ⊦ a ∈ s → s ≠ ∅; (forward) from specification set-basic

Proof step 163 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

# asn-s ≠ 0, asn-s ≠ ∅, (as0, n) ∈ asn-s, ¬ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as), ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ as0 ∈ ass0 ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)

User applied rule all left

And closed the goal!

Rule argument

pos: left 5 terms: as0, n abort: F discard: T computed: T

Additional information

Used terms: as0, n

Proof step 164 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

n = n0 + 1, move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), as0 ∈ ass0, ¬ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as), ¬ (as0, n) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 165:
# ass0 ≠ 0, ass0 ≠ ∅, move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), as0 ∈ ass0, ¬ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as), ¬ (as0, n0 + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦

Rule argument

Additional information

Used simplifier rules: size-zero-01: ⊦ s ≠ ∅ → # s ≠ 0; (forward) from specification set-basic ne-01: ⊦ a ∈ s → s ≠ ∅; (forward) from specification set-basic

Proof step 165 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

# ass0 ≠ 0, ass0 ≠ ∅, move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), as0 ∈ ass0, ¬ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as), ¬ (as0, n0 + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

pos: left 7 terms: as0, n0 + 1

Additional information

Used terms: as0, n0 + 1

Proof step 166 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

¬ ((as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)), (as2, n1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ (as2 = as ∨ as2 ∈ ass0) ∧ n1 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 167:
# asn-s ≠ 0, ¬ ((as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)), asn-s ≠ ∅, (as2, n1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ (as2 = as ∨ as2 ∈ ass0) ∧ n1 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2)

Rule argument

Additional information

Used simplifier rules: size-zero-01: ⊦ s ≠ ∅ → # s ≠ 0; (forward) from specification set-basic ne-01: ⊦ a ∈ s → s ≠ ∅; (forward) from specification set-basic

Proof step 167 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

# asn-s ≠ 0, ¬ ((as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)), asn-s ≠ ∅, (as2, n1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ (as2 = as ∨ as2 ∈ ass0) ∧ n1 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2)

User applied rule case distinction

And obtained the following new goals

Proof step 168:
# asn-s ≠ 0, asn-s ≠ ∅, (as2, n1) ∈ asn-s, (as0, n) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ (as2 = as ∨ as2 ∈ ass0) ∧ n1 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)
Proof step 169:
n = n0 + 1, # asn-s ≠ 0, asn-s ≠ ∅, move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), (as2, n1) ∈ asn-s, ¬ (as0, n) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), as0 = as ∨ as0 ∈ ass0 ⊦ (as2 = as ∨ as2 ∈ ass0) ∧ n1 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2)

Rule argument

pos: left 2

Additional information

Proof step 168 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

# asn-s ≠ 0, asn-s ≠ ∅, (as2, n1) ∈ asn-s, (as0, n) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ (as2 = as ∨ as2 ∈ ass0) ∧ n1 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)

User applied rule all left

And closed the goal!

Rule argument

pos: left 5 terms: as0, n abort: F discard: T computed: T

Additional information

Used terms: as0, n

Proof step 169 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

n = n0 + 1, # asn-s ≠ 0, asn-s ≠ ∅, move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), (as2, n1) ∈ asn-s, ¬ (as0, n) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), as0 = as ∨ as0 ∈ ass0 ⊦ (as2 = as ∨ as2 ∈ ass0) ∧ n1 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 170:
# asn-s ≠ 0, asn-s ≠ ∅, move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), (as2, n1) ∈ asn-s, ¬ (as0, n0 + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), as0 = as ∨ as0 ∈ ass0 ⊦ (as2 = as ∨ as2 ∈ ass0) ∧ n1 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2)

Rule argument

Additional information

Proof step 170 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

# asn-s ≠ 0, asn-s ≠ ∅, move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), (as2, n1) ∈ asn-s, ¬ (as0, n0 + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), as0 = as ∨ as0 ∈ ass0 ⊦ (as2 = as ∨ as2 ∈ ass0) ∧ n1 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2)

User applied rule all left

And closed the goal!

Rule argument

pos: left 6 terms: as2, n1 abort: F discard: T computed: T

Additional information

Used terms: as2, n1

Proof step 171 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

n1 = n0 + 1, (as2, n1) ≠ (as, n0 + 1), ¬ ((as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), ¬ (as2, n1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), as2 = as ∨ as2 ∈ ass0 ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 172:
# ass0 ≠ 0, ¬ ((as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)), as2 ≠ as, ass0 ≠ ∅, move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), as2 ∈ ass0, ¬ (as2, n0 + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦

Rule argument

Additional information

Used simplifier rules: size-zero-01: ⊦ s ≠ ∅ → # s ≠ 0; (forward) from specification set-basic ne-01: ⊦ a ∈ s → s ≠ ∅; (forward) from specification set-basic

Proof step 172 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

# ass0 ≠ 0, ¬ ((as0, n) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)), as2 ≠ as, ass0 ≠ ∅, move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), as2 ∈ ass0, ¬ (as2, n0 + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦

User applied rule case distinction

And obtained the following new goals

Proof step 173:
# ass0 ≠ 0, as2 ≠ as, ass0 ≠ ∅, move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), as2 ∈ ass0, (as0, n) ∈ asn-s, ¬ (as2, n0 + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)
Proof step 175:
n = n0 + 1, # ass0 ≠ 0, as2 ≠ as, ass0 ≠ ∅, move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), as2 ∈ ass0, ¬ (as0, n) ∈ asn-s, ¬ (as2, n0 + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), as0 = as ∨ as0 ∈ ass0 ⊦

Rule argument

pos: left 2

Additional information

Proof step 173 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

# ass0 ≠ 0, as2 ≠ as, ass0 ≠ ∅, move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), as2 ∈ ass0, (as0, n) ∈ asn-s, ¬ (as2, n0 + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 174:
# ass0 ≠ 0, # asn-s ≠ 0, as2 ≠ as, asn-s ≠ ∅, ass0 ≠ ∅, move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), as2 ∈ ass0, (as0, n) ∈ asn-s, ¬ (as2, n0 + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)

Rule argument

Additional information

Used simplifier rules: size-zero-01: ⊦ s ≠ ∅ → # s ≠ 0; (forward) from specification set-basic ne-01: ⊦ a ∈ s → s ≠ ∅; (forward) from specification set-basic

Proof step 174 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

# ass0 ≠ 0, # asn-s ≠ 0, as2 ≠ as, asn-s ≠ ∅, ass0 ≠ ∅, move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), as2 ∈ ass0, (as0, n) ∈ asn-s, ¬ (as2, n0 + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2) ⊦ (as0 = as ∨ as0 ∈ ass0) ∧ n = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0)

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

pos: left 10 terms: as2, n0 + 1

Additional information

Used terms: as2, n0 + 1

Proof step 175 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

n = n0 + 1, # ass0 ≠ 0, as2 ≠ as, ass0 ≠ ∅, move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), as2 ∈ ass0, ¬ (as0, n) ∈ asn-s, ¬ (as2, n0 + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), as0 = as ∨ as0 ∈ ass0 ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 176:
# ass0 ≠ 0, as2 ≠ as, ass0 ≠ ∅, move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), as2 ∈ ass0, ¬ (as0, n0 + 1) ∈ asn-s, ¬ (as2, n0 + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), as0 = as ∨ as0 ∈ ass0 ⊦

Rule argument

Additional information

Proof step 176 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

# ass0 ≠ 0, as2 ≠ as, ass0 ≠ ∅, move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), as2 ∈ ass0, ¬ (as0, n0 + 1) ∈ asn-s, ¬ (as2, n0 + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n0 + 1 ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), as0 = as ∨ as0 ∈ ass0 ⊦

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

pos: left 9 terms: as2, n0 + 1

Additional information

Used terms: as2, n0 + 1

Proof step 177 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ allreachable ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 178:
⊦ allreachable(g) ↔ (∀ b. dom(g)(b) → (∃ a. isroot(g)(a) ∧ path(g)(a, b)))
Proof step 179:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∃ b. ¬ ( dom ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (b) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, b))) ⊦

Rule argument

spec: Koenigs-Lemma-gen, name: allreachable-def, seq: ⊦ allreachable(g) ↔ (∀ b. dom(g)(b) → (∃ a. isroot(g)(a) ∧ path(g)(a, b))), subst:[g] → [ (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))]; ['a] → [('as, Nat)], <all paths>

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))

Proof step 178 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ allreachable(g) ↔ (∀ b. dom(g)(b) → (∃ a. isroot(g)(a) ∧ path(g)(a, b)))

A spec-lemma

Proof step 179 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∃ b. ¬ ( dom ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (b) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, b))) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 180:
aINV(as), aINV(asn._1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(asn._2), asn._1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, asn)

Rule argument

Additional information

Used simplifier rules: ⊦ ext !(a ') = (ext(a) = None ⊃ [];ext(a).get '); (s) ⊦ dom(vs × es) = vs; (s)

Proof step 180 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), aINV(asn._1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(asn._2), asn._1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, asn)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 181:
asn = (as0, n), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, asn)

Rule argument

term: asn._1

Additional information

Used terms: as0, n

Proof step 181 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asn = (as0, n), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, asn)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 182:
aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n))

Rule argument

Additional information

Proof step 182 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n))

User applied rule structural induction

And obtained the following new goals

Proof step 183:
aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, 0))
Proof step 194:
aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 +1), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ aINV, as, as0, cINV, csf, cstart, cstep, cext, caf, t, astart, astep, aext. aINV(as) ∧ aINV(as0) ∧ cINV(csf(0)) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(0), as) ∧ t(csf(n0), as0) ∧ ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as))) ∧ (∀ n. cINV(csf(n))) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0))) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0 +1))

Rule argument

term: n

Additional information

Used simplifier rules: Nat freely generated by 0, +1;;

Proof step 183 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, 0))

User applied rule exists right

And obtained the following new goals

Proof step 184:
aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((as0, 0)) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((as0, 0), (as0, 0))

Rule argument

pos: right 1 terms: (as0, 0) abort: F discard: T computed: T

Additional information

Used terms: (as0, 0)

Proof step 184 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((as0, 0)) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((as0, 0), (as0, 0))

User applied rule case distinction

And obtained the following new goals

Proof step 185:
aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((as0, 0)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦
Proof step 187:
aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((as0, 0), (as0, 0)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

Rule argument

pos: right 1

Additional information

Proof step 185 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((as0, 0)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 186:
⊦ isroot(g)(b) ↔ dom(g)(b) ∧ (∀ a. ¬ edge(g)(a, b))

Rule argument

spec: infgraph-gen, name: isroot-def, seq: ⊦ isroot(g)(b) ↔ dom(g)(b) ∧ (∀ a. ¬ edge(g)(a, b)), subst:[g, b] → [ (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1)), (as0, 0)]; ['a] → [('as, Nat)], <all paths>

Additional information

Used simplifier rules: ⊦ dom(vs × es) = vs; (s) ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b); (ws) ⊦ m + 1 ≠ 0; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1)), (as0, 0)

Proof step 186 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ isroot(g)(b) ↔ dom(g)(b) ∧ (∀ a. ¬ edge(g)(a, b))

A spec-lemma

Proof step 187 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((as0, 0), (as0, 0)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 188:
⊦ path(g)(a, b) ↔ (∃ x. pathp(g)(⌜x⌝ ) ∧ x ≠ [] ∧ a = x.head ∧ b = x.last)
Proof step 189:
aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ x. ¬ ( pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜x⌝ ) ∧ x ≠ [] ∧ (as0, 0) = x.head ∧ (as0, 0) = x.last) ⊦

Rule argument

spec: infgraph-gen, name: path-def, seq: ⊦ path(g)(a, b) ↔ (∃ x. pathp(g)(⌜x⌝ ) ∧ x ≠ [] ∧ a = x.head ∧ b = x.last), subst:[g, a, b] → [ (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1)), (as0, 0), (as0, 0)]; ['a] → [('as, Nat)], <all paths>

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1)), (as0, 0), (as0, 0)

Proof step 188 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ path(g)(a, b) ↔ (∃ x. pathp(g)(⌜x⌝ ) ∧ x ≠ [] ∧ a = x.head ∧ b = x.last)

A spec-lemma

Proof step 189 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ x. ¬ ( pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜x⌝ ) ∧ x ≠ [] ∧ (as0, 0) = x.head ∧ (as0, 0) = x.last) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 190:
aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ x. ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜x⌝ ) ∨ x = [] ∨ (as0, 0) ≠ x.head ∨ (as0, 0) ≠ x.last ⊦

Rule argument

Additional information

Proof step 190 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ x. ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜x⌝ ) ∨ x = [] ∨ (as0, 0) ≠ x.head ∨ (as0, 0) ≠ x.last ⊦

User applied rule all left

And obtained the following new goals

Proof step 191:
aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜(as0, 0) '⌝ ) ∨ (as0, 0) ' = [] ∨ (as0, 0) ≠ (as0, 0) '.head ∨ (as0, 0) ≠ (as0, 0) '.last ⊦

Rule argument

pos: left 17 terms: (as0, 0) ' abort: F discard: T computed: F

Additional information

Used terms: (as0, 0) '

Proof step 191 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜(as0, 0) '⌝ ) ∨ (as0, 0) ' = [] ∨ (as0, 0) ≠ (as0, 0) '.head ∨ (as0, 0) ≠ (as0, 0) '.last ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 192:
aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜(as0, 0) '⌝ ), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ a '.last = a; (s) ⊦ a '.head = a; (s) ⊦ a ' ≠ []; (s)

Proof step 192 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜(as0, 0) '⌝ ), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 193:
⊦ pathp(g)(σ) ↔ (∀ n. ⌜n⌝ < # σ → dom(g)(σ[n])) ∧ (∀ n. ⌜n + 1⌝ < # σ → edge(g)(σ[n], σ[n + 1]))

Rule argument

spec: infgraph-gen, name: pathp-def, seq:⊦ pathp(g)(σ) ↔ (∀ n. ⌜n⌝ < # σ → dom(g)(σ[n])) ∧ (∀ n. ⌜n + 1⌝ < # σ → edge(g)(σ[n], σ[n + 1])), subst:[g, σ] → [ (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1)), ⌜(as0, 0) '⌝ ]; ['a] → [('as, Nat)], <all paths>

Additional information

Used simplifier rules: ⊦ m < 1 ↔ m = 0; (s) ⊦ ⌜x⌝ [n] = x[n]; (s) ⊦ a '[0] = a; (s) ⊦ dom(vs × es) = vs; (s) ⊦ ⌜m + n⌝ = ⌜m⌝ + ⌜n⌝ ; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic ⊦ # ⌜x⌝ = ⌜# x⌝ ; (s) ⊦ # a ' = 0 +1; (s) ⊦ m ≤ n → (⌜(* m)⌝ + n∞2 < ⌜(* n)⌝ ↔ n∞2 < ⌜n - m⌝ ); (s) ⊦ ⌜m⌝ < ⌜n⌝ ↔ m < n; (s) ⊦ ¬ n < 0; (s) add-assoc: ⊦ (n∞ + n∞1) + n∞2 = n∞ + n∞1 + n∞2; from specification nat-inf add-comm: ⊦ n∞1 + n∞2 = n∞2 + n∞1; from specification nat-inf Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1)), ⌜(as0, 0) '⌝

Proof step 193 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ pathp(g)(σ) ↔ (∀ n. ⌜n⌝ < # σ → dom(g)(σ[n])) ∧ (∀ n. ⌜n + 1⌝ < # σ → edge(g)(σ[n], σ[n + 1]))

A spec-lemma

Proof step 194 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 +1), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ aINV, as, as0, cINV, csf, cstart, cstep, cext, caf, t, astart, astep, aext. aINV(as) ∧ aINV(as0) ∧ cINV(csf(0)) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(0), as) ∧ t(csf(n0), as0) ∧ ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as))) ∧ (∀ n. cINV(csf(n))) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0))) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0 +1))

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 195:
aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ aINV, as, as0, cINV, csf, cstart, cstep, cext, caf, t, astart, astep, aext. aINV(as) ∧ aINV(as0) ∧ cINV(csf(0)) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(0), as) ∧ t(csf(n0), as0) ∧ ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as))) ∧ (∀ n. cINV(csf(n))) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0))), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0 + 1))

Rule argument

Additional information

Used simplifier rules: ⊦ m +1 = m + 1; (s)

Proof step 195 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ aINV, as, as0, cINV, csf, cstart, cstep, cext, caf, t, astart, astep, aext. aINV(as) ∧ aINV(as0) ∧ cINV(csf(0)) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(0), as) ∧ t(csf(n0), as0) ∧ ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as))) ∧ (∀ n. cINV(csf(n))) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0))), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0 + 1))

User applied rule all left

And obtained the following new goals

Proof step 196:
aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 + 1), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(n0)) ∧ cstep(csf(n0), caf(n0), csf(n0 + 1)) ∧ t(csf(n0 + 1), as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ∧ t(csf(n0), as)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ aINV, as, as0, cINV, csf, cstart, cstep, cext, caf, t, astart, astep, aext. aINV(as) ∧ aINV(as0) ∧ cINV(csf(0)) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(0), as) ∧ t(csf(n0), as0) ∧ ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as))) ∧ (∀ n. cINV(csf(n))) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0))) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0 + 1))

Rule argument

pos: left 16 terms: csf(n0), caf(n0), csf(n0 + 1), as0 abort: F discard: F computed: F

Additional information

Used terms: csf(n0), caf(n0), csf(n0 + 1), as0

Proof step 196 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 + 1), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(n0)) ∧ cstep(csf(n0), caf(n0), csf(n0 + 1)) ∧ t(csf(n0 + 1), as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ∧ t(csf(n0), as)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ aINV, as, as0, cINV, csf, cstart, cstep, cext, caf, t, astart, astep, aext. aINV(as) ∧ aINV(as0) ∧ cINV(csf(0)) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(0), as) ∧ t(csf(n0), as0) ∧ ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as))) ∧ (∀ n. cINV(csf(n))) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0))) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0 + 1))

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 197:
aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(n0)) ∧ cstep(csf(n0), caf(n0), csf(n0 + 1)) → aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ∧ t(csf(n0), as1), ∀ aINV, as, as0, cINV, csf, cstart, cstep, cext, caf, t, astart, astep, aext. aINV(as) ∧ aINV(as0) ∧ cINV(csf(0)) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(0), as) ∧ t(csf(n0), as0) ∧ ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as))) ∧ (∀ n. cINV(csf(n))) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0))), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0 + 1))

Rule argument

Additional information

Proof step 197 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(n0)) ∧ cstep(csf(n0), caf(n0), csf(n0 + 1)) → aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0) ∧ t(csf(n0), as1), ∀ aINV, as, as0, cINV, csf, cstart, cstep, cext, caf, t, astart, astep, aext. aINV(as) ∧ aINV(as0) ∧ cINV(csf(0)) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(0), as) ∧ t(csf(n0), as0) ∧ ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as))) ∧ (∀ n. cINV(csf(n))) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0))), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0 + 1))

User applied rule case distinction

And obtained the following new goals

Proof step 198:
aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 + 1), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ aINV, as, as0, cINV, csf, cstart, cstep, cext, caf, t, astart, astep, aext. aINV(as) ∧ aINV(as0) ∧ cINV(csf(0)) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(0), as) ∧ t(csf(n0), as0) ∧ ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as))) ∧ (∀ n. cINV(csf(n))) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0))) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0 + 1)), cINV(csf(n0)) ∧ cstep(csf(n0), caf(n0), csf(n0 + 1))
Proof step 200:
aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ aINV, as, as0, cINV, csf, cstart, cstep, cext, caf, t, astart, astep, aext. aINV(as) ∧ aINV(as0) ∧ cINV(csf(0)) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(0), as) ∧ t(csf(n0), as0) ∧ ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as))) ∧ (∀ n. cINV(csf(n))) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0))) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0 + 1))

Rule argument

pos: left 9

Additional information

Proof step 198 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 + 1), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ aINV, as, as0, cINV, csf, cstart, cstep, cext, caf, t, astart, astep, aext. aINV(as) ∧ aINV(as0) ∧ cINV(csf(0)) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(0), as) ∧ t(csf(n0), as0) ∧ ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as))) ∧ (∀ n. cINV(csf(n))) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0))) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0 + 1)), cINV(csf(n0)) ∧ cstep(csf(n0), caf(n0), csf(n0 + 1))

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 199:
aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 + 1), as0), t(csf(0), as), ¬ cINV(csf(n0)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ aINV, as, as0, cINV, csf, cstart, cstep, cext, caf, t, astart, astep, aext. aINV(as) ∧ aINV(as0) ∧ cINV(csf(0)) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(0), as) ∧ t(csf(n0), as0) ∧ ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as))) ∧ (∀ n. cINV(csf(n))) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0))) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0 + 1))

Rule argument

Additional information

Used simplifier rules: ⊦ ¬ step(sf(n), af(n), sf(n + 1)) → (fragω(IOAut(start, step, ext))(sf, af) ↔ false); (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic

Proof step 199 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 + 1), as0), t(csf(0), as), ¬ cINV(csf(n0)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ aINV, as, as0, cINV, csf, cstart, cstep, cext, caf, t, astart, astep, aext. aINV(as) ∧ aINV(as0) ∧ cINV(csf(0)) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(0), as) ∧ t(csf(n0), as0) ∧ ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as))) ∧ (∀ n. cINV(csf(n))) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0))) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0 + 1))

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

pos: left 11 terms: n0

Additional information

Used terms: n0

Proof step 200 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ aINV, as, as0, cINV, csf, cstart, cstep, cext, caf, t, astart, astep, aext. aINV(as) ∧ aINV(as0) ∧ cINV(csf(0)) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(0), as) ∧ t(csf(n0), as0) ∧ ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as))) ∧ (∀ n. cINV(csf(n))) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0))) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0 + 1))

User applied rule all left

And obtained the following new goals

Proof step 201:
aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), aINV(as) ∧ aINV(as1) ∧ cINV(csf(0)) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(0), as) ∧ t(csf(n0), as1) ∧ ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as))) ∧ (∀ n. cINV(csf(n))) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as1, n0))), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0 + 1))

Rule argument

pos: left 20 terms: aINV, as, as1, cINV, csf, cstart, cstep, cext, caf, t, astart, astep, aext abort: F discard: T computed: F

Additional information

Used terms: aINV, as, as1, cINV, csf, cstart, cstep, cext, caf, t, astart, astep, aext

Proof step 201 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), aINV(as) ∧ aINV(as1) ∧ cINV(csf(0)) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(0), as) ∧ t(csf(n0), as1) ∧ ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as))) ∧ (∀ n. cINV(csf(n))) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as1, n0))), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0 + 1))

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 202:
aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn, (as1, n0)), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0 + 1))

Rule argument

Additional information

Proof step 202 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn, (as1, n0)), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (a, (as0, n0 + 1))

User applied rule exists right

And obtained the following new goals

Proof step 203:
aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn, (as1, n0)), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn, (as0, n0 + 1))

Rule argument

pos: right 1 terms: asn abort: F discard: T computed: T

Additional information

Used terms: asn

Proof step 203 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn, (as1, n0)), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn, (as0, n0 + 1))

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 204:
aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn, (as1, n0)), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn, (as0, n0 + 1)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

Rule argument

Additional information

Proof step 204 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn, (as1, n0)), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn, (as0, n0 + 1)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 205:
⊦ path(g)(a, b) ↔ (∃ x. pathp(g)(⌜x⌝ ) ∧ x ≠ [] ∧ a = x.head ∧ b = x.last)
Proof step 206:
aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn, (as0, n0 + 1)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∃ x. pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜x⌝ ) ∧ x ≠ [] ∧ asn = x.head ∧ (as1, n0) = x.last ⊦

Rule argument

spec: infgraph-gen, name:path-def, seq: ⊦ path(g)(a, b) ↔ (∃ x. pathp(g)(⌜x⌝ ) ∧ x ≠ [] ∧ a = x.head ∧ b = x.last), subst:[g, a, b] → [ (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1)), asn, (as1, n0)]; ['a] → [('as, Nat)], <all paths>

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1)), asn, (as1, n0)

Proof step 205 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ path(g)(a, b) ↔ (∃ x. pathp(g)(⌜x⌝ ) ∧ x ≠ [] ∧ a = x.head ∧ b = x.last)

A spec-lemma

Proof step 206 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn, (as0, n0 + 1)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∃ x. pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜x⌝ ) ∧ x ≠ [] ∧ asn = x.head ∧ (as1, n0) = x.last ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 207:
(as1, n0) = x.last, x ≠ [], aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (x.head), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜x⌝ ), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (x.head, (as0, n0 + 1)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

Rule argument

Additional information

Proof step 207 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = x.last, x ≠ [], aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (x.head), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜x⌝ ), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (x.head, (as0, n0 + 1)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 208:
(as1, n0) = x.last, x = asn2 + x0, x ≠ [], aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜x⌝ ), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2, (as0, n0 + 1)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Rule argument

spec: list-data, name:elim-add, seq: ⊦ x ≠ [] → (head = x.head ∧ tail = x.tail ↔ x = head + tail), subst:[x, head, tail] → [x, asn2, x0]; ['a] → [('as, Nat)]

Additional information

Used simplifier rules: ⊦ x ≠ [] → (head = x.head ∧ tail = x.tail ↔ x = head + tail); (elim) Used terms: x, asn2, x0

Proof step 208 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = x.last, x = asn2 + x0, x ≠ [], aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜x⌝ ), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2, (as0, n0 + 1)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 209:
(as1, n0) = (asn2 ' + x0).last, aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜asn2 '⌝ + ⌜x0⌝ ), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2, (as0, n0 + 1)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ ⌜x + y⌝ = ⌜x⌝ + ⌜y⌝ ; (s) ⊦ a + x = a ' + x; (s) ⊦ a ' ≠ []; (s) ⊦ x + y = [] ↔ x = [] ∧ y = []; (s)

Proof step 209 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜asn2 '⌝ + ⌜x0⌝ ), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2, (as0, n0 + 1)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 210:
⊦ path(g)(a, b) ↔ (∃ x. pathp(g)(⌜x⌝ ) ∧ x ≠ [] ∧ a = x.head ∧ b = x.last)
Proof step 211:
(as1, n0) = (asn2 ' + x0).last, aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜asn2 '⌝ + ⌜x0⌝ ), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ x. ¬ ( pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜x⌝ ) ∧ x ≠ [] ∧ asn2 = x.head ∧ (as0, n0 + 1) = x.last) ⊦

Rule argument

spec: infgraph-gen, name: path-def, seq: ⊦ path(g)(a, b) ↔ (∃ x. pathp(g)(⌜x⌝ ) ∧ x ≠ [] ∧ a = x.head ∧ b = x.last), subst:[g, a, b] → [ (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1)), asn2, (as0, n0 + 1)]; ['a] → [('as, Nat)], <all paths>

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1)), asn2, (as0, n0 + 1)

Proof step 210 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ path(g)(a, b) ↔ (∃ x. pathp(g)(⌜x⌝ ) ∧ x ≠ [] ∧ a = x.head ∧ b = x.last)

A spec-lemma

Proof step 211 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜asn2 '⌝ + ⌜x0⌝ ), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ x. ¬ ( pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜x⌝ ) ∧ x ≠ [] ∧ asn2 = x.head ∧ (as0, n0 + 1) = x.last) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 212:
(as1, n0) = (asn2 ' + x0).last, aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜asn2 '⌝ + ⌜x0⌝ ), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ x. ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜x⌝ ) ∨ x = [] ∨ asn2 ≠ x.head ∨ (as0, n0 + 1) ≠ x.last ⊦

Rule argument

Additional information

Proof step 212 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜asn2 '⌝ + ⌜x0⌝ ), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ x. ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜x⌝ ) ∨ x = [] ∨ asn2 ≠ x.head ∨ (as0, n0 + 1) ≠ x.last ⊦

User applied rule all left

And obtained the following new goals

Proof step 213:
(as1, n0) = (asn2 ' + x0).last, aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜asn2 '⌝ + ⌜x0⌝ ), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜asn2 ' + x0 + (as0, n0 + 1) '⌝ ) ∨ asn2 ' + x0 + (as0, n0 + 1) ' = [] ∨ asn2 ≠ (asn2 ' + x0 + (as0, n0 + 1) ').head ∨ (as0, n0 + 1) ≠ (asn2 ' + x0 + (as0, n0 + 1) ').last ⊦

Rule argument

pos: left 23 terms: asn2 ' + x0 + (as0, n0 + 1) ' abort: F discard: T computed: F

Additional information

Used terms: asn2 ' + x0 + (as0, n0 + 1) '

Proof step 213 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜asn2 '⌝ + ⌜x0⌝ ), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜asn2 ' + x0 + (as0, n0 + 1) '⌝ ) ∨ asn2 ' + x0 + (as0, n0 + 1) ' = [] ∨ asn2 ≠ (asn2 ' + x0 + (as0, n0 + 1) ').head ∨ (as0, n0 + 1) ≠ (asn2 ' + x0 + (as0, n0 + 1) ').last ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 214:
(as1, n0) = (asn2 ' + x0).last, aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜asn2 '⌝ + ⌜x0⌝ ), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜asn2 '⌝ + ⌜x0⌝ + ⌜(as0, n0 + 1) '⌝ ), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ (a ' + x + b ').last = b; (s) ⊦ (a ' + x).head = a; (s) ⊦ a ' ≠ []; (s) ⊦ x + y = [] ↔ x = [] ∧ y = []; (s) ⊦ ⌜x + y⌝ = ⌜x⌝ + ⌜y⌝ ; (s)

Proof step 214 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜asn2 '⌝ + ⌜x0⌝ ), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜asn2 '⌝ + ⌜x0⌝ + ⌜(as0, n0 + 1) '⌝ ), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 215:
⊦ pathp(g)(σ) ↔ (∀ n. ⌜n⌝ < # σ → dom(g)(σ[n])) ∧ (∀ n. ⌜n + 1⌝ < # σ → edge(g)(σ[n], σ[n + 1]))
Proof step 216:
(as1, n0) = (asn2 ' + x0).last, aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜asn2 '⌝ + ⌜x0⌝ + ⌜(as0, n0 + 1) '⌝ ), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n. ⌜n⌝ < #(⌜asn2 '⌝ + ⌜x0⌝ ) → dom ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((⌜asn2 '⌝ + ⌜x0⌝ )[n]), ∀ n. ⌜n + 1⌝ < #(⌜asn2 '⌝ + ⌜x0⌝ ) → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((⌜asn2 '⌝ + ⌜x0⌝ )[n], (⌜asn2 '⌝ + ⌜x0⌝ )[n + 1]) ⊦

Rule argument

spec: infgraph-gen, name:pathp-def, seq:⊦ pathp(g)(σ) ↔ (∀ n. ⌜n⌝ < # σ → dom(g)(σ[n])) ∧ (∀ n. ⌜n + 1⌝ < # σ → edge(g)(σ[n], σ[n + 1])), subst:[g, σ] → [ (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1)), ⌜asn2 '⌝ + ⌜x0⌝ ]; ['a] → [('as, Nat)], <all paths>

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1)), ⌜asn2 '⌝ + ⌜x0⌝

Proof step 215 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ pathp(g)(σ) ↔ (∀ n. ⌜n⌝ < # σ → dom(g)(σ[n])) ∧ (∀ n. ⌜n + 1⌝ < # σ → edge(g)(σ[n], σ[n + 1]))

A spec-lemma

Proof step 216 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜asn2 '⌝ + ⌜x0⌝ + ⌜(as0, n0 + 1) '⌝ ), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n. ⌜n⌝ < #(⌜asn2 '⌝ + ⌜x0⌝ ) → dom ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((⌜asn2 '⌝ + ⌜x0⌝ )[n]), ∀ n. ⌜n + 1⌝ < #(⌜asn2 '⌝ + ⌜x0⌝ ) → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((⌜asn2 '⌝ + ⌜x0⌝ )[n], (⌜asn2 '⌝ + ⌜x0⌝ )[n + 1]) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 217:
(as1, n0) = (asn2 ' + x0).last, aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜asn2 '⌝ + ⌜x0⌝ + ⌜(as0, n0 + 1) '⌝ ), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ dom(vs × es) = vs; (s) append-assoc: ⊦ (σ + σ1) + σ2 = σ + σ1 + σ2; from specification stream ⊦ (⌜x⌝ + ⌜x0⌝ )[m] = (x + x0)[m]; (s) add-comm: ⊦ n∞1 + n∞2 = n∞2 + n∞1; from specification nat-inf add-assoc: ⊦ (n∞ + n∞1) + n∞2 = n∞ + n∞1 + n∞2; from specification nat-inf ⊦ ⌜m⌝ < ⌜n⌝ ↔ m < n; (s) ⊦ ⌜n⌝ < ⌜1⌝ + n∞ ↔ ¬ n∞ < ⌜n⌝ ; (s) ⊦ # ⌜x⌝ = ⌜# x⌝ ; (s) ⊦ # a ' = 0 +1; (s) ⊦ #(σ + σ1) = # σ + # σ1; (s) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ ⌜x⌝ [n] = x[n]; (s) ⊦ (⌜a '⌝ + σ)[n + 1] = σ[n]; (s) ⊦ n∞ + ⌜0⌝ = n∞; (s) ⊦ m ≤ n → (⌜(* m)⌝ + n∞2 < ⌜(* n)⌝ + n∞1 ↔ n∞2 < ⌜n - m⌝ + n∞1); (s) ⊦ ⌜m + n⌝ = ⌜m⌝ + ⌜n⌝ ; (s)

Proof step 217 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (⌜asn2 '⌝ + ⌜x0⌝ + ⌜(as0, n0 + 1) '⌝ ), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 218:
⊦ pathp(g)(σ) ↔ (∀ n. ⌜n⌝ < # σ → dom(g)(σ[n])) ∧ (∀ n. ⌜n + 1⌝ < # σ → edge(g)(σ[n], σ[n + 1]))
Proof step 219:
(as1, n0) = (asn2 ' + x0).last, aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), (∃ n. ¬ ( ⌜n⌝ < #(⌜asn2 '⌝ + ⌜x0⌝ + ⌜(as0, n0 + 1) '⌝ ) → dom ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((⌜asn2 '⌝ + ⌜x0⌝ + ⌜(as0, n0 + 1) '⌝ )[n]))) ∨ (∃ n. ¬ ( ⌜n + 1⌝ < #(⌜asn2 '⌝ + ⌜x0⌝ + ⌜(as0, n0 + 1) '⌝ ) → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((⌜asn2 '⌝ + ⌜x0⌝ + ⌜(as0, n0 + 1) '⌝ )[n], (⌜asn2 '⌝ + ⌜x0⌝ + ⌜(as0, n0 + 1) '⌝ )[n + 1]))) ⊦

Rule argument

spec: infgraph-gen, name: pathp-def, seq:⊦ pathp(g)(σ) ↔ (∀ n. ⌜n⌝ < # σ → dom(g)(σ[n])) ∧ (∀ n. ⌜n + 1⌝ < # σ → edge(g)(σ[n], σ[n + 1])), subst:[g, σ] → [ (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1)), ⌜asn2 '⌝ + ⌜x0⌝ + ⌜(as0, n0 + 1) '⌝ ]; ['a] → [('as, Nat)], <all paths>

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1)), ⌜asn2 '⌝ + ⌜x0⌝ + ⌜(as0, n0 + 1) '⌝

Proof step 218 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ pathp(g)(σ) ↔ (∀ n. ⌜n⌝ < # σ → dom(g)(σ[n])) ∧ (∀ n. ⌜n + 1⌝ < # σ → edge(g)(σ[n], σ[n + 1]))

A spec-lemma

Proof step 219 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), (∃ n. ¬ ( ⌜n⌝ < #(⌜asn2 '⌝ + ⌜x0⌝ + ⌜(as0, n0 + 1) '⌝ ) → dom ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((⌜asn2 '⌝ + ⌜x0⌝ + ⌜(as0, n0 + 1) '⌝ )[n]))) ∨ (∃ n. ¬ ( ⌜n + 1⌝ < #(⌜asn2 '⌝ + ⌜x0⌝ + ⌜(as0, n0 + 1) '⌝ ) → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((⌜asn2 '⌝ + ⌜x0⌝ + ⌜(as0, n0 + 1) '⌝ )[n], (⌜asn2 '⌝ + ⌜x0⌝ + ⌜(as0, n0 + 1) '⌝ )[n + 1]))) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 220:
(as1, n0) = (asn2 ' + x0).last, aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ¬ ( n < 2 + # x0 → t(csf((asn2 ' + x0 + (as0, n0 + 1) ')[n]._2), (asn2 ' + x0 + (as0, n0 + 1) ')[n]._1) ∧ aINV((asn2 ' + x0 + (as0, n0 + 1) ')[n]._1)) ∨ ¬ ( ¬ # x0 < n1 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1], (x0 + (as0, n0 + 1) ')[n1])) ⊦

Rule argument

Additional information

Used simplifier rules: append-assoc: ⊦ (σ + σ1) + σ2 = σ + σ1 + σ2; from specification stream c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ (⌜x⌝ + ⌜x0⌝ )[m] = (x + x0)[m]; (s) ⊦ (⌜a '⌝ + σ)[n + 1] = σ[n]; (s) ⊦ (⌜x⌝ + ⌜x0⌝ + ⌜x1⌝ )[m] = (x + x0 + x1)[m]; (s) add-comm: ⊦ n∞1 + n∞2 = n∞2 + n∞1; from specification nat-inf add-assoc: ⊦ (n∞ + n∞1) + n∞2 = n∞ + n∞1 + n∞2; from specification nat-inf ⊦ ⌜m⌝ < ⌜n⌝ ↔ m < n; (s) ⊦ ⌜n⌝ < ⌜1⌝ + n∞ ↔ ¬ n∞ < ⌜n⌝ ; (s) ⊦ m ≤ n → (⌜(* m)⌝ + n∞2 < ⌜(* n)⌝ + n∞1 ↔ n∞2 < ⌜n - m⌝ + n∞1); (s) ⊦ ⌜(* n)⌝ + ⌜(* m)⌝ = ⌜n + m⌝ ; (s) ⊦ # a ' = 0 +1; (s) ⊦ # ⌜x⌝ = ⌜# x⌝ ; (s) ⊦ #(σ + σ1) = # σ + # σ1; (s) ⊦ ⌜m + n⌝ = ⌜m⌝ + ⌜n⌝ ; (s) ⊦ dom(vs × es) = vs; (s) ⊦ ⌜n⌝ < ⌜m⌝ + ⌜n0⌝ ↔ n < m + n0; (s)

Proof step 220 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ¬ ( n < 2 + # x0 → t(csf((asn2 ' + x0 + (as0, n0 + 1) ')[n]._2), (asn2 ' + x0 + (as0, n0 + 1) ')[n]._1) ∧ aINV((asn2 ' + x0 + (as0, n0 + 1) ')[n]._1)) ∨ ¬ ( ¬ # x0 < n1 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1], (x0 + (as0, n0 + 1) ')[n1])) ⊦

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 221:
(as1, n0) = (asn2 ' + x0).last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ¬(n < 2 + # x0 → t(csf(n2), as2) ∧ aINV(as2)) ∨ ¬ ( ¬ # x0 < n1 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1], (x0 + (as0, n0 + 1) ')[n1])) ⊦

Rule argument

term: (asn2 ' + x0 + (as0, n0 + 1) ')[n]._2

Additional information

Used terms: as2, n2

Proof step 221 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ¬(n < 2 + # x0 → t(csf(n2), as2) ∧ aINV(as2)) ∨ ¬ ( ¬ # x0 < n1 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1], (x0 + (as0, n0 + 1) ')[n1])) ⊦

User applied rule case distinction

And obtained the following new goals

Proof step 222:
(as1, n0) = (asn2 ' + x0).last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), n < 2 + # x0, aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1) ⊦ t(csf(n2), as2) ∧ aINV(as2)
Proof step 231:
(as1, n0) = (asn2 ' + x0).last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ # x0 < n1, ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1], (x0 + (as0, n0 + 1) ')[n1]), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1) ⊦

Rule argument

pos: left 25

Additional information

Proof step 222 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), n < 2 + # x0, aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1) ⊦ t(csf(n2), as2) ∧ aINV(as2)

User applied rule all left

And obtained the following new goals

Proof step 223:
(as1, n0) = (asn2 ' + x0).last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), n < 2 + # x0, aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ t(csf(n2), as2) ∧ aINV(as2)

Rule argument

pos: left 25 terms: n abort: F discard: T computed: F

Additional information

Used terms: n

Proof step 223 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), n < 2 + # x0, aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ t(csf(n2), as2) ∧ aINV(as2)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 224:
(as1, n0) = (asn2 ' + x0).last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), (asn2 ' + x0)[n] = (as3, n1), n < 2 + # x0, aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ # x0 < n → t(csf(n1), as3) ∧ aINV(as3), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]) ⊦ t(csf(n2), as2) ∧ aINV(as2)

Rule argument

term: (asn2 ' + x0)[n]._2

Additional information

Used terms: as3, n1

Proof step 224 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), (asn2 ' + x0)[n] = (as3, n1), n < 2 + # x0, aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ # x0 < n → t(csf(n1), as3) ∧ aINV(as3), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]) ⊦ t(csf(n2), as2) ∧ aINV(as2)

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 225:
⊦ n < # x → (x + y)[n] = x[n]
Proof step 226:
(as1, n0) = (asn2 ' + x0).last, (asn2 ' + x0)[n] = (as3, n1), (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), n < 2 + # x0, aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ n < # asn2 ', ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ # x0 < n → t(csf(n1), as3) ∧ aINV(as3), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ t(csf(n2), as2) ∧ aINV(as2)

Rule argument

spec: list-del, name: get-append-less, seq: ⊦ n < # x → (x + y)[n] = x[n], subst:[x, y, n] → [asn2 ', x0 + (as0, n0 + 1) ', n]; ['a] → [('as, Nat)], <all paths>

Additional information

Used simplifier rules: ⊦ n < # x → (x + y)[n] = x[n]; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ # a ' = 0 +1; (s) ⊦ m < 1 ↔ m = 0; (s) f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic lf-02: ⊦ m < n ∧ m = n0 → n0 < n; (forward) from specification nat-basic ⊦ a '[0] = a; (s) ⊦ 0 < m ↔ m ≠ 0; (s) n < n0 ⊦ (* n) ≠ m0 + (* n0); (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic ⊦ ¬ n < 0; (s) Used terms: asn2 ', x0 + (as0, n0 + 1) ', n

Proof step 225 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ n < # x → (x + y)[n] = x[n]

A spec-lemma

Proof step 226 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, (asn2 ' + x0)[n] = (as3, n1), (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), n < 2 + # x0, aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ n < # asn2 ', ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ # x0 < n → t(csf(n1), as3) ∧ aINV(as3), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ t(csf(n2), as2) ∧ aINV(as2)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 227:
(as1, n0) = (asn2 ' + x0).last, x0[n - 1] = (as3, n1), (x0 + (as0, n0 + 1) ')[n - 1] = (as2, n2), n ≠ 0, n < 2 + # x0, aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ # x0 < n → t(csf(n1), as3) ∧ aINV(as3), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ t(csf(n2), as2) ∧ aINV(as2)

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic n < n0 ⊦ (* n) ≠ m0 + (* n0); (s) f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic ⊦ m < 1 ↔ m = 0; (s) ⊦ # a ' = 0 +1; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ ¬ n < # x → (x + y)[n] = y[n - # x]; (s)

Proof step 227 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, x0[n - 1] = (as3, n1), (x0 + (as0, n0 + 1) ')[n - 1] = (as2, n2), n ≠ 0, n < 2 + # x0, aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ # x0 < n → t(csf(n1), as3) ∧ aINV(as3), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ t(csf(n2), as2) ∧ aINV(as2)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 228:
(as1, n0) = (asn2 ' + x0).last, (x0 + (as0, n0 + 1) ')[n3] = (as2, n2), x0[n3] = (as3, n1), n = n3 + 1, n ≠ 0, n < 2 + # x0, aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ # x0 < n → t(csf(n1), as3) ∧ aINV(as3), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]) ⊦ t(csf(n2), as2) ∧ aINV(as2)

Rule argument

spec: nat, name:elim-pred-c, seq:n ≠ 0 ⊦ m = n - 1 ↔ n = m + 1, subst:[n, m] → [n, n3]

Additional information

Used simplifier rules: n ≠ 0 ⊦ m = n - 1 ↔ n = m + 1; (elim) Used terms: n, n3

Proof step 228 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, (x0 + (as0, n0 + 1) ')[n3] = (as2, n2), x0[n3] = (as3, n1), n = n3 + 1, n ≠ 0, n < 2 + # x0, aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ¬ # x0 < n → t(csf(n1), as3) ∧ aINV(as3), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]) ⊦ t(csf(n2), as2) ∧ aINV(as2)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 229:
(as1, n0) = (asn2 ' + x0).last, x0[n3] = (as3, n1), (x0 + (as0, n0 + 1) ')[n3] = (as2, n2), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), n3 ≤ # x0, ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), n3 < # x0 → t(csf(n1), as3) ∧ aINV(as3), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ t(csf(n2), as2) ∧ aINV(as2)

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m < n + 1 ↔ ¬ n < m; (s) ⊦ m < n ↔ ¬ n ≤ m; (ss) n < n0 ⊦ m + (* n) < m0 + (* n0) ↔ m < m0 + (n0 - n); (s) ⊦ m + 1 ≠ 0; (s)

Proof step 229 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, x0[n3] = (as3, n1), (x0 + (as0, n0 + 1) ')[n3] = (as2, n2), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), n3 ≤ # x0, ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), n3 < # x0 → t(csf(n1), as3) ∧ aINV(as3), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦ t(csf(n2), as2) ∧ aINV(as2)

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 230:
⊦ ¬ n < # x → (x + y)[n] = y[n - # x]

Rule argument

spec: list-del, name: get-append-grt, seq: ⊦ ¬ n < # x → (x + y)[n] = y[n - # x], subst:[x, y, n] → [x0, (as0, n0 + 1) ', n3]; ['a] → [('as, Nat)], <all paths>

Additional information

Used simplifier rules: ⊦ m < n ↔ ¬ n ≤ m; (ss) ⊦ m ≤ n → (n ≤ m ↔ m = n); (s) ⊦ m - m = 0; (s) ⊦ a '[0] = a; (s) ⊦ m ≤ m; (s) ⊦ ¬ n < n; (s) ⊦ n < # x → (x + a ')[n] = x[n]; (s) ⊦ m < n → m ≤ n; (s) f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic ⊦ # x = 0 ↔ x = []; (s) ⊦ x ≠ [] → (a ' + x).last = x.last; (s) a: ⊦ (x + y) + z = x + y + z; from specification list Used terms: x0, (as0, n0 + 1) ', n3

Proof step 230 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ ¬ n < # x → (x + y)[n] = y[n - # x]

A spec-lemma

Proof step 231 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), ¬ # x0 < n1, ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1], (x0 + (as0, n0 + 1) ')[n1]), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 232:
(as1, n0) = (asn2 ' + x0).last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), n1 ≤ # x0, ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1], (x0 + (as0, n0 + 1) ')[n1]), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ m < n ↔ ¬ n ≤ m; (ss)

Proof step 232 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), n1 ≤ # x0, ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1], (x0 + (as0, n0 + 1) ')[n1]), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n], x0[n]), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

User applied rule all left

And obtained the following new goals

Proof step 233:
(as1, n0) = (asn2 ' + x0).last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), n1 ≤ # x0, ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1], (x0 + (as0, n0 + 1) ')[n1]), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), n1 < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n1], x0[n1]), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1) ⊦

Rule argument

pos: left 18 terms: n1 abort: F discard: T computed: F

Additional information

Used terms: n1

Proof step 233 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), aINV(as0), aINV(as), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), n1 ≤ # x0, ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1], (x0 + (as0, n0 + 1) ')[n1]), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), n1 < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n1], x0[n1]), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1) ⊦

User applied rule cut formula

And obtained the following new goals

Proof step 234:
(as1, n0) = (asn2 ' + x0).last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), n1 < # x0, aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), n1 ≤ # x0, ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1], (x0 + (as0, n0 + 1) ')[n1]), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), n1 < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n1], x0[n1]), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦
Proof step 251:
(as1, n0) = (asn2 ' + x0).last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), n1 ≤ # x0, ¬ n1 < # x0, ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1], (x0 + (as0, n0 + 1) ')[n1]), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), n1 < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n1], x0[n1]), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Rule argument

fma: n1 < # x0

Additional information

Used formulas: n1 < # x0

Proof step 234 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), n1 < # x0, aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), n1 ≤ # x0, ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1], (x0 + (as0, n0 + 1) ')[n1]), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), n1 < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n1], x0[n1]), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 235:
(as1, n0) = x0.last, x0[n1]._2 = (asn2 ' + x0)[n1]._2 + 1, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0 ≠ [], n1 < # x0, aINV(x0[n1]._1), aINV((asn2 ' + x0)[n1]._1), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))((asn2 ' + x0)[n1]._1, (cext(caf((asn2 ' + x0)[n1]._2)) = None ⊃ [];cext(caf((asn2 ' + x0)[n1]._2)).get '), x0[n1]._1), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(x0[n1]._2), x0[n1]._1), t(csf((asn2 ' + x0)[n1]._2), (asn2 ' + x0)[n1]._1), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1], x0[n1]), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ x ≠ [] → (a ' + x).last = x.last; (s) ⊦ # x = 0 ↔ x = []; (s) f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b); (ws) ⊦ n < # x → (x + a ')[n] = x[n]; (s) ⊦ m < n → m ≤ n; (s)

Proof step 235 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = x0.last, x0[n1]._2 = (asn2 ' + x0)[n1]._2 + 1, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0 ≠ [], n1 < # x0, aINV(x0[n1]._1), aINV((asn2 ' + x0)[n1]._1), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))((asn2 ' + x0)[n1]._1, (cext(caf((asn2 ' + x0)[n1]._2)) = None ⊃ [];cext(caf((asn2 ' + x0)[n1]._2)).get '), x0[n1]._1), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(x0[n1]._2), x0[n1]._1), t(csf((asn2 ' + x0)[n1]._2), (asn2 ' + x0)[n1]._1), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1], x0[n1]), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 236:
(as1, n0) = x0.last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0[n1] = (as3, n3), n3 = (asn2 ' + x0)[n1]._2 + 1, x0 ≠ [], n1 < # x0, aINV(as0), aINV(as), aINV(as1), aINV((asn2 ' + x0)[n1]._1), aINV(as3), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), move(IOAut(astart, astep, aext))((asn2 ' + x0)[n1]._1, (cext(caf((asn2 ' + x0)[n1]._2)) = None ⊃ [];cext(caf((asn2 ' + x0)[n1]._2)).get '), as3), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), t(csf((asn2 ' + x0)[n1]._2), (asn2 ' + x0)[n1]._1), t(csf(n3), as3), ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1], x0[n1]), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1) ⊦

Rule argument

term: x0[n1]._2

Additional information

Used terms: as3, n3

Proof step 236 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = x0.last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0[n1] = (as3, n3), n3 = (asn2 ' + x0)[n1]._2 + 1, x0 ≠ [], n1 < # x0, aINV(as0), aINV(as), aINV(as1), aINV((asn2 ' + x0)[n1]._1), aINV(as3), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), move(IOAut(astart, astep, aext))((asn2 ' + x0)[n1]._1, (cext(caf((asn2 ' + x0)[n1]._2)) = None ⊃ [];cext(caf((asn2 ' + x0)[n1]._2)).get '), as3), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), t(csf((asn2 ' + x0)[n1]._2), (asn2 ' + x0)[n1]._1), t(csf(n3), as3), ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1], x0[n1]), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 237:
(as1, n0) = x0.last, x0[n1] = (as3, (asn2 ' + x0)[n1]._2 + 1), (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0 ≠ [], n1 < # x0, aINV(as3), aINV((asn2 ' + x0)[n1]._1), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))((asn2 ' + x0)[n1]._1, (cext(caf((asn2 ' + x0)[n1]._2)) = None ⊃ [];cext(caf((asn2 ' + x0)[n1]._2)).get '), as3), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf((asn2 ' + x0)[n1]._2 + 1), as3), t(csf((asn2 ' + x0)[n1]._2), (asn2 ' + x0)[n1]._1), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1], x0[n1]), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list

Proof step 237 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = x0.last, x0[n1] = (as3, (asn2 ' + x0)[n1]._2 + 1), (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0 ≠ [], n1 < # x0, aINV(as3), aINV((asn2 ' + x0)[n1]._1), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))((asn2 ' + x0)[n1]._1, (cext(caf((asn2 ' + x0)[n1]._2)) = None ⊃ [];cext(caf((asn2 ' + x0)[n1]._2)).get '), as3), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf((asn2 ' + x0)[n1]._2 + 1), as3), t(csf((asn2 ' + x0)[n1]._2), (asn2 ' + x0)[n1]._1), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1], x0[n1]), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 238:
(as1, n0) = x0.last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0[n1] = (as3, n3 + 1), (asn2 ' + x0)[n1] = (as4, n3), x0 ≠ [], n1 < # x0, aINV(as0), aINV(as), aINV(as1), aINV(as4), aINV(as3), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), move(IOAut(astart, astep, aext))(as4, (cext(caf(n3)) = None ⊃ [];cext(caf(n3)).get '), as3), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), t(csf(n3), as4), t(csf(n3 + 1), as3), ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1], x0[n1]), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1) ⊦

Rule argument

term: (asn2 ' + x0)[n1]._2

Additional information

Used terms: as4, n3

Proof step 238 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = x0.last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0[n1] = (as3, n3 + 1), (asn2 ' + x0)[n1] = (as4, n3), x0 ≠ [], n1 < # x0, aINV(as0), aINV(as), aINV(as1), aINV(as4), aINV(as3), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), move(IOAut(astart, astep, aext))(as4, (cext(caf(n3)) = None ⊃ [];cext(caf(n3)).get '), as3), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), t(csf(n3), as4), t(csf(n3 + 1), as3), ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1], x0[n1]), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 239:
⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b)
Proof step 240:
(as1, n0) = x0.last, (asn2 ' + x0)[n1] = (as4, n3), x0[n1] = (as3, n3 + 1), (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0 ≠ [], n1 < # x0, aINV(as3), aINV(as4), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as4, (cext(caf(n3)) = None ⊃ [];cext(caf(n3)).get '), as3), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n3 + 1), as3), t(csf(n3), as4), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ( ¬ aINV((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1) ∨ ¬ aINV(x0[n1]._1) ∨ x0[n1]._2 ≠ (asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2 + 1 ∨ ¬ move(IOAut(astart, astep, aext)) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1, (cext(caf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2)) = None ⊃ [];cext(caf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2)).get '), x0[n1]._1)) ∨ (¬ t(csf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2), (asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1) ∨ ¬ aINV((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1)) ∨ ¬ t(csf(x0[n1]._2), x0[n1]._1) ∨ ¬ aINV(x0[n1]._1) ⊦

Rule argument

spec: infgraph-gen-basic, name: edge-def, seq: ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b), subst:[vs, es, a, b] → [λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1), λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1), (asn2 ' + x0 + (as0, n0 + 1) ')[n1], x0[n1]]; ['a] → [('as, Nat)], <all paths>

Additional information

Used terms: λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1), λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1), (asn2 ' + x0 + (as0, n0 + 1) ')[n1], x0[n1]

Proof step 239 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b)

A spec-lemma

Proof step 240 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = x0.last, (asn2 ' + x0)[n1] = (as4, n3), x0[n1] = (as3, n3 + 1), (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0 ≠ [], n1 < # x0, aINV(as3), aINV(as4), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as4, (cext(caf(n3)) = None ⊃ [];cext(caf(n3)).get '), as3), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n3 + 1), as3), t(csf(n3), as4), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ( ¬ aINV((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1) ∨ ¬ aINV(x0[n1]._1) ∨ x0[n1]._2 ≠ (asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2 + 1 ∨ ¬ move(IOAut(astart, astep, aext)) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1, (cext(caf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2)) = None ⊃ [];cext(caf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2)).get '), x0[n1]._1)) ∨ (¬ t(csf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2), (asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1) ∨ ¬ aINV((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1)) ∨ ¬ t(csf(x0[n1]._2), x0[n1]._1) ∨ ¬ aINV(x0[n1]._1) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 241:
(as1, n0) = x0.last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0[n1] = (as3, n3 + 1), (asn2 ' + x0)[n1] = (as4, n3), x0 ≠ [], n1 < # x0, aINV(as0), aINV(as), aINV(as1), aINV(as4), aINV(as3), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), move(IOAut(astart, astep, aext))(as4, (cext(caf(n3)) = None ⊃ [];cext(caf(n3)).get '), as3), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), t(csf(n3), as4), t(csf(n3 + 1), as3), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), x0[n1]._2 ≠ (asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2 + 1 ∨ ¬ move(IOAut(astart, astep, aext)) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1, (cext(caf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2)) = None ⊃ [];cext(caf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2)).get '), x0[n1]._1) ∨ ¬ t(csf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2), (asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1) ∨ ¬ aINV((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1) ∨ ¬ t(csf(x0[n1]._2), x0[n1]._1) ∨ ¬ aINV(x0[n1]._1) ⊦

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list

Proof step 241 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = x0.last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0[n1] = (as3, n3 + 1), (asn2 ' + x0)[n1] = (as4, n3), x0 ≠ [], n1 < # x0, aINV(as0), aINV(as), aINV(as1), aINV(as4), aINV(as3), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), move(IOAut(astart, astep, aext))(as4, (cext(caf(n3)) = None ⊃ [];cext(caf(n3)).get '), as3), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), t(csf(n3), as4), t(csf(n3 + 1), as3), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), x0[n1]._2 ≠ (asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2 + 1 ∨ ¬ move(IOAut(astart, astep, aext)) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1, (cext(caf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2)) = None ⊃ [];cext(caf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2)).get '), x0[n1]._1) ∨ ¬ t(csf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2), (asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1) ∨ ¬ aINV((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1) ∨ ¬ t(csf(x0[n1]._2), x0[n1]._1) ∨ ¬ aINV(x0[n1]._1) ⊦

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 242:
(as1, n0) = x0.last, (asn2 ' + x0)[n1] = (as4, n3), x0[n1] = (as3, n3 + 1), (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0[n1] = (as5, n4), x0 ≠ [], n1 < # x0, aINV(as3), aINV(as4), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as4, (cext(caf(n3)) = None ⊃ [];cext(caf(n3)).get '), as3), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n3 + 1), as3), t(csf(n3), as4), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), n4 ≠ (asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2 + 1 ∨ ¬ move(IOAut(astart, astep, aext)) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1, (cext(caf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2)) = None ⊃ [];cext(caf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2)).get '), as5) ∨ ¬ t(csf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2), (asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1) ∨ ¬ aINV((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1) ∨ ¬ t(csf(n4), as5) ∨ ¬ aINV(as5) ⊦

Rule argument

term: x0[n1]._2

Additional information

Used terms: as5, n4

Proof step 242 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = x0.last, (asn2 ' + x0)[n1] = (as4, n3), x0[n1] = (as3, n3 + 1), (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0[n1] = (as5, n4), x0 ≠ [], n1 < # x0, aINV(as3), aINV(as4), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as4, (cext(caf(n3)) = None ⊃ [];cext(caf(n3)).get '), as3), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n3 + 1), as3), t(csf(n3), as4), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), n4 ≠ (asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2 + 1 ∨ ¬ move(IOAut(astart, astep, aext)) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1, (cext(caf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2)) = None ⊃ [];cext(caf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2)).get '), as5) ∨ ¬ t(csf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2), (asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1) ∨ ¬ aINV((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1) ∨ ¬ t(csf(n4), as5) ∨ ¬ aINV(as5) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 243:
(as1, n0) = x0.last, (asn2 ' + x0)[n1] = (as4, n3), x0[n1] = (as3, n3 + 1), (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0 ≠ [], n1 < # x0, aINV(as0), aINV(as), aINV(as1), aINV(as4), aINV(as3), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), move(IOAut(astart, astep, aext))(as4, (cext(caf(n3)) = None ⊃ [];cext(caf(n3)).get '), as3), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), t(csf(n3), as4), t(csf(n3 + 1), as3), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), n3 ≠ (asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2 ∨ ¬ move(IOAut(astart, astep, aext)) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1, (cext(caf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2)) = None ⊃ [];cext(caf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2)).get '), as3) ∨ ¬ t(csf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2), (asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1) ∨ ¬ aINV((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1) ⊦

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m + n = m + n0 ↔ n = n0; (s) a: ⊦ (x + y) + z = x + y + z; from specification list

Proof step 243 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = x0.last, (asn2 ' + x0)[n1] = (as4, n3), x0[n1] = (as3, n3 + 1), (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0 ≠ [], n1 < # x0, aINV(as0), aINV(as), aINV(as1), aINV(as4), aINV(as3), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), move(IOAut(astart, astep, aext))(as4, (cext(caf(n3)) = None ⊃ [];cext(caf(n3)).get '), as3), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), t(csf(n3), as4), t(csf(n3 + 1), as3), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), n3 ≠ (asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2 ∨ ¬ move(IOAut(astart, astep, aext)) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1, (cext(caf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2)) = None ⊃ [];cext(caf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2)).get '), as3) ∨ ¬ t(csf((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2), (asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1) ∨ ¬ aINV((asn2 ' + x0 + (as0, n0 + 1) ')[n1]._1) ⊦

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 244:
(as1, n0) = x0.last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0[n1] = (as3, n3 + 1), (asn2 ' + x0)[n1] = (as4, n3), (asn2 ' + x0 + (as0, n0 + 1) ')[n1] = (as5, n4), x0 ≠ [], n1 < # x0, aINV(as3), aINV(as4), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as4, (cext(caf(n3)) = None ⊃ [];cext(caf(n3)).get '), as3), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n3 + 1), as3), t(csf(n3), as4), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), n3 ≠ n4 ∨ ¬ move(IOAut(astart, astep, aext))(as5, (cext(caf(n4)) = None ⊃ [];cext(caf(n4)).get '), as3) ∨ ¬ t(csf(n4), as5) ∨ ¬ aINV(as5) ⊦

Rule argument

term: (asn2 ' + x0 + (as0, n0 + 1) ')[n1]._2

Additional information

Used terms: as5, n4

Proof step 244 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = x0.last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0[n1] = (as3, n3 + 1), (asn2 ' + x0)[n1] = (as4, n3), (asn2 ' + x0 + (as0, n0 + 1) ')[n1] = (as5, n4), x0 ≠ [], n1 < # x0, aINV(as3), aINV(as4), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as4, (cext(caf(n3)) = None ⊃ [];cext(caf(n3)).get '), as3), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n3 + 1), as3), t(csf(n3), as4), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), n3 ≠ n4 ∨ ¬ move(IOAut(astart, astep, aext))(as5, (cext(caf(n4)) = None ⊃ [];cext(caf(n4)).get '), as3) ∨ ¬ t(csf(n4), as5) ∨ ¬ aINV(as5) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 245:
⊦ n < # x → (x + y)[n] = x[n]
Proof step 246:
(as1, n0) = x0.last, (asn2 ' + x0 + (as0, n0 + 1) ')[n1] = (as5, n4), (asn2 ' + x0)[n1] = (as4, n3), x0[n1] = (as3, n3 + 1), (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0 ≠ [], n1 < # x0, aINV(as0), aINV(as), aINV(as1), aINV(as4), aINV(as3), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), move(IOAut(astart, astep, aext))(as4, (cext(caf(n3)) = None ⊃ [];cext(caf(n3)).get '), as3), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), t(csf(n3), as4), t(csf(n3 + 1), as3), ¬ n1 < # asn2 ', ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), n3 ≠ n4 ∨ ¬ move(IOAut(astart, astep, aext))(as5, (cext(caf(n4)) = None ⊃ [];cext(caf(n4)).get '), as3) ∨ ¬ t(csf(n4), as5) ∨ ¬ aINV(as5) ⊦

Rule argument

spec: list-del, name: get-append-less, seq: ⊦ n < # x → (x + y)[n] = x[n], subst:[x, y, n] → [asn2 ', x0 + (as0, n0 + 1) ', n1]; ['a] → [('as, Nat)], <all paths>

Additional information

Used simplifier rules: ⊦ n < # x → (x + y)[n] = x[n]; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ # a ' = 0 +1; (s) ⊦ m < 1 ↔ m = 0; (s) lf-02: ⊦ m < n ∧ m = n0 → n0 < n; (forward) from specification nat-basic ⊦ a '[0] = a; (s) ⊦ x ≠ [] → x[0] = x.head; (s) ⊦ 0 < m ↔ m ≠ 0; (s) ⊦ # x = 0 ↔ x = []; (s) Used terms: asn2 ', x0 + (as0, n0 + 1) ', n1

Proof step 245 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ n < # x → (x + y)[n] = x[n]

A spec-lemma

Proof step 246 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = x0.last, (asn2 ' + x0 + (as0, n0 + 1) ')[n1] = (as5, n4), (asn2 ' + x0)[n1] = (as4, n3), x0[n1] = (as3, n3 + 1), (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0 ≠ [], n1 < # x0, aINV(as0), aINV(as), aINV(as1), aINV(as4), aINV(as3), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), move(IOAut(astart, astep, aext))(as4, (cext(caf(n3)) = None ⊃ [];cext(caf(n3)).get '), as3), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), t(csf(n3), as4), t(csf(n3 + 1), as3), ¬ n1 < # asn2 ', ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), n3 ≠ n4 ∨ ¬ move(IOAut(astart, astep, aext))(as5, (cext(caf(n4)) = None ⊃ [];cext(caf(n4)).get '), as3) ∨ ¬ t(csf(n4), as5) ∨ ¬ aINV(as5) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 247:
(as1, n0) = x0.last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0[n1] = (as3, n3 + 1), x0[n1 - 1] = (as4, n3), (x0 + (as0, n0 + 1) ')[n1 - 1] = (as5, n4), n1 ≠ 0, x0 ≠ [], n1 < # x0, aINV(as3), aINV(as4), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as4, (cext(caf(n3)) = None ⊃ [];cext(caf(n3)).get '), as3), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n3 + 1), as3), t(csf(n3), as4), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), n3 ≠ n4 ∨ ¬ move(IOAut(astart, astep, aext))(as5, (cext(caf(n4)) = None ⊃ [];cext(caf(n4)).get '), as3) ∨ ¬ t(csf(n4), as5) ∨ ¬ aINV(as5) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ m < 1 ↔ m = 0; (s) ⊦ # a ' = 0 +1; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ ¬ n < # x → (x + y)[n] = y[n - # x]; (s)

Proof step 247 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = x0.last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0[n1] = (as3, n3 + 1), x0[n1 - 1] = (as4, n3), (x0 + (as0, n0 + 1) ')[n1 - 1] = (as5, n4), n1 ≠ 0, x0 ≠ [], n1 < # x0, aINV(as3), aINV(as4), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as4, (cext(caf(n3)) = None ⊃ [];cext(caf(n3)).get '), as3), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n3 + 1), as3), t(csf(n3), as4), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), n3 ≠ n4 ∨ ¬ move(IOAut(astart, astep, aext))(as5, (cext(caf(n4)) = None ⊃ [];cext(caf(n4)).get '), as3) ∨ ¬ t(csf(n4), as5) ∨ ¬ aINV(as5) ⊦

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 248:
(as1, n0) = x0.last, (x0 + (as0, n0 + 1) ')[n5] = (as5, n4), x0[n5] = (as4, n3), x0[n1] = (as3, n3 + 1), (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), n1 = n5 + 1, n1 ≠ 0, x0 ≠ [], n1 < # x0, aINV(as0), aINV(as), aINV(as1), aINV(as4), aINV(as3), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), move(IOAut(astart, astep, aext))(as4, (cext(caf(n3)) = None ⊃ [];cext(caf(n3)).get '), as3), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), t(csf(n3), as4), t(csf(n3 + 1), as3), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), n3 ≠ n4 ∨ ¬ move(IOAut(astart, astep, aext))(as5, (cext(caf(n4)) = None ⊃ [];cext(caf(n4)).get '), as3) ∨ ¬ t(csf(n4), as5) ∨ ¬ aINV(as5) ⊦

Rule argument

spec: nat, name:elim-pred-c, seq:n ≠ 0 ⊦ m = n - 1 ↔ n = m + 1, subst:[n, m] → [n1, n5]

Additional information

Used simplifier rules: n ≠ 0 ⊦ m = n - 1 ↔ n = m + 1; (elim) Used terms: n1, n5

Proof step 248 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = x0.last, (x0 + (as0, n0 + 1) ')[n5] = (as5, n4), x0[n5] = (as4, n3), x0[n1] = (as3, n3 + 1), (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), n1 = n5 + 1, n1 ≠ 0, x0 ≠ [], n1 < # x0, aINV(as0), aINV(as), aINV(as1), aINV(as4), aINV(as3), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), move(IOAut(astart, astep, aext))(as4, (cext(caf(n3)) = None ⊃ [];cext(caf(n3)).get '), as3), t(csf(n0 + 1), as0), t(csf(0), as), t(csf(n0), as1), t(csf(n3), as4), t(csf(n3 + 1), as3), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), n3 ≠ n4 ∨ ¬ move(IOAut(astart, astep, aext))(as5, (cext(caf(n4)) = None ⊃ [];cext(caf(n4)).get '), as3) ∨ ¬ t(csf(n4), as5) ∨ ¬ aINV(as5) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 249:
(as1, n0) = x0.last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0[n5 + 1] = (as3, n3 + 1), x0[n5] = (as4, n3), (x0 + (as0, n0 + 1) ')[n5] = (as5, n4), x0 ≠ [], n5 + 1 < # x0, aINV(as3), aINV(as4), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as4, (cext(caf(n3)) = None ⊃ [];cext(caf(n3)).get '), as3), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n3 + 1), as3), t(csf(n3), as4), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), n3 ≠ n4 ∨ ¬ move(IOAut(astart, astep, aext))(as5, (cext(caf(n4)) = None ⊃ [];cext(caf(n4)).get '), as3) ∨ ¬ t(csf(n4), as5) ∨ ¬ aINV(as5) ⊦

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m + 1 ≠ 0; (s)

Proof step 249 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = x0.last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), x0[n5 + 1] = (as3, n3 + 1), x0[n5] = (as4, n3), (x0 + (as0, n0 + 1) ')[n5] = (as5, n4), x0 ≠ [], n5 + 1 < # x0, aINV(as3), aINV(as4), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as4, (cext(caf(n3)) = None ⊃ [];cext(caf(n3)).get '), as3), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n3 + 1), as3), t(csf(n3), as4), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), n3 ≠ n4 ∨ ¬ move(IOAut(astart, astep, aext))(as5, (cext(caf(n4)) = None ⊃ [];cext(caf(n4)).get '), as3) ∨ ¬ t(csf(n4), as5) ∨ ¬ aINV(as5) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 250:
⊦ ¬ n < # x → (x + y)[n] = y[n - # x]

Rule argument

spec: list-del, name: get-append-grt, seq: ⊦ ¬ n < # x → (x + y)[n] = y[n - # x], subst:[x, y, n] → [x0, (as0, n0 + 1) ', n5]; ['a] → [('as, Nat)], <all paths>

Additional information

Used simplifier rules: ⊦ ¬ m < n → ¬ m + m0 < n; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic ⊦ n < # x → (x + a ')[n] = x[n]; (s) a: ⊦ (x + y) + z = x + y + z; from specification list Used terms: x0, (as0, n0 + 1) ', n5

Proof step 250 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ ¬ n < # x → (x + y)[n] = y[n - # x]

A spec-lemma

Proof step 251 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), n1 ≤ # x0, ¬ n1 < # x0, ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0 + (as0, n0 + 1) ')[n1], (x0 + (as0, n0 + 1) ')[n1]), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), n1 < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((asn2 ' + x0)[n1], x0[n1]), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 252:
(as1, n0) = (asn2 ' + x0).last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((as1, n0), (as0, n0 + 1)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ ¬ n < n; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ (a ' + x + y)[# x] = (a ' + x).last; (s) ⊦ m ≤ m; (s) ⊦ n = # x → (x + a ')[n] = a; (s) ⊦ m ≤ n → (n ≤ m ↔ m = n); (s) ⊦ m < n ↔ ¬ n ≤ m; (ss)

Proof step 252 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

(as1, n0) = (asn2 ' + x0).last, (asn2 ' + x0 + (as0, n0 + 1) ')[n] = (as2, n2), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) (asn2), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as0), t(csf(n0), as1), t(csf(0), as), t(csf(n0 + 1), as0), ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1))) ((as1, n0), (as0, n0 + 1)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. ¬ # x0 < n → t(csf((asn2 ' + x0)[n]._2), (asn2 ' + x0)[n]._1) ∧ aINV((asn2 ' + x0)[n]._1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 253:
⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b)

Rule argument

spec: infgraph-gen-basic, name: edge-def, seq: ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b), subst:[vs, es, a, b] → [λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1), λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1), (as1, n0), (as0, n0 + 1)]; ['a] → [('as, Nat)], <all paths>

Additional information

Used simplifier rules: ⊦ m + n = m + n0 ↔ n = n0; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic Used terms: λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1), λ asn0, asn1. aINV(asn0._1) ∧ aINV(asn1._1) ∧ asn1._2 = asn0._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn0._1, (cext(caf(asn0._2)) = None ⊃ [];cext(caf(asn0._2)).get '), asn1._1), (as1, n0), (as0, n0 + 1)

Proof step 253 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b)

A spec-lemma

Proof step 254 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∃ nf. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (nf(0)) ∧ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜nf⌝ ) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 255:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(0)), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (⌜asnf⌝ ), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ ext !(a ') = (ext(a) = None ⊃ [];ext(a).get '); (s)

Proof step 255 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(0)), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (⌜asnf⌝ ), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 256:
⊦ isroot(g)(b) ↔ dom(g)(b) ∧ (∀ a. ¬ edge(g)(a, b))
Proof step 257:
aINV(as), cINV(csf(0)), cstart(csf(0)), dom ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (⌜asnf⌝ ), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, asnf(0)) ⊦

Rule argument

spec: infgraph-gen, name: isroot-def, seq: ⊦ isroot(g)(b) ↔ dom(g)(b) ∧ (∀ a. ¬ edge(g)(a, b)), subst:[g, b] → [ (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1)), asnf(0)]; ['a] → [('as, Nat)], <all paths>

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1)), asnf(0)

Proof step 256 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ isroot(g)(b) ↔ dom(g)(b) ∧ (∀ a. ¬ edge(g)(a, b))

A spec-lemma

Proof step 257 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), dom ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (⌜asnf⌝ ), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, asnf(0)) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 258:
aINV(as), aINV(asnf(0)._1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (⌜asnf⌝ ), t(csf(0), as), t(csf(asnf(0)._2), asnf(0)._1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, asnf(0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ dom(vs × es) = vs; (s)

Proof step 258 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), aINV(asnf(0)._1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (⌜asnf⌝ ), t(csf(0), as), t(csf(asnf(0)._2), asnf(0)._1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, asnf(0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 259:
asnf(0) = (as0, n), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (⌜asnf⌝ ), t(csf(n), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, asnf(0)) ⊦

Rule argument

term: asnf(0)._1

Additional information

Used terms: as0, n

Proof step 259 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, n), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (⌜asnf⌝ ), t(csf(n), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, asnf(0)) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 260:
asnf(0) = (as0, n), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (⌜asnf⌝ ), t(csf(0), as), t(csf(n), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

Rule argument

Additional information

Proof step 260 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, n), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (⌜asnf⌝ ), t(csf(0), as), t(csf(n), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 261:
⊦ pathp(g)(σ) ↔ (∀ n. ⌜n⌝ < # σ → dom(g)(σ[n])) ∧ (∀ n. ⌜n + 1⌝ < # σ → edge(g)(σ[n], σ[n + 1]))
Proof step 262:
asnf(0) = (as0, n), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)), ∀ n. ⌜n⌝ < # ⌜asnf⌝ → dom ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (⌜asnf⌝ [n]), ∀ n. ⌜n + 1⌝ < # ⌜asnf⌝ → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (⌜asnf⌝ [n], ⌜asnf⌝ [n + 1]) ⊦

Rule argument

spec: infgraph-gen, name: pathp-def, seq:⊦ pathp(g)(σ) ↔ (∀ n. ⌜n⌝ < # σ → dom(g)(σ[n])) ∧ (∀ n. ⌜n + 1⌝ < # σ → edge(g)(σ[n], σ[n + 1])), subst:[g, σ] → [ (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1)), ⌜asnf⌝ ]; ['a] → [('as, Nat)], <all paths>

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1)), ⌜asnf⌝

Proof step 261 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ pathp(g)(σ) ↔ (∀ n. ⌜n⌝ < # σ → dom(g)(σ[n])) ∧ (∀ n. ⌜n + 1⌝ < # σ → edge(g)(σ[n], σ[n + 1]))

A spec-lemma

Proof step 262 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, n), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)), ∀ n. ⌜n⌝ < # ⌜asnf⌝ → dom ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (⌜asnf⌝ [n]), ∀ n. ⌜n + 1⌝ < # ⌜asnf⌝ → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (⌜asnf⌝ [n], ⌜asnf⌝ [n + 1]) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 263:
asnf(0) = (as0, n), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ dom(vs × es) = vs; (s) ⊦ ⌜nf⌝ [n] = nf(n); (s) ⊦ ⌜m⌝ < ∞; (s) ⊦ # ⌜nf⌝ = ∞; (s) add-comm: ⊦ n∞1 + n∞2 = n∞2 + n∞1; from specification nat-inf add-assoc: ⊦ (n∞ + n∞1) + n∞2 = n∞ + n∞1 + n∞2; from specification nat-inf ⊦ ⌜n⌝ ≠ ∞; (s) ⊦ ⌜m⌝ + n∞ = ∞ ↔ n∞ = ∞; (s) ⊦ n∞ < ∞ ↔ n∞ ≠ ∞; (s) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ ⌜m + n⌝ = ⌜m⌝ + ⌜n⌝ ; (s)

Proof step 263 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, n), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

User applied rule cut formula

And obtained the following new goals

Proof step 264:
asnf(0) = (as0, n), n = 0, aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)) ⊦
Proof step 287:
asnf(0) = (as0, n), n ≠ 0, aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)) ⊦

Rule argument

fma: n = 0

Additional information

Used formulas: n = 0

Proof step 264 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, n), n = 0, aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 265:
asnf(0) = (as0, 0), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

Rule argument

Additional information

Proof step 265 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, 0), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

User applied rule cut formula

And obtained the following new goals

Proof step 266:
asnf(0) = (as0, 0), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ n. asnf(n)._2 = n ⊦
Proof step 278:
asnf(0) = (as0, 0), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)) ⊦ ∀ n. asnf(n)._2 = n

Rule argument

fma: ∀ n. asnf(n)._2 = n

Additional information

Used formulas: ∀ n. asnf(n)._2 = n

Proof step 266 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, 0), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ n. asnf(n)._2 = n ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 267:
asnf(0) = (as0, 0), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. asnf(n)._2 = n, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

Rule argument

Additional information

Proof step 267 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, 0), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. asnf(n)._2 = n, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

User applied rule cut formula

And obtained the following new goals

Proof step 268:
asnf(0) = (as0, 0), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ n. asnf(n)._2 = n, ∀ n. move(IOAut(astart, astep, aext))(asnf(n)._1, cext !(caf(n) '), asnf(n + 1)._1) ⊦
Proof step 272:
asnf(0) = (as0, 0), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ n. asnf(n)._2 = n ⊦ ∀ n. move(IOAut(astart, astep, aext))(asnf(n)._1, cext !(caf(n) '), asnf(n + 1)._1)

Rule argument

fma: ∀ n. move(IOAut(astart, astep, aext))(asnf(n)._1, cext !(caf(n) '), asnf(n + 1)._1)

Additional information

Used formulas: ∀ n. move(IOAut(astart, astep, aext))(asnf(n)._1, cext !(caf(n) '), asnf(n + 1)._1)

Proof step 268 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, 0), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ n. asnf(n)._2 = n, ∀ n. move(IOAut(astart, astep, aext))(asnf(n)._1, cext !(caf(n) '), asnf(n + 1)._1) ⊦

User applied rule apply lemma

And obtained the following new goals

Proof step 269:
start(sf(0)), ∀ n. move(IOAut(start, step, ext))(sf(n), cext !(caf(n) '), sf(n + 1)) ⊦ trace(IOAut(start, step, ext))(cext !(⌜caf⌝ ))
Proof step 270:
asnf(0) = (as0, 0), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ astart(asnf(0)._1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. move(IOAut(astart, astep, aext))(asnf(n)._1, cext !(caf(n) '), asnf(n + 1)._1), ∀ n. asnf(n)._2 = n, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

Rule argument

spec: IOtrace, name:infappend-moves-gen, seq:start(sf(0)), ∀ n. move(IOAut(start, step, ext))(sf(n), cext !(caf(n) '), sf(n + 1)) ⊦ trace(IOAut(start, step, ext))(cext !(⌜caf⌝ )), subst:[step, cext, start, sf, caf, ext] → [astep, cext, astart, λ n. asnf(n)._1, caf, aext]; ['e, 's, 'a, 'ca] → ['e, 'as, 'aa, 'ca]

Additional information

Used terms: cext, aext, astart, caf, λ n. asnf(n)._1, astep

Proof step 269 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

start(sf(0)), ∀ n. move(IOAut(start, step, ext))(sf(n), cext !(caf(n) '), sf(n + 1)) ⊦ trace(IOAut(start, step, ext))(cext !(⌜caf⌝ ))

A spec-lemma

Proof step 270 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, 0), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ astart(asnf(0)._1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. move(IOAut(astart, astep, aext))(asnf(n)._1, cext !(caf(n) '), asnf(n + 1)._1), ∀ n. asnf(n)._2 = n, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 271:
asnf(0) = (as0, 0), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ astart(as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. move(IOAut(astart, astep, aext))(asnf(n)._1, (cext(caf(n)) = None ⊃ [];cext(caf(n)).get '), asnf(n + 1)._1), ∀ n. asnf(n)._2 = n, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ ext !(a ') = (ext(a) = None ⊃ [];ext(a).get '); (s)

Proof step 271 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, 0), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ astart(as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. move(IOAut(astart, astep, aext))(asnf(n)._1, (cext(caf(n)) = None ⊃ [];cext(caf(n)).get '), asnf(n + 1)._1), ∀ n. asnf(n)._2 = n, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

pos: left 14 terms: csf(0), as0

Additional information

Used terms: csf(0), as0

Proof step 272 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, 0), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ n. asnf(n)._2 = n ⊦ ∀ n. move(IOAut(astart, astep, aext))(asnf(n)._1, cext !(caf(n) '), asnf(n + 1)._1)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 273:
asnf(0) = (as0, 0), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ move(IOAut(astart, astep, aext))(asnf(n)._1, (cext(caf(n)) = None ⊃ [];cext(caf(n)).get '), asnf(n + 1)._1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. asnf(n)._2 = n, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ ext !(a ') = (ext(a) = None ⊃ [];ext(a).get '); (s)

Proof step 273 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, 0), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ move(IOAut(astart, astep, aext))(asnf(n)._1, (cext(caf(n)) = None ⊃ [];cext(caf(n)).get '), asnf(n + 1)._1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. asnf(n)._2 = n, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 274:
asnf(0) = (as0, 0), asnf(n) = (as1, n0), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ move(IOAut(astart, astep, aext))(as1, (cext(caf(n)) = None ⊃ [];cext(caf(n)).get '), asnf(n + 1)._1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ n. asnf(n)._2 = n ⊦

Rule argument

term: asnf(n)._1

Additional information

Used terms: as1, n0

Proof step 274 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, 0), asnf(n) = (as1, n0), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ move(IOAut(astart, astep, aext))(as1, (cext(caf(n)) = None ⊃ [];cext(caf(n)).get '), asnf(n + 1)._1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ n. asnf(n)._2 = n ⊦

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 275:
asnf(n) = (as1, n0), asnf(0) = (as0, 0), asnf(n + 1) = (as2, n1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ move(IOAut(astart, astep, aext))(as1, (cext(caf(n)) = None ⊃ [];cext(caf(n)).get '), as2), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. asnf(n)._2 = n, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

Rule argument

term: asnf(n + 1)._1

Additional information

Used terms: as2, n1

Proof step 275 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(n) = (as1, n0), asnf(0) = (as0, 0), asnf(n + 1) = (as2, n1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ move(IOAut(astart, astep, aext))(as1, (cext(caf(n)) = None ⊃ [];cext(caf(n)).get '), as2), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. asnf(n)._2 = n, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

User applied rule all left

And obtained the following new goals

Proof step 276:
asnf(n + 1) = (as2, n1), asnf(0) = (as0, 0), asnf(n) = (as1, n0), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n), asnf(n + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ move(IOAut(astart, astep, aext))(as1, (cext(caf(n)) = None ⊃ [];cext(caf(n)).get '), as2), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ n. asnf(n)._2 = n ⊦

Rule argument

pos: left 23 terms: n abort: F discard: T computed: F

Additional information

Used terms: n

Proof step 276 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(n + 1) = (as2, n1), asnf(0) = (as0, 0), asnf(n) = (as1, n0), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n), asnf(n + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ move(IOAut(astart, astep, aext))(as1, (cext(caf(n)) = None ⊃ [];cext(caf(n)).get '), as2), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ n. asnf(n)._2 = n ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 277:
asnf(n) = (as1, n0), asnf(0) = (as0, 0), asnf(n + 1) = (as2, n0 + 1), aINV(as1), aINV(as2), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), t(csf(n0), as1), t(csf(n0 + 1), as2), t(csf(0), as), t(csf(0), as0), ¬ move(IOAut(astart, astep, aext))(as1, (cext(caf(n)) = None ⊃ [];cext(caf(n)).get '), as2), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. asnf(n)._2 = n, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b); (ws)

Proof step 277 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(n) = (as1, n0), asnf(0) = (as0, 0), asnf(n + 1) = (as2, n0 + 1), aINV(as1), aINV(as2), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n0)) = None ⊃ [];cext(caf(n0)).get '), as2), t(csf(n0), as1), t(csf(n0 + 1), as2), t(csf(0), as), t(csf(0), as0), ¬ move(IOAut(astart, astep, aext))(as1, (cext(caf(n)) = None ⊃ [];cext(caf(n)).get '), as2), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n. asnf(n)._2 = n, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

User applied rule all left

And closed the goal!

Rule argument

pos: left 18 terms: n abort: F discard: F computed: F

Additional information

Used terms: n

Proof step 278 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, 0), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)) ⊦ ∀ n. asnf(n)._2 = n

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 279:
asnf(0) = (as0, 0), asnf(n)._2 ≠ n, aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

Rule argument

Additional information

Proof step 279 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, 0), asnf(n)._2 ≠ n, aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 280:
asnf(0) = (as0, 0), asnf(n) = (as1, n0), n0 ≠ n, aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)) ⊦

Rule argument

term: asnf(n)._2

Additional information

Used terms: as1, n0

Proof step 280 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, 0), asnf(n) = (as1, n0), n0 ≠ n, aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)) ⊦

User applied rule weakening

And obtained the following new goals

Proof step 281:
asnf(n) = (as1, n0), asnf(0) = (as0, 0), n0 ≠ n, aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

Rule argument

poslist: left 11, left 20

Additional information

Proof step 281 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(n) = (as1, n0), asnf(0) = (as0, 0), n0 ≠ n, aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

User applied rule structural induction

And obtained the following new goals

Proof step 282:
asnf(0) = (as0, 0), asnf(n1 +1) = (as1, n0), n0 ≠ n1 +1, aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ asnf, as1, n0, as0, aINV, as, cINV, csf, cstart, cstep, cext, caf, t, astart, astep, aext. ¬ ( asnf(n1) = (as1, n0) ∧ asnf(0) = (as0, 0) ∧ n0 ≠ n1 ∧ aINV(as) ∧ aINV(as0) ∧ cINV(csf(0)) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(0), as) ∧ t(csf(0), as0) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0))) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as))) ∧ (∀ n. cINV(csf(n))) ∧ (∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1))) ∧ (∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1))) ⊦

Rule argument

term: n

Additional information

Used simplifier rules: Nat freely generated by 0, +1;;

Proof step 282 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, 0), asnf(n1 +1) = (as1, n0), n0 ≠ n1 +1, aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ asnf, as1, n0, as0, aINV, as, cINV, csf, cstart, cstep, cext, caf, t, astart, astep, aext. ¬ ( asnf(n1) = (as1, n0) ∧ asnf(0) = (as0, 0) ∧ n0 ≠ n1 ∧ aINV(as) ∧ aINV(as0) ∧ cINV(csf(0)) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(0), as) ∧ t(csf(0), as0) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0))) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as))) ∧ (∀ n. cINV(csf(n))) ∧ (∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1))) ∧ (∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1))) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 283:
asnf(0) = (as0, 0), asnf(n1 + 1) = (as1, n0), n0 ≠ n1 + 1, aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ asnf0, as2, n, as3, aINV0, as4, cINV0, csf0, cstart0, cstep0, cext0, caf0, t0, astart0, astep0, aext0. asnf0(n1) ≠ (as2, n) ∨ asnf0(0) ≠ (as3, 0) ∨ n = n1 ∨ ¬ aINV0(as4) ∨ ¬ aINV0(as3) ∨ ¬ cINV0(csf0(0)) ∨ ¬ cstart0(csf0(0)) ∨ ¬ fragω(IOAut(cstart0, cstep0, cext0))(csf0, caf0) ∨ ¬ t0(csf0(0), as4) ∨ ¬ t0(csf0(0), as3) ∨ ¬ (∀ a. ¬ edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, (cext0(caf0(asn._2)) = None ⊃ [];cext0(caf0(asn._2)).get '), asn0._1))) (a, (as3, 0))) ∨ ¬(∀ cs, as. cstart0(cs) ∧ t0(cs, as) ∧ aINV0(as) → astart0(as)) ∨ ¬(∀ as, aa, as0. aINV0(as) ∧ astep0(as, aa, as0) → aINV0(as0)) ∨ ¬(∀ cs, ca, cs0. cINV0(cs) ∧ cstep0(cs, ca, cs0) → cINV0(cs0)) ∨ ¬(∀ as. astart0(as) → aINV0(as)) ∨ ¬(∀ cs. cINV0(cs) → (∃ ass. ∀ as. t0(cs, as) ∧ aINV0(as) ↔ as ∈ ass)) ∨ ¬ (∀ cs, ca, cs0, as0. cINV0(cs) ∧ cstep0(cs, ca, cs0) ∧ t0(cs0, as0) ∧ aINV0(as0) → (∃ as. aINV0(as) ∧ move(IOAut(astart0, astep0, aext0))(as, (cext0(ca) = None ⊃ [];cext0(ca).get '), as0) ∧ t0(cs, as))) ∨ ¬(∀ n. cINV0(csf0(n))) ∨ ¬ (∀ n0. edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, (cext0(caf0(asn._2)) = None ⊃ [];cext0(caf0(asn._2)).get '), asn0._1))) (asnf0(n0), asnf0(n0 + 1))) ∨ ¬(∀ n0. t0(csf0(asnf0(n0)._2), asnf0(n0)._1) ∧ aINV0(asnf0(n0)._1)) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ m +1 = m + 1; (s)

Proof step 283 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, 0), asnf(n1 + 1) = (as1, n0), n0 ≠ n1 + 1, aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(0), as0), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ asnf0, as2, n, as3, aINV0, as4, cINV0, csf0, cstart0, cstep0, cext0, caf0, t0, astart0, astep0, aext0. asnf0(n1) ≠ (as2, n) ∨ asnf0(0) ≠ (as3, 0) ∨ n = n1 ∨ ¬ aINV0(as4) ∨ ¬ aINV0(as3) ∨ ¬ cINV0(csf0(0)) ∨ ¬ cstart0(csf0(0)) ∨ ¬ fragω(IOAut(cstart0, cstep0, cext0))(csf0, caf0) ∨ ¬ t0(csf0(0), as4) ∨ ¬ t0(csf0(0), as3) ∨ ¬ (∀ a. ¬ edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, (cext0(caf0(asn._2)) = None ⊃ [];cext0(caf0(asn._2)).get '), asn0._1))) (a, (as3, 0))) ∨ ¬(∀ cs, as. cstart0(cs) ∧ t0(cs, as) ∧ aINV0(as) → astart0(as)) ∨ ¬(∀ as, aa, as0. aINV0(as) ∧ astep0(as, aa, as0) → aINV0(as0)) ∨ ¬(∀ cs, ca, cs0. cINV0(cs) ∧ cstep0(cs, ca, cs0) → cINV0(cs0)) ∨ ¬(∀ as. astart0(as) → aINV0(as)) ∨ ¬(∀ cs. cINV0(cs) → (∃ ass. ∀ as. t0(cs, as) ∧ aINV0(as) ↔ as ∈ ass)) ∨ ¬ (∀ cs, ca, cs0, as0. cINV0(cs) ∧ cstep0(cs, ca, cs0) ∧ t0(cs0, as0) ∧ aINV0(as0) → (∃ as. aINV0(as) ∧ move(IOAut(astart0, astep0, aext0))(as, (cext0(ca) = None ⊃ [];cext0(ca).get '), as0) ∧ t0(cs, as))) ∨ ¬(∀ n. cINV0(csf0(n))) ∨ ¬ (∀ n0. edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, (cext0(caf0(asn._2)) = None ⊃ [];cext0(caf0(asn._2)).get '), asn0._1))) (asnf0(n0), asnf0(n0 + 1))) ∨ ¬(∀ n0. t0(csf0(asnf0(n0)._2), asnf0(n0)._1) ∧ aINV0(asnf0(n0)._1)) ⊦

User applied rule all left

And obtained the following new goals

Proof step 284:
asnf(n1 + 1) = (as1, n0), asnf(0) = (as0, 0), n0 ≠ n1 + 1, aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n1), asnf(n1 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ∀ asnf0, as2, n, as3, aINV0, as4, cINV0, csf0, cstart0, cstep0, cext0, caf0, t0, astart0, astep0, aext0. asnf0(n1) ≠ (as2, n) ∨ asnf0(0) ≠ (as3, 0) ∨ n = n1 ∨ ¬ aINV0(as4) ∨ ¬ aINV0(as3) ∨ ¬ cINV0(csf0(0)) ∨ ¬ cstart0(csf0(0)) ∨ ¬ fragω(IOAut(cstart0, cstep0, cext0))(csf0, caf0) ∨ ¬ t0(csf0(0), as4) ∨ ¬ t0(csf0(0), as3) ∨ ¬ (∀ a. ¬ edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, (cext0(caf0(asn._2)) = None ⊃ [];cext0(caf0(asn._2)).get '), asn0._1))) (a, (as3, 0))) ∨ ¬(∀ cs, as. cstart0(cs) ∧ t0(cs, as) ∧ aINV0(as) → astart0(as)) ∨ ¬(∀ as, aa, as0. aINV0(as) ∧ astep0(as, aa, as0) → aINV0(as0)) ∨ ¬(∀ cs, ca, cs0. cINV0(cs) ∧ cstep0(cs, ca, cs0) → cINV0(cs0)) ∨ ¬(∀ as. astart0(as) → aINV0(as)) ∨ ¬(∀ cs. cINV0(cs) → (∃ ass. ∀ as. t0(cs, as) ∧ aINV0(as) ↔ as ∈ ass)) ∨ ¬ (∀ cs, ca, cs0, as0. cINV0(cs) ∧ cstep0(cs, ca, cs0) ∧ t0(cs0, as0) ∧ aINV0(as0) → (∃ as. aINV0(as) ∧ move(IOAut(astart0, astep0, aext0))(as, (cext0(ca) = None ⊃ [];cext0(ca).get '), as0) ∧ t0(cs, as))) ∨ ¬(∀ n. cINV0(csf0(n))) ∨ ¬ (∀ n0. edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, (cext0(caf0(asn._2)) = None ⊃ [];cext0(caf0(asn._2)).get '), asn0._1))) (asnf0(n0), asnf0(n0 + 1))) ∨ ¬(∀ n0. t0(csf0(asnf0(n0)._2), asnf0(n0)._1) ∧ aINV0(asnf0(n0)._1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)) ⊦

Rule argument

pos: left 19 terms: n1 abort: F discard: F computed: F

Additional information

Used terms: n1

Proof step 284 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(n1 + 1) = (as1, n0), asnf(0) = (as0, 0), n0 ≠ n1 + 1, aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n1), asnf(n1 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as0), t(csf(0), as), ∀ asnf0, as2, n, as3, aINV0, as4, cINV0, csf0, cstart0, cstep0, cext0, caf0, t0, astart0, astep0, aext0. asnf0(n1) ≠ (as2, n) ∨ asnf0(0) ≠ (as3, 0) ∨ n = n1 ∨ ¬ aINV0(as4) ∨ ¬ aINV0(as3) ∨ ¬ cINV0(csf0(0)) ∨ ¬ cstart0(csf0(0)) ∨ ¬ fragω(IOAut(cstart0, cstep0, cext0))(csf0, caf0) ∨ ¬ t0(csf0(0), as4) ∨ ¬ t0(csf0(0), as3) ∨ ¬ (∀ a. ¬ edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, (cext0(caf0(asn._2)) = None ⊃ [];cext0(caf0(asn._2)).get '), asn0._1))) (a, (as3, 0))) ∨ ¬(∀ cs, as. cstart0(cs) ∧ t0(cs, as) ∧ aINV0(as) → astart0(as)) ∨ ¬(∀ as, aa, as0. aINV0(as) ∧ astep0(as, aa, as0) → aINV0(as0)) ∨ ¬(∀ cs, ca, cs0. cINV0(cs) ∧ cstep0(cs, ca, cs0) → cINV0(cs0)) ∨ ¬(∀ as. astart0(as) → aINV0(as)) ∨ ¬(∀ cs. cINV0(cs) → (∃ ass. ∀ as. t0(cs, as) ∧ aINV0(as) ↔ as ∈ ass)) ∨ ¬ (∀ cs, ca, cs0, as0. cINV0(cs) ∧ cstep0(cs, ca, cs0) ∧ t0(cs0, as0) ∧ aINV0(as0) → (∃ as. aINV0(as) ∧ move(IOAut(astart0, astep0, aext0))(as, (cext0(ca) = None ⊃ [];cext0(ca).get '), as0) ∧ t0(cs, as))) ∨ ¬(∀ n. cINV0(csf0(n))) ∨ ¬ (∀ n0. edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, (cext0(caf0(asn._2)) = None ⊃ [];cext0(caf0(asn._2)).get '), asn0._1))) (asnf0(n0), asnf0(n0 + 1))) ∨ ¬(∀ n0. t0(csf0(asnf0(n0)._2), asnf0(n0)._1) ∧ aINV0(asnf0(n0)._1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 285:
asnf(0) = (as0, 0), asnf(n1 + 1) = (as1, asnf(n1)._2 + 1), asnf(n1)._2 ≠ n1, aINV(asnf(n1)._1), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(asnf(n1)._1, (cext(caf(asnf(n1)._2)) = None ⊃ [];cext(caf(asnf(n1)._2)).get '), as1), t(csf(asnf(n1)._2), asnf(n1)._1), t(csf(asnf(n1)._2 + 1), as1), t(csf(0), as), t(csf(0), as0), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ asnf0, as2, n, as3, aINV0, as4, cINV0, csf0, cstart0, cstep0, cext0, caf0, t0, astart0, astep0, aext0. asnf0(n1) ≠ (as2, n) ∨ asnf0(0) ≠ (as3, 0) ∨ n = n1 ∨ ¬ aINV0(as4) ∨ ¬ aINV0(as3) ∨ ¬ cINV0(csf0(0)) ∨ ¬ cstart0(csf0(0)) ∨ ¬ fragω(IOAut(cstart0, cstep0, cext0))(csf0, caf0) ∨ ¬ t0(csf0(0), as4) ∨ ¬ t0(csf0(0), as3) ∨ ¬ (∀ a. ¬ edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, (cext0(caf0(asn._2)) = None ⊃ [];cext0(caf0(asn._2)).get '), asn0._1))) (a, (as3, 0))) ∨ ¬(∀ cs, as. cstart0(cs) ∧ t0(cs, as) ∧ aINV0(as) → astart0(as)) ∨ ¬(∀ as, aa, as0. aINV0(as) ∧ astep0(as, aa, as0) → aINV0(as0)) ∨ ¬(∀ cs, ca, cs0. cINV0(cs) ∧ cstep0(cs, ca, cs0) → cINV0(cs0)) ∨ ¬(∀ as. astart0(as) → aINV0(as)) ∨ ¬(∀ cs. cINV0(cs) → (∃ ass. ∀ as. t0(cs, as) ∧ aINV0(as) ↔ as ∈ ass)) ∨ ¬ (∀ cs, ca, cs0, as0. cINV0(cs) ∧ cstep0(cs, ca, cs0) ∧ t0(cs0, as0) ∧ aINV0(as0) → (∃ as. aINV0(as) ∧ move(IOAut(astart0, astep0, aext0))(as, (cext0(ca) = None ⊃ [];cext0(ca).get '), as0) ∧ t0(cs, as))) ∨ ¬(∀ n. cINV0(csf0(n))) ∨ ¬ (∀ n0. edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, (cext0(caf0(asn._2)) = None ⊃ [];cext0(caf0(asn._2)).get '), asn0._1))) (asnf0(n0), asnf0(n0 + 1))) ∨ ¬(∀ n0. t0(csf0(asnf0(n0)._2), asnf0(n0)._1) ∧ aINV0(asnf0(n0)._1)) ⊦

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m + n = m + n0 ↔ n = n0; (s) ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b); (ws)

Proof step 285 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, 0), asnf(n1 + 1) = (as1, asnf(n1)._2 + 1), asnf(n1)._2 ≠ n1, aINV(asnf(n1)._1), aINV(as1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(asnf(n1)._1, (cext(caf(asnf(n1)._2)) = None ⊃ [];cext(caf(asnf(n1)._2)).get '), as1), t(csf(asnf(n1)._2), asnf(n1)._1), t(csf(asnf(n1)._2 + 1), as1), t(csf(0), as), t(csf(0), as0), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ asnf0, as2, n, as3, aINV0, as4, cINV0, csf0, cstart0, cstep0, cext0, caf0, t0, astart0, astep0, aext0. asnf0(n1) ≠ (as2, n) ∨ asnf0(0) ≠ (as3, 0) ∨ n = n1 ∨ ¬ aINV0(as4) ∨ ¬ aINV0(as3) ∨ ¬ cINV0(csf0(0)) ∨ ¬ cstart0(csf0(0)) ∨ ¬ fragω(IOAut(cstart0, cstep0, cext0))(csf0, caf0) ∨ ¬ t0(csf0(0), as4) ∨ ¬ t0(csf0(0), as3) ∨ ¬ (∀ a. ¬ edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, (cext0(caf0(asn._2)) = None ⊃ [];cext0(caf0(asn._2)).get '), asn0._1))) (a, (as3, 0))) ∨ ¬(∀ cs, as. cstart0(cs) ∧ t0(cs, as) ∧ aINV0(as) → astart0(as)) ∨ ¬(∀ as, aa, as0. aINV0(as) ∧ astep0(as, aa, as0) → aINV0(as0)) ∨ ¬(∀ cs, ca, cs0. cINV0(cs) ∧ cstep0(cs, ca, cs0) → cINV0(cs0)) ∨ ¬(∀ as. astart0(as) → aINV0(as)) ∨ ¬(∀ cs. cINV0(cs) → (∃ ass. ∀ as. t0(cs, as) ∧ aINV0(as) ↔ as ∈ ass)) ∨ ¬ (∀ cs, ca, cs0, as0. cINV0(cs) ∧ cstep0(cs, ca, cs0) ∧ t0(cs0, as0) ∧ aINV0(as0) → (∃ as. aINV0(as) ∧ move(IOAut(astart0, astep0, aext0))(as, (cext0(ca) = None ⊃ [];cext0(ca).get '), as0) ∧ t0(cs, as))) ∨ ¬(∀ n. cINV0(csf0(n))) ∨ ¬ (∀ n0. edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, (cext0(caf0(asn._2)) = None ⊃ [];cext0(caf0(asn._2)).get '), asn0._1))) (asnf0(n0), asnf0(n0 + 1))) ∨ ¬(∀ n0. t0(csf0(asnf0(n0)._2), asnf0(n0)._1) ∧ aINV0(asnf0(n0)._1)) ⊦

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 286:
asnf(n1 + 1) = (as1, n + 1), asnf(0) = (as0, 0), asnf(n1) = (as2, n), n ≠ n1, aINV(as0), aINV(as), aINV(as1), aINV(as2), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as2, (cext(caf(n)) = None ⊃ [];cext(caf(n)).get '), as1), t(csf(0), as0), t(csf(0), as), t(csf(n + 1), as1), t(csf(n), as2), ∀ asnf0, as2, n, as3, aINV0, as4, cINV0, csf0, cstart0, cstep0, cext0, caf0, t0, astart0, astep0, aext0. asnf0(n1) ≠ (as2, n) ∨ asnf0(0) ≠ (as3, 0) ∨ n = n1 ∨ ¬ aINV0(as4) ∨ ¬ aINV0(as3) ∨ ¬ cINV0(csf0(0)) ∨ ¬ cstart0(csf0(0)) ∨ ¬ fragω(IOAut(cstart0, cstep0, cext0))(csf0, caf0) ∨ ¬ t0(csf0(0), as4) ∨ ¬ t0(csf0(0), as3) ∨ ¬ (∀ a. ¬ edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, (cext0(caf0(asn._2)) = None ⊃ [];cext0(caf0(asn._2)).get '), asn0._1))) (a, (as3, 0))) ∨ ¬(∀ cs, as. cstart0(cs) ∧ t0(cs, as) ∧ aINV0(as) → astart0(as)) ∨ ¬(∀ as, aa, as0. aINV0(as) ∧ astep0(as, aa, as0) → aINV0(as0)) ∨ ¬(∀ cs, ca, cs0. cINV0(cs) ∧ cstep0(cs, ca, cs0) → cINV0(cs0)) ∨ ¬(∀ as. astart0(as) → aINV0(as)) ∨ ¬(∀ cs. cINV0(cs) → (∃ ass. ∀ as. t0(cs, as) ∧ aINV0(as) ↔ as ∈ ass)) ∨ ¬ (∀ cs, ca, cs0, as0. cINV0(cs) ∧ cstep0(cs, ca, cs0) ∧ t0(cs0, as0) ∧ aINV0(as0) → (∃ as. aINV0(as) ∧ move(IOAut(astart0, astep0, aext0))(as, (cext0(ca) = None ⊃ [];cext0(ca).get '), as0) ∧ t0(cs, as))) ∨ ¬(∀ n. cINV0(csf0(n))) ∨ ¬ (∀ n0. edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, (cext0(caf0(asn._2)) = None ⊃ [];cext0(caf0(asn._2)).get '), asn0._1))) (asnf0(n0), asnf0(n0 + 1))) ∨ ¬(∀ n0. t0(csf0(asnf0(n0)._2), asnf0(n0)._1) ∧ aINV0(asnf0(n0)._1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)) ⊦

Rule argument

term: asnf(n1)._2

Additional information

Used terms: as2, n

Proof step 286 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(n1 + 1) = (as1, n + 1), asnf(0) = (as0, 0), asnf(n1) = (as2, n), n ≠ n1, aINV(as0), aINV(as), aINV(as1), aINV(as2), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as2, (cext(caf(n)) = None ⊃ [];cext(caf(n)).get '), as1), t(csf(0), as0), t(csf(0), as), t(csf(n + 1), as1), t(csf(n), as2), ∀ asnf0, as2, n, as3, aINV0, as4, cINV0, csf0, cstart0, cstep0, cext0, caf0, t0, astart0, astep0, aext0. asnf0(n1) ≠ (as2, n) ∨ asnf0(0) ≠ (as3, 0) ∨ n = n1 ∨ ¬ aINV0(as4) ∨ ¬ aINV0(as3) ∨ ¬ cINV0(csf0(0)) ∨ ¬ cstart0(csf0(0)) ∨ ¬ fragω(IOAut(cstart0, cstep0, cext0))(csf0, caf0) ∨ ¬ t0(csf0(0), as4) ∨ ¬ t0(csf0(0), as3) ∨ ¬ (∀ a. ¬ edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, (cext0(caf0(asn._2)) = None ⊃ [];cext0(caf0(asn._2)).get '), asn0._1))) (a, (as3, 0))) ∨ ¬(∀ cs, as. cstart0(cs) ∧ t0(cs, as) ∧ aINV0(as) → astart0(as)) ∨ ¬(∀ as, aa, as0. aINV0(as) ∧ astep0(as, aa, as0) → aINV0(as0)) ∨ ¬(∀ cs, ca, cs0. cINV0(cs) ∧ cstep0(cs, ca, cs0) → cINV0(cs0)) ∨ ¬(∀ as. astart0(as) → aINV0(as)) ∨ ¬(∀ cs. cINV0(cs) → (∃ ass. ∀ as. t0(cs, as) ∧ aINV0(as) ↔ as ∈ ass)) ∨ ¬ (∀ cs, ca, cs0, as0. cINV0(cs) ∧ cstep0(cs, ca, cs0) ∧ t0(cs0, as0) ∧ aINV0(as0) → (∃ as. aINV0(as) ∧ move(IOAut(astart0, astep0, aext0))(as, (cext0(ca) = None ⊃ [];cext0(ca).get '), as0) ∧ t0(cs, as))) ∨ ¬(∀ n. cINV0(csf0(n))) ∨ ¬ (∀ n0. edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, (cext0(caf0(asn._2)) = None ⊃ [];cext0(caf0(asn._2)).get '), asn0._1))) (asnf0(n0), asnf0(n0 + 1))) ∨ ¬(∀ n0. t0(csf0(asnf0(n0)._2), asnf0(n0)._1) ∧ aINV0(asnf0(n0)._1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, 0)) ⊦

User applied rule all left

And closed the goal!

Rule argument

pos: left 17 terms: asnf, as2, n, as0, aINV, as, cINV, csf, cstart, cstep, cext, caf, t, astart, astep, aext abort: F discard: T computed: T

Additional information

Used terms: asnf, as2, n, as0, aINV, as, cINV, csf, cstart, cstep, cext, caf, t, astart, astep, aext

Proof step 287 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, n), n ≠ 0, aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)) ⊦

User applied rule all left

And obtained the following new goals

Proof step 288:
asnf(0) = (as0, n), n ≠ 0, aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(n - 1)) ∧ cstep(csf(n - 1), caf(n - 1), csf(n)) ∧ t(csf(n), as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(caf(n - 1)) = None ⊃ [];cext(caf(n - 1)).get '), as0) ∧ t(csf(n - 1), as)), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

Rule argument

pos: left 14 terms: csf(n - 1), caf(n - 1), csf(n), as0 abort: F discard: T computed: F

Additional information

Used terms: csf(n - 1), caf(n - 1), csf(n), as0

Proof step 288 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, n), n ≠ 0, aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(n - 1)) ∧ cstep(csf(n - 1), caf(n - 1), csf(n)) ∧ t(csf(n), as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(caf(n - 1)) = None ⊃ [];cext(caf(n - 1)).get '), as0) ∧ t(csf(n - 1), as)), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 289:
asnf(0) = (as0, n), n ≠ 0, aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(n - 1)) ∧ cstep(csf(n - 1), caf(n - 1), csf(n)) → aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n - 1)) = None ⊃ [];cext(caf(n - 1)).get '), as0) ∧ t(csf(n - 1), as1), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)) ⊦

Rule argument

Additional information

Proof step 289 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, n), n ≠ 0, aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(n - 1)) ∧ cstep(csf(n - 1), caf(n - 1), csf(n)) → aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n - 1)) = None ⊃ [];cext(caf(n - 1)).get '), as0) ∧ t(csf(n - 1), as1), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)) ⊦

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 290:
asnf(0) = (as0, n), n = n1 + 1, n ≠ 0, aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(n1)) ∧ cstep(csf(n1), caf(n1), csf(n)) → aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n1)) = None ⊃ [];cext(caf(n1)).get '), as0) ∧ t(csf(n1), as1), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

Rule argument

spec: nat, name:elim-pred-c, seq:n ≠ 0 ⊦ m = n - 1 ↔ n = m + 1, subst:[n, m] → [n, n1]

Additional information

Used simplifier rules: n ≠ 0 ⊦ m = n - 1 ↔ n = m + 1; (elim) Used terms: n, n1

Proof step 290 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, n), n = n1 + 1, n ≠ 0, aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(n1)) ∧ cstep(csf(n1), caf(n1), csf(n)) → aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n1)) = None ⊃ [];cext(caf(n1)).get '), as0) ∧ t(csf(n1), as1), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, (as0, n)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 291:
asnf(0) = (as0, n1 + 1), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n1 + 1), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(n1)) ∧ cstep(csf(n1), caf(n1), csf(n1 + 1)) → aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n1)) = None ⊃ [];cext(caf(n1)).get '), as0) ∧ t(csf(n1), as1), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, asnf(0)) ⊦

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m + 1 ≠ 0; (s)

Proof step 291 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, n1 + 1), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n1 + 1), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), cINV(csf(n1)) ∧ cstep(csf(n1), caf(n1), csf(n1 + 1)) → aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, (cext(caf(n1)) = None ⊃ [];cext(caf(n1)).get '), as0) ∧ t(csf(n1), as1), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, asnf(0)) ⊦

User applied rule case distinction

And obtained the following new goals

Proof step 292:
asnf(0) = (as0, n1 + 1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n1 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, asnf(0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦ cINV(csf(n1)) ∧ cstep(csf(n1), caf(n1), csf(n1 + 1))
Proof step 294:
asnf(0) = (as0, n1 + 1), aINV(as), aINV(as0), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n1)) = None ⊃ [];cext(caf(n1)).get '), as0), t(csf(0), as), t(csf(n1 + 1), as0), t(csf(n1), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, asnf(0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

Rule argument

pos: left 10

Additional information

Proof step 292 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, n1 + 1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n1 + 1), as0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, asnf(0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦ cINV(csf(n1)) ∧ cstep(csf(n1), caf(n1), csf(n1 + 1))

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 293:
asnf(0) = (as0, n1 + 1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), cstep(csf(n1), caf(n1), csf(n1 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n1 + 1), as0), ¬ cINV(csf(n1)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, asnf(0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ ¬ step(sf(n), af(n), sf(n + 1)) → (fragω(IOAut(start, step, ext))(sf, af) ↔ false); (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic

Proof step 293 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, n1 + 1), aINV(as), aINV(as0), cINV(csf(0)), cstart(csf(0)), cstep(csf(n1), caf(n1), csf(n1 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), t(csf(n1 + 1), as0), ¬ cINV(csf(n1)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, asnf(0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

pos: left 19 terms: n1

Additional information

Used terms: n1

Proof step 294 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, n1 + 1), aINV(as), aINV(as0), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n1)) = None ⊃ [];cext(caf(n1)).get '), as0), t(csf(0), as), t(csf(n1 + 1), as0), t(csf(n1), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (a, asnf(0)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1) ⊦

User applied rule all left

And obtained the following new goals

Proof step 295:
asnf(0) = (as0, n1 + 1), aINV(as1), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n1)) = None ⊃ [];cext(caf(n1)).get '), as0), t(csf(n1), as1), t(csf(n1 + 1), as0), t(csf(0), as), ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n1), asnf(0)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

Rule argument

pos: left 13 terms: (as1, n1) abort: F discard: T computed: F

Additional information

Used terms: (as1, n1)

Proof step 295 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, n1 + 1), aINV(as1), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n1)) = None ⊃ [];cext(caf(n1)).get '), as0), t(csf(n1), as1), t(csf(n1 + 1), as0), t(csf(0), as), ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) ((as1, n1), asnf(0)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 296:
⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b)
Proof step 297:
asnf(0) = (as0, n1 + 1), aINV(as), aINV(as0), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n1)) = None ⊃ [];cext(caf(n1)).get '), as0), t(csf(0), as), t(csf(n1 + 1), as0), t(csf(n1), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ( ¬ aINV((as1, n1)._1) ∨ ¬ aINV(asnf(0)._1) ∨ asnf(0)._2 ≠ (as1, n1)._2 + 1 ∨ ¬ move(IOAut(astart, astep, aext))((as1, n1)._1, (cext(caf((as1, n1)._2)) = None ⊃ [];cext(caf((as1, n1)._2)).get '), asnf(0)._1)) ∨ (¬ t(csf((as1, n1)._2), (as1, n1)._1) ∨ ¬ aINV((as1, n1)._1)) ∨ ¬ t(csf(asnf(0)._2), asnf(0)._1) ∨ ¬ aINV(asnf(0)._1) ⊦

Rule argument

spec: infgraph-gen-basic, name: edge-def, seq: ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b), subst:[vs, es, a, b] → [λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1), λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1), (as1, n1), asnf(0)]; ['a] → [('as, Nat)], <all paths>

Additional information

Used terms: λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1), λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext)) (asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1), (as1, n1), asnf(0)

Proof step 296 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b)

A spec-lemma

Proof step 297 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, n1 + 1), aINV(as), aINV(as0), aINV(as1), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n1)) = None ⊃ [];cext(caf(n1)).get '), as0), t(csf(0), as), t(csf(n1 + 1), as0), t(csf(n1), as1), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ n. cINV(csf(n)), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ( ¬ aINV((as1, n1)._1) ∨ ¬ aINV(asnf(0)._1) ∨ asnf(0)._2 ≠ (as1, n1)._2 + 1 ∨ ¬ move(IOAut(astart, astep, aext))((as1, n1)._1, (cext(caf((as1, n1)._2)) = None ⊃ [];cext(caf((as1, n1)._2)).get '), asnf(0)._1)) ∨ (¬ t(csf((as1, n1)._2), (as1, n1)._1) ∨ ¬ aINV((as1, n1)._1)) ∨ ¬ t(csf(asnf(0)._2), asnf(0)._1) ∨ ¬ aINV(asnf(0)._1) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 298:
asnf(0) = (as0, n1 + 1), aINV(as1), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n1)) = None ⊃ [];cext(caf(n1)).get '), as0), t(csf(n1), as1), t(csf(n1 + 1), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), asnf(0)._2 ≠ n1 + 1 ∨ ¬ move(IOAut(astart, astep, aext))(as1, (cext(caf(n1)) = None ⊃ [];cext(caf(n1)).get '), asnf(0)._1) ∨ ¬ t(csf(asnf(0)._2), asnf(0)._1) ∨ ¬ aINV(asnf(0)._1) ⊦

Rule argument

Additional information

Proof step 298 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

asnf(0) = (as0, n1 + 1), aINV(as1), aINV(as0), aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, (cext(caf(n1)) = None ⊃ [];cext(caf(n1)).get '), as0), t(csf(n1), as1), t(csf(n1 + 1), as0), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ n0. t(csf(asnf(n0)._2), asnf(n0)._1) ∧ aINV(asnf(n0)._1), ∀ n0. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, (cext(caf(asn._2)) = None ⊃ [];cext(caf(asn._2)).get '), asn0._1))) (asnf(n0), asnf(n0 + 1)), ∀ n. cINV(csf(n)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), asnf(0)._2 ≠ n1 + 1 ∨ ¬ move(IOAut(astart, astep, aext))(as1, (cext(caf(n1)) = None ⊃ [];cext(caf(n1)).get '), asnf(0)._1) ∨ ¬ t(csf(asnf(0)._2), asnf(0)._1) ∨ ¬ aINV(asnf(0)._1) ⊦

Heuristic elimination applied rule apply elim lemma

And closed the goal!

Rule argument

term: asnf(0)._2

Additional information

Used terms: as2, n

Proof step 299 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)) ⊦ ∀ n. cINV(csf(n))

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 300:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ cINV(csf(n)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

Rule argument

Additional information

Proof step 300 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ cINV(csf(n)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

User applied rule apply lemma

And obtained the following new goals

Proof step 301:
frag(IOAut(start, step, ext))(σ, α), iNV(σ[0]), ∀ s, a, s0. iNV(s) ∧ step(s, a, s0) → iNV(s0) ⊦ ∀ n. ⌜n⌝ < # σ → iNV(σ[n])
Proof step 302:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ cINV(csf(n)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)) ⊦ frag(IOAut(cstart, cstep, cext))(⌜csf⌝ , ⌜caf⌝ ) ∧ cINV(⌜csf⌝ [0]) ∧ (∀ s, a, s0. cINV(s) ∧ cstep(s, a, s0) → cINV(s0))
Proof step 304:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ cINV(csf(n)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. ⌜n⌝ < # ⌜csf⌝ → cINV(⌜csf⌝ [n]) ⊦

Rule argument

spec: IOtrace, name:preserve-INV, seq:frag(IOAut(start, step, ext))(σ, α), iNV(σ[0]), ∀ s, a, s0. iNV(s) ∧ step(s, a, s0) → iNV(s0) ⊦ ∀ n. ⌜n⌝ < # σ → iNV(σ[n]), subst:[σ, step, iNV, α, start, ext] → [⌜csf⌝ , cstep, cINV, ⌜caf⌝ , cstart, cext]; ['s, 'a, 'e] → ['cs, 'ca, 'e]

Additional information

Used terms: cext, ⌜caf⌝ , cstart, ⌜csf⌝ , cINV, cstep

Proof step 301 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

frag(IOAut(start, step, ext))(σ, α), iNV(σ[0]), ∀ s, a, s0. iNV(s) ∧ step(s, a, s0) → iNV(s0) ⊦ ∀ n. ⌜n⌝ < # σ → iNV(σ[n])

A spec-lemma

Proof step 302 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ cINV(csf(n)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)) ⊦ frag(IOAut(cstart, cstep, cext))(⌜csf⌝ , ⌜caf⌝ ) ∧ cINV(⌜csf⌝ [0]) ∧ (∀ s, a, s0. cINV(s) ∧ cstep(s, a, s0) → cINV(s0))

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 303:
aINV(as), cINV(csf(0)), cINV(cs), cstart(csf(0)), cstep(cs, ca, cs0), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ cINV(csf(n)), ¬ cINV(cs0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ ⌜nf⌝ [n] = nf(n); (s) ⊦ frag(ioa)(⌜sf⌝ , ⌜af⌝ ) ↔ fragω(ioa)(sf, af); (s)

Proof step 303 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cINV(cs), cstart(csf(0)), cstep(cs, ca, cs0), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ cINV(csf(n)), ¬ cINV(cs0), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

pos: left 14 terms: cs, ca, cs0

Additional information

Used terms: cs, ca, cs0

Proof step 304 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ cINV(csf(n)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ n. ⌜n⌝ < # ⌜csf⌝ → cINV(⌜csf⌝ [n]) ⊦

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 305:
aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ cINV(csf(n)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n0. cINV(csf(n0)) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ ⌜nf⌝ [n] = nf(n); (s) ⊦ ⌜m⌝ < ∞; (s) ⊦ # ⌜nf⌝ = ∞; (s)

Proof step 305 from proof imfiniobackwardinv-implies-leqrefine-aux (previous step) (back to tree)

aINV(as), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ cINV(csf(n)), ¬ trace(IOAut(astart, astep, aext))(cext !(⌜caf⌝ )), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, (cext(ca) = None ⊃ [];cext(ca).get '), as0) ∧ t(cs, as)), ∀ cs. cINV(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n0. cINV(csf(n0)) ⊦