Proof step 1 from proof startfin-weakfin-bwinv-is-leqrefine (conclusion) (back to tree)

System applied rule normalize

And obtained the following new goals

• Proof step 2:

  bwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ C_≤T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass) ⊦

Rule argument

Additional information

Proof step 2 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply lemma

And obtained the following new goals

• Proof step 3:

  ≤BI(cioaut, aioaut) ⊦ C_≤*T_A(cioaut, aioaut)

• Proof step 4:

  bwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ C_≤T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), ¬ ≤BI(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass) ⊦

• Proof step 7:

  C_≤*T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), bwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ C_≤T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass) ⊦

Rule argument

Additional information

Used terms: IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)

Proof step 3 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 4 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 5:

  ⊦ ≤BI(cioaut, aioaut) ↔ (∃ t, aINV, cINV. bwsim(cioaut, aioaut, t, cINV, aINV))

• Proof step 6:

  bwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV), ¬ C_≤T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ t, aINV, cINV. ¬ bwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV) ⊦

Rule argument

Additional information

Used terms: IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)

Proof step 5 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 6 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

Additional information

Used terms: t, aINV, cINV

Proof step 7 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 8:

  ⊦ bwsim(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext), t, cINV, aINV) ↔ (∀ cs. cstart(cs) → cINV(cs)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)))

• Proof step 9:

  C_≤*T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), ¬ C_≤T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)) ⊦

Rule argument

Additional information

Used terms: astep, astart, t, aext, cstart, cstep, aINV, cext, cINV

Proof step 8 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 9 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule cut formula

And obtained the following new goals

• Proof step 10:

  C_≤*T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), ¬ C_≤T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs. (∃ csl, cal. exec*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cs = csl.last) → cINV(cs) ⊦

• Proof step 306:

  C_≤*T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), ¬ C_≤T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass) ⊦ ∀ cs. (∃ csl, cal. exec*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cs = csl.last) → cINV(cs)

Rule argument

Additional information

Used formulas: ∀ cs. (∃ csl, cal. exec*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cs = csl.last) → cINV(cs)

Proof step 10 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 11:

  C_≤*T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), ¬ C_≤T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ IOAut(start, step, ext).start = start; (s) ⊦ exec*(ioa)(sl, al) ↔ frag*(ioa)(sl, al) ∧ ioa.start(sl[0]); (s)

Proof step 11 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 12:

  ⊦ C_≤T_A(cioaut, aioaut) ↔ (∀ β. trace(cioaut)(β) → trace(aioaut)(β))

• Proof step 13:

  C_≤*T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∃ β. ¬(trace(IOAut(cstart, cstep, cext))(β) → trace(IOAut(astart, astep, aext))(β)) ⊦

Rule argument

Additional information

Used terms: IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)

Proof step 12 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 13 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 14:

  C_≤*T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), trace(IOAut(cstart, cstep, cext))(β), ¬ trace(IOAut(astart, astep, aext))(β), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

Rule argument

Additional information

Proof step 14 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 15:

  ⊦ C_≤*T_A(cioaut, aioaut) ↔ (∀ el. trace*(cioaut)(el) → trace*(aioaut)(el))

• Proof step 16:

  trace(IOAut(cstart, cstep, cext))(β), ¬ trace(IOAut(astart, astep, aext))(β), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦

Rule argument

Additional information

Used terms: IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)

Proof step 15 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 16 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 17:

  trace(IOAut(cstart, cstep, cext))(β), ¬ trace(IOAut(astart, astep, aext))(β), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

Rule argument

Additional information

Proof step 17 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule constructor cut

And obtained the following new goals

• Proof step 18:

  β = ⌜el0⌝ , trace(IOAut(cstart, cstep, cext))(β), ¬ trace(IOAut(astart, astep, aext))(β), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦

• Proof step 20:

  β = ⌜ef⌝ , trace(IOAut(cstart, cstep, cext))(β), ¬ trace(IOAut(astart, astep, aext))(β), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦

Rule argument

Additional information

Used simplifier rules: Stream('a) freely generated by ⌜ ⌝, ⌜ ⌝;;

Proof step 18 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 19:

  trace*(IOAut(cstart, cstep, cext))(el0), ¬ trace*(IOAut(astart, astep, aext))(el0), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ trace(ioa)(⌜el⌝ ) ↔ trace*(ioa)(el); (s)

Proof step 19 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

Additional information

Used terms: el0

Proof step 20 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 21:

  traceω(IOAut(cstart, cstep, cext))(ef), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ trace(ioa)(⌜ef⌝ ) ↔ traceω(ioa)(ef); (s)

Proof step 21 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 22:

  ⊦ traceω(IOAut(start, step, ext))(ef) ↔ (∃ sf, af. ⌜ef⌝ = ext !(⌜af⌝ ) ∧ execω(IOAut(start, step, ext))(sf, af))

• Proof step 23:

  ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∃ sf, af. ⌜ef⌝ = cext !(⌜af⌝ ) ∧ execω(IOAut(cstart, cstep, cext))(sf, af) ⊦

Rule argument

Additional information

Used terms: cstart, cstep, cext, ef

Proof step 22 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 23 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 24:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ IOAut(start, step, ext).start = start; (s) ⊦ execω(ioa)(sf, af) ↔ fragω(ioa)(sf, af) ∧ ioa.start(sf(0)); (s)

Proof step 24 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply lemma

And obtained the following new goals

• Proof step 25:

  infgraph(g), finroot(g), finout(g), allreachable(g) ⊦ ∃ nf. isroot(g)(nf(0)) ∧ pathp(g)(⌜nf⌝ )

• Proof step 26:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦ infgraph ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ∧ finroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ∧ finout ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ∧ allreachable ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1)))

• Proof step 257:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∃ nf. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (nf(0)) ∧ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜nf⌝ ) ⊦

Rule argument

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))

Proof step 25 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 26 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 27:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ infgraph ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

• Proof step 66:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ finroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

• Proof step 125:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ finout ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

• Proof step 177:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ allreachable ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

Rule argument

Additional information

Proof step 27 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 28:

  ⊦ infgraph(g) ↔ (∀ s. ∃ a. dom(g)(a) ∧ ¬ a ∈ s)

• Proof step 29:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∃ s. ¬ (∃ a. dom ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ ¬ a ∈ s) ⊦

Rule argument

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))

Proof step 28 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 29 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 30:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

Rule argument

Additional information

Used simplifier rules: ⊦ dom(vs × es) = vs; (s)

Proof step 30 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule cut formula

And obtained the following new goals

• Proof step 31:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∃ n. ∀ asn. asn ∈ asn-s → asn._2 < n ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

• Proof step 50:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s, ∃ n. ∀ asn. asn ∈ asn-s → asn._2 < n

Rule argument

Additional information

Used formulas: ∃ n. ∀ asn. asn ∈ asn-s → asn._2 < n

Proof step 31 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 32:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ asn. asn ∈ asn-s → asn._2 < n, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

Rule argument

Additional information

Proof step 32 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 33:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), cINV(csf(n + 1)) → (∃ as. t(csf(n + 1), as) ∧ aINV(as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 < n ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

Rule argument

Additional information

Used terms: csf(n + 1)

Proof step 33 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 34:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), cINV(csf(n + 1)) → t(csf(n + 1), as) ∧ aINV(as), ∀ asn. asn ∈ asn-s → asn._2 < n, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

Rule argument

Additional information

Proof step 34 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 35:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ cINV(csf(n + 1)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 < n ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

• Proof step 47:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 < n ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

Rule argument

Additional information

Proof step 35 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 36:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ cINV(csf(n + 1)), ¬ traceω(IOAut(astart, astep, aext))(ef), (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ csf(n + 1) = csl.last) → cINV(csf(n + 1)), ∀ asn. asn ∈ asn-s → asn._2 < n, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)) ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

Rule argument

Additional information

Used terms: csf(n + 1)

Proof step 36 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 37:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ cINV(csf(n + 1)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 < n ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s, ∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ csf(n + 1) = csl.last

Rule argument

Additional information

Proof step 37 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule exists right

And obtained the following new goals

• Proof step 38:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ cINV(csf(n + 1)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ asn. asn ∈ asn-s → asn._2 < n, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)) ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s, frag*(IOAut(cstart, cstep, cext))(csf.take(n + 2), caf.take(n + 1)) ∧ cstart(csf.take(n + 2)[0]) ∧ csf(n + 1) = (csf.take(n + 2)).last

Rule argument

Additional information

Used terms: csf.take(n + 2), caf.take(n + 1)

Proof step 38 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 39:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ cINV(csf(n + 1)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 < n ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s, frag*(IOAut(cstart, cstep, cext))(csf.take(n + 2), caf.take(n + 1)) ∧ csf(n + 1) = (csf.take(n + 2)).last

Rule argument

Additional information

Used simplifier rules: m < n ⊦ nf.take(n)[m] = nf(m); (s) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic n < n0 ⊦ (* n) ≠ m0 + (* n0); (s) ⊦ 0 < m ↔ m ≠ 0; (s)

Proof step 39 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 40:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ cINV(csf(n + 1)), ¬ frag*(IOAut(cstart, cstep, cext))(csf.take(n + 2), caf.take(n + 1)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ asn. asn ∈ asn-s → asn._2 < n, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)) ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

• Proof step 42:

  ⌜ef⌝ = cext !(⌜caf⌝ ), csf(n + 1) ≠ (csf.take(n + 2)).last, cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ cINV(csf(n + 1)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ asn. asn ∈ asn-s → asn._2 < n, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)) ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

Rule argument

Additional information

Proof step 40 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply lemma

And obtained the following new goals

• Proof step 41:

  ⊦ frag(IOAut(start, step, ext))(σ, α) ∧ ¬ # α < ⌜n⌝ → frag*(IOAut(start, step, ext))(σ.take(n + 1), α.take(n))

Rule argument

Additional information

Used simplifier rules: ⊦ frag(ioa)(⌜sf⌝ , ⌜af⌝ ) ↔ fragω(ioa)(sf, af); (s) ⊦ # ⌜nf⌝ = ∞; (s) ⊦ ⌜m + n⌝ = ⌜m⌝ + ⌜n⌝ ; (s) ⊦ ¬ ∞ < n∞; (s) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ ⌜nf⌝ .take(n) = nf.take(n); (s) Used terms: cext, n + 1, ⌜caf⌝ , cstep, cstart, ⌜csf⌝

Proof step 41 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 42 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 43:

  ⊦ nf.take(n + 2) = nf(0) + (λ n. nf(n + 1)).take(n + 1)

• Proof step 44:

  ⌜ef⌝ = cext !(⌜caf⌝ ), csf(n + 1) ≠ (csf(0) + (λ n. csf(n + 1)).take(n + 1)).last, cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ cINV(csf(n + 1)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 < n ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

Rule argument

Additional information

Used terms: csf, n

Proof step 43 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 44 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 45:

  ⌜ef⌝ = cext !(⌜caf⌝ ), csf(n + 1) ≠ (csf(0) ' + (λ n. csf(n + 1)).take(n + 1)).last, cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ cINV(csf(n + 1)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ asn. asn ∈ asn-s → asn._2 < n, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)) ⊦ ∃ a. t(csf(a._2), a._1) ∧ aINV(a._1) ∧ ¬ a ∈ asn-s

Rule argument

Additional information

Used simplifier rules: ⊦ a + x = a ' + x; (s)

Proof step 45 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 46:

  ⊦ nf.take(m + 1) = nf.take(m) + nf(m) '

Rule argument

Additional information

Used simplifier rules: ⊦ (a ' + x + b ').last = b; (s) a: ⊦ (x + y) + z = x + y + z; from specification list Used terms: λ n. csf(n + 1), n

Proof step 46 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 47 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule exists right

And obtained the following new goals

• Proof step 48:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ asn. asn ∈ asn-s → asn._2 < n, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ t(csf((as, n + 1)._2), (as, n + 1)._1) ∧ aINV((as, n + 1)._1) ∧ ¬ (as, n + 1) ∈ asn-s

Rule argument

Additional information

Used terms: (as, n + 1)

Proof step 48 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 49:

  ⌜ef⌝ = cext !(⌜caf⌝ ), # asn-s ≠ 0, asn-s ≠ ∅, aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n + 1), as), (as, n + 1) ∈ asn-s, ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ asn. asn ∈ asn-s → asn._2 < n, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

Rule argument

Additional information

Used simplifier rules: size-zero-01: ⊦ s ≠ ∅ → # s ≠ 0; (forward) from specification set-basic ne-01: ⊦ a ∈ s → s ≠ ∅; (forward) from specification set-basic

Proof step 49 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

Additional information

Used simplifier rules: ⊦ ¬ m + n < m; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic Used terms: (as, n + 1)

Proof step 50 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule weakening

And obtained the following new goals

• Proof step 51:

  ⊦ ∃ n. ∀ asn. asn ∈ asn-s → asn._2 < n

Rule argument

Additional information

Proof step 51 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule structural induction

And obtained the following new goals

• Proof step 52:

  ∃ n. ∀ asn. asn ∈ asn-s0 → asn._2 < n ⊦ ∃ n. ∀ asn0. asn0 ∈ asn-s0 ++ asn → asn0._2 < n

Rule argument

Additional information

Used simplifier rules: Set('a) generated by ∅, ++;; ⊦ ¬ a ∈ ∅; (s)

Proof step 52 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 53:

  ∀ asn. asn ∈ asn-s0 → asn._2 < n ⊦ ∃ n0. ∀ asn0. asn0 = asn ∨ asn0 ∈ asn-s0 → asn0._2 < n0

Rule argument

Additional information

Used simplifier rules: ⊦ a ∈ s ++ b ↔ a = b ∨ a ∈ s; (s)

Proof step 53 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule exists right

And obtained the following new goals

• Proof step 54:

  ∀ asn. asn ∈ asn-s0 → asn._2 < n ⊦ ∀ asn0. asn0 = asn ∨ asn0 ∈ asn-s0 → asn0._2 < n, ∃ n0. ∀ asn0. asn0 = asn ∨ asn0 ∈ asn-s0 → asn0._2 < n0

Rule argument

Additional information

Used terms: n

Proof step 54 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 55:

  n ≤ asn0._2, ∀ asn. asn ∈ asn-s0 → asn._2 < n, asn0 = asn ∨ asn0 ∈ asn-s0 ⊦ ∃ n0. ∀ asn0. asn0 = asn ∨ asn0 ∈ asn-s0 → asn0._2 < n0

Rule argument

Additional information

Used simplifier rules: ⊦ m < n ↔ ¬ n ≤ m; (ss)

Proof step 55 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 56:

  asn0 = (as, n0), n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, asn0 = asn ∨ asn0 ∈ asn-s0 ⊦ ∃ n0. ∀ asn0. asn0 = asn ∨ asn0 ∈ asn-s0 → asn0._2 < n0

Rule argument

Additional information

Used terms: as, n0

Proof step 56 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 57:

  n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, (as, n0) = asn ∨ (as, n0) ∈ asn-s0 ⊦ ∃ n0. ∀ asn0. asn0 = asn ∨ asn0 ∈ asn-s0 → asn0._2 < n0

Rule argument

Additional information

Proof step 57 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule exists right

And obtained the following new goals

• Proof step 58:

  n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, (as, n0) = asn ∨ (as, n0) ∈ asn-s0 ⊦ ∀ asn0. asn0 = asn ∨ asn0 ∈ asn-s0 → asn0._2 < n0 + 1

Rule argument

Additional information

Used terms: n0 + 1

Proof step 58 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 59:

  n < asn0._2, n0 < asn0._2, n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, (as, n0) = asn ∨ (as, n0) ∈ asn-s0, asn0 = asn ∨ asn0 ∈ asn-s0 ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ m < n → n ≠ 0; (s) fle-01: ⊦ m ≤ n ∧ n < n0 → m < n0; (forward) from specification nat f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m < n + 1 ↔ ¬ n < m; (s)

Proof step 59 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 60:

  asn0 = (as0, n1), n0 < n1, n < n1, n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, asn0 = asn ∨ asn0 ∈ asn-s0, (as, n0) = asn ∨ (as, n0) ∈ asn-s0 ⊦

Rule argument

Additional information

Used terms: as0, n1

Proof step 60 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 61:

  n < n1, n0 < n1, n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, (as0, n1) = asn ∨ (as0, n1) ∈ asn-s0, (as, n0) = asn ∨ (as, n0) ∈ asn-s0 ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ m < n → n ≠ 0; (s) fle-01: ⊦ m ≤ n ∧ n < n0 → m < n0; (forward) from specification nat f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic

Proof step 61 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 62:

  (as0, n1) = asn, n0 < n1, n < n1, n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, (as, n0) = asn ∨ (as, n0) ∈ asn-s0 ⊦

• Proof step 64:

  n0 < n1, n < n1, (as0, n1) ∈ asn-s0, n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, (as, n0) = asn ∨ (as, n0) ∈ asn-s0 ⊦

Rule argument

Additional information

Proof step 62 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 63:

  # asn-s0 ≠ 0, (as, n0) ≠ (as0, n1), asn-s0 ≠ ∅, n < n1, n0 < n1, (as, n0) ∈ asn-s0, n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n ⊦

Rule argument

Additional information

Used simplifier rules: size-zero-01: ⊦ s ≠ ∅ → # s ≠ 0; (forward) from specification set-basic ne-01: ⊦ a ∈ s → s ≠ ∅; (forward) from specification set-basic ⊦ ¬ n < n; (s) lf-01: ⊦ m < n ∧ n = n0 → m < n0; (forward) from specification nat-basic lf-02: ⊦ m < n ∧ m = n0 → n0 < n; (forward) from specification nat-basic

Proof step 63 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

Additional information

Used simplifier rules: ⊦ m ≤ n → (n < m ↔ false); (s) Used terms: (as, n0)

Proof step 64 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 65:

  # asn-s0 ≠ 0, asn-s0 ≠ ∅, n0 < n1, n < n1, (as0, n1) ∈ asn-s0, n ≤ n0, ∀ asn. asn ∈ asn-s0 → asn._2 < n, (as, n0) = asn ∨ (as, n0) ∈ asn-s0 ⊦

Rule argument

Additional information

Used simplifier rules: size-zero-01: ⊦ s ≠ ∅ → # s ≠ 0; (forward) from specification set-basic ne-01: ⊦ a ∈ s → s ≠ ∅; (forward) from specification set-basic

Proof step 65 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

Additional information

Used simplifier rules: ⊦ m < n → ¬ n < m; (s) Used terms: (as0, n1)

Proof step 66 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 67:

  ⊦ finroot(g) ↔ (∃ s. ∀ a. isroot(g)(a) ↔ a ∈ s)

• Proof step 68:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ s. ¬ (∀ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ↔ a ∈ s) ⊦

Rule argument

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))

Proof step 67 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 68 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 69:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), cstart(csf(0)) → cINV(csf(0)), ∀ s. ¬ (∀ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ↔ a ∈ s), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

Rule argument

Additional information

Used terms: csf(0)

Proof step 69 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 70:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ s. ¬ (∀ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ↔ a ∈ s) ⊦

Rule argument

Additional information

Proof step 70 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule cut formula

And obtained the following new goals

• Proof step 71:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ s. ¬ (∀ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ↔ a ∈ s), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ ass. ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0) ⊦

• Proof step 111:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ s. ¬ (∀ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ↔ a ∈ s), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ ∀ ass. ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0)

Rule argument

Additional information

Used formulas: ∀ ass. ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0)

Proof step 71 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 72:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), cstart(csf(0)) → (∃ ass. ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass), ∀ ass. ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ s. ¬ (∀ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ↔ a ∈ s) ⊦

Rule argument

Additional information

Used terms: csf(0)

Proof step 72 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 73:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ s. ¬ (∀ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ↔ a ∈ s), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ ass. ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦

Rule argument

Additional information

Proof step 73 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 74:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ s. ¬ (∀ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ↔ a ∈ s), ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0) ⊦

Rule argument

Additional information

Used terms: ass

Proof step 74 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 75:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ s. ¬ (∀ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ↔ a ∈ s), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦

Rule argument

Additional information

Proof step 75 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 76:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s ⊦ ∀ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ↔ a ∈ asn-s

Rule argument

Additional information

Used terms: asn-s

Proof step 76 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 77:

  ⌜ef⌝ = cext !(⌜caf⌝ ), ¬ ( isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn) ↔ asn ∈ asn-s), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦

Rule argument

Additional information

Proof step 77 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 78:

  ⊦ isroot(g)(b) ↔ dom(g)(b) ∧ (∀ a. ¬ edge(g)(a, b))

• Proof step 79:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s ⊦ dom ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, asn)) ↔ asn ∈ asn-s

Rule argument

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1)), asn

Proof step 78 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 79 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 80:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦ t(csf(asn._2), asn._1) ∧ aINV(asn._1) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, asn)) ↔ asn ∈ asn-s

Rule argument

Additional information

Used simplifier rules: ⊦ dom(vs × es) = vs; (s)

Proof step 80 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 81:

  asn = (as, n), ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s ⊦ t(csf(n), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, asn)) ↔ asn ∈ asn-s

Rule argument

Additional information

Used terms: as, n

Proof step 81 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 82:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ as. t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass ⊦ t(csf(n), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n))) ↔ (as, n) ∈ asn-s

Rule argument

Additional information

Proof step 82 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 83:

  t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s ⊦ t(csf(n), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n))) ↔ (as, n) ∈ asn-s

Rule argument

Additional information

Used terms: as

Proof step 83 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 84:

  t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, as ∈ ass ↔ (as, 0) ∈ asn-s, ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ t(csf(n), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n))) ↔ (as, n) ∈ asn-s

Rule argument

Additional information

Used terms: as

Proof step 84 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule cut formula

And obtained the following new goals

• Proof step 85:

  as ∈ ass ↔ (as, 0) ∈ asn-s, t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, n = 0, ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦ t(csf(n), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n))) ↔ (as, n) ∈ asn-s

• Proof step 87:

  as ∈ ass ↔ (as, 0) ∈ asn-s, t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ⌜ef⌝ = cext !(⌜caf⌝ ), n ≠ 0, cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦ t(csf(n), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n))) ↔ (as, n) ∈ asn-s

Rule argument

Additional information

Used formulas: n = 0

Proof step 85 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 86:

  t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, as ∈ ass ↔ (as, 0) ∈ asn-s, ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ t(csf(0), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0))) ↔ as ∈ ass

Rule argument

Additional information

Proof step 86 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule case distinction

And closed the goal!

Rule argument

Additional information

Used simplifier rules: ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b); (ws) ⊦ m + 1 ≠ 0; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic

Proof step 87 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 88:

  t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, as ∈ ass ↔ (as, 0) ∈ asn-s, ⌜ef⌝ = cext !(⌜caf⌝ ), n ≠ 0, cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ csf(n - 1) = csl.last) → cINV(csf(n - 1)), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)) ⊦ t(csf(n), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n))) ↔ (as, n) ∈ asn-s

Rule argument

Additional information

Used terms: csf(n - 1)

Proof step 88 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 89:

  as ∈ ass ↔ (as, 0) ∈ asn-s, t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, n = n0 + 1, ⌜ef⌝ = cext !(⌜caf⌝ ), n ≠ 0, cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ csf(n0) = csl.last) → cINV(csf(n0)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦ t(csf(n), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n))) ↔ (as, n) ∈ asn-s

Rule argument

Additional information

Used simplifier rules: n ≠ 0 ⊦ m = n - 1 ↔ n = m + 1; (elim) Used terms: n, n0

Proof step 89 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 90:

  t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, as ∈ ass ↔ (as, 0) ∈ asn-s, ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ csf(n0) = csl.last) → cINV(csf(n0)), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)) ⊦ t(csf(n0 + 1), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1))) ↔ (as, n0 + 1) ∈ asn-s

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m + 1 ≠ 0; (s)

Proof step 90 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 91:

  as ∈ ass ↔ (as, 0) ∈ asn-s, t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦ t(csf(n0 + 1), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1))) ↔ (as, n0 + 1) ∈ asn-s, ∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ csf(n0) = csl.last

• Proof step 98:

  as ∈ ass ↔ (as, 0) ∈ asn-s, t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cINV(csf(n0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦ t(csf(n0 + 1), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1))) ↔ (as, n0 + 1) ∈ asn-s

Rule argument

Additional information

Proof step 91 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 92:

  t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, as ∈ ass ↔ (as, 0) ∈ asn-s, ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)) ⊦ t(csf(n0 + 1), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1))) ↔ (as, n0 + 1) ∈ asn-s, ∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ csf(n0) = csl.last

Rule argument

Additional information

Proof step 92 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 93:

  as ∈ ass ↔ (as, 0) ∈ asn-s, t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), cINV(csf(n0)) → (∃ as. t(csf(n0), as) ∧ aINV(as)), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦ t(csf(n0 + 1), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1))) ↔ (as, n0 + 1) ∈ asn-s, ∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ csf(n0) = csl.last

Rule argument

Additional information

Used terms: csf(n0)

Proof step 93 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 94:

  t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, as ∈ ass ↔ (as, 0) ∈ asn-s, ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), cINV(csf(n0)) → t(csf(n0), as0) ∧ aINV(as0), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)) ⊦ t(csf(n0 + 1), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1))) ↔ (as, n0 + 1) ∈ asn-s, ∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ csf(n0) = csl.last

Rule argument

Additional information

Proof step 94 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule exists right

And obtained the following new goals

• Proof step 95:

  as ∈ ass ↔ (as, 0) ∈ asn-s, t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), cINV(csf(n0)) → t(csf(n0), as0) ∧ aINV(as0), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦ t(csf(n0 + 1), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1))) ↔ (as, n0 + 1) ∈ asn-s, frag*(IOAut(cstart, cstep, cext))(csf.take(n0 + 1), caf.take(n0)) ∧ cstart(csf.take(n0 + 1)[0]) ∧ csf(n0) = (csf.take(n0 + 1)).last

Rule argument

Additional information

Used terms: csf.take(n0 + 1), caf.take(n0)

Proof step 95 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 96:

  t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, as ∈ ass ↔ (as, 0) ∈ asn-s, ⌜ef⌝ = cext !(⌜caf⌝ ), csf(n0) ≠ (csf.take(n0 + 1)).last, cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), cINV(csf(n0)) → t(csf(n0), as0) ∧ aINV(as0), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)) ⊦ t(csf(n0 + 1), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1))) ↔ (as, n0 + 1) ∈ asn-s

Rule argument

Additional information

Used simplifier rules: m < n ⊦ nf.take(n)[m] = nf(m); (s) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m + 1 ≠ 0; (s) ⊦ 0 < m ↔ m ≠ 0; (s) ⊦ fragω(IOAut(start, step, ext))(sf, af) → (frag*(IOAut(start, step, ext))(sf.take(n + 1), af.take(n)) ↔ true); (ss)

Proof step 96 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 97:

  ⊦ nf.take(m + 1) = nf.take(m) + nf(m) '

Rule argument

Additional information

Used simplifier rules: ⊦ (x + a ').last = a; (s) a: ⊦ (x + y) + z = x + y + z; from specification list Used terms: csf, n0

Proof step 97 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 98 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 99:

  ⊦ fragω(ioa)(sf, af) ↔ (∀ n. ioa.step(sf(n), af(n), sf(n +1)))

• Proof step 100:

  t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, as ∈ ass ↔ (as, 0) ∈ asn-s, ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(n0)), cINV(csf(0)), cstart(csf(0)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ n. IOAut(cstart, cstep, cext).step(csf(n), caf(n), csf(n +1)) ⊦ t(csf(n0 + 1), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1))) ↔ (as, n0 + 1) ∈ asn-s

Rule argument

Additional information

Used terms: IOAut(cstart, cstep, cext), csf, caf

Proof step 99 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 100 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 101:

  as ∈ ass ↔ (as, 0) ∈ asn-s, t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cINV(csf(n0)), cstart(csf(0)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ n. cstep(csf(n), caf(n), csf(n + 1)) ⊦ t(csf(n0 + 1), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1))) ↔ (as, n0 + 1) ∈ asn-s

Rule argument

Additional information

Used simplifier rules: ⊦ IOAut(start, step, ext).step = step; (s) ⊦ m +1 = m + 1; (s)

Proof step 101 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 102:

  t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, as ∈ ass ↔ (as, 0) ∈ asn-s, ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(n0)), cINV(csf(0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)) ⊦ t(csf(n0 + 1), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1))) ↔ (as, n0 + 1) ∈ asn-s

Rule argument

Additional information

Used terms: n0

Proof step 102 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 103:

  as ∈ ass ↔ (as, 0) ∈ asn-s, t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), ¬ traceω(IOAut(astart, astep, aext))(ef), cINV(csf(n0)) ∧ cstep(csf(n0), caf(n0), csf(n0 + 1)) ∧ t(csf(n0 + 1), as) ∧ aINV(as) → (∃ as1. aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as) ∧ t(csf(n0), as1)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦ t(csf(n0 + 1), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1))) ↔ (as, n0 + 1) ∈ asn-s

Rule argument

Additional information

Used terms: csf(n0), caf(n0), csf(n0 + 1), as

Proof step 103 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 104:

  t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, as ∈ ass ↔ (as, 0) ∈ asn-s, ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(n0)), cINV(csf(0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), ¬ traceω(IOAut(astart, astep, aext))(ef), t(csf(n0 + 1), as) ∧ aINV(as) → aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as) ∧ t(csf(n0), as1), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦ t(csf(n0 + 1), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1))) ↔ (as, n0 + 1) ∈ asn-s

Rule argument

Additional information

Proof step 104 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 105:

  as ∈ ass ↔ (as, 0) ∈ asn-s, t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cINV(csf(0)), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ¬ (as, n0 + 1) ∈ asn-s, t(csf(n0 + 1), as) ∧ aINV(as) → aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as) ∧ t(csf(n0), as1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1)) ⊦

• Proof step 109:

  as ∈ ass ↔ (as, 0) ∈ asn-s, t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), (as, n0 + 1) ∈ asn-s, ¬ traceω(IOAut(astart, astep, aext))(ef), t(csf(n0 + 1), as) ∧ aINV(as) → aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as) ∧ t(csf(n0), as1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦ t(csf(n0 + 1), as) ∧ aINV(as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1)))

Rule argument

Additional information

Proof step 105 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 106:

  as ∈ ass ↔ (as, 0) ∈ asn-s, t(csf(0), as) ↔ as ∈ ass, ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), aINV(as1), cINV(csf(n0)), cINV(csf(0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0 + 1), as), t(csf(n0), as1), ¬ traceω(IOAut(astart, astep, aext))(ef), ¬ (as, n0 + 1) ∈ asn-s, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1)), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as) ⊦

Rule argument

Additional information

Proof step 106 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 107:

  t(csf(0), as) ↔ as ∈ ass, as ∈ ass ↔ (as, 0) ∈ asn-s, ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as1), aINV(as), cINV(csf(0)), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((as1, n0), (as, n0 + 1)), ¬ traceω(IOAut(astart, astep, aext))(ef), ¬ (as, n0 + 1) ∈ asn-s, ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦

Rule argument

Additional information

Used terms: (as1, n0)

Proof step 107 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 108:

  ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b)

Rule argument

Additional information

Used simplifier rules: ⊦ m + n = m + n0 ↔ n = n0; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic Used terms: λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1), λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1), (as1, n0), (as, n0 + 1)

Proof step 108 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 109 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 110:

  as ∈ ass ↔ (as, 0) ∈ asn-s, t(csf(0), as) ∧ aINV(as) ↔ as ∈ ass, ⌜ef⌝ = cext !(⌜caf⌝ ), # asn-s ≠ 0, asn-s ≠ ∅, cINV(csf(0)), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), (as, n0 + 1) ∈ asn-s, ¬ traceω(IOAut(astart, astep, aext))(ef), t(csf(n0 + 1), as) ∧ aINV(as) → aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as) ∧ t(csf(n0), as1), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦ t(csf(n0 + 1), as) ∧ aINV(as) ∧ ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn, (as, n0 + 1))

Rule argument

Additional information

Used simplifier rules: size-zero-01: ⊦ s ≠ ∅ → # s ≠ 0; (forward) from specification set-basic ne-01: ⊦ a ∈ s → s ≠ ∅; (forward) from specification set-basic

Proof step 110 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

Additional information

Used simplifier rules: ⊦ m + 1 ≠ 0; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic Used terms: (as, n0 + 1)

Proof step 111 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 112:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cINV(csf(0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ s. ¬ (∀ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ↔ a ∈ s) ⊦ ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0)

Rule argument

Additional information

Proof step 112 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule weakening

And obtained the following new goals

• Proof step 113:

  ⊦ ∃ asn-s. (∀ as. as ∈ ass ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0)

Rule argument

Additional information

Proof step 113 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule structural induction

And obtained the following new goals

• Proof step 114:

  ⊦ ∃ asn-s. (∀ as. as ∈ ∅ ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0)

• Proof step 116:

  ∃ asn-s. (∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0) ⊦ ∃ asn-s. (∀ as0. as0 ∈ ass0 ++ as ↔ (as0, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0)

Rule argument

Additional information

Used simplifier rules: Set('a) generated by ∅, ++;;

Proof step 114 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 115:

  ⊦ ∃ asn-s. (∀ as. ¬ (as, 0) ∈ asn-s) ∧ (∀ asn. asn ∈ asn-s → asn._2 = 0)

Rule argument

Additional information

Used simplifier rules: ⊦ ¬ a ∈ ∅; (s)

Proof step 115 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule exists right

And closed the goal!

Rule argument

Additional information

Used simplifier rules: ⊦ ¬ a ∈ ∅; (s) Used terms: ∅

Proof step 116 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 117:

  ∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦ ∃ asn-s0. (∀ as0. as0 = as ∨ as0 ∈ ass0 ↔ (as0, 0) ∈ asn-s0) ∧ (∀ asn. asn ∈ asn-s0 → asn._2 = 0)

Rule argument

Additional information

Used simplifier rules: ⊦ a ∈ s ++ b ↔ a = b ∨ a ∈ s; (s)

Proof step 117 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule exists right

And obtained the following new goals

• Proof step 118:

  ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s ⊦ (∀ as0. as0 = as ∨ as0 ∈ ass0 ↔ (as0, 0) ∈ asn-s ++ (as, 0)) ∧ (∀ asn. asn ∈ asn-s ++ (as, 0) → asn._2 = 0)

Rule argument

Additional information

Used terms: asn-s ++ (as, 0)

Proof step 118 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 119:

  ∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦ (as0 ≠ as → (as0 ∈ ass0 ↔ (as0, 0) ∈ asn-s)) ∧ (asn = (as, 0) ∨ asn ∈ asn-s → asn._2 = 0)

Rule argument

Additional information

Used simplifier rules: ⊦ a ∈ s ++ b ↔ a = b ∨ a ∈ s; (s)

Proof step 119 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 120:

  asn = (as1, n), ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s ⊦ (as0 ≠ as → (as0 ∈ ass0 ↔ (as0, 0) ∈ asn-s)) ∧ (asn = (as, 0) ∨ asn ∈ asn-s → n = 0)

Rule argument

Additional information

Used terms: as1, n

Proof step 120 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 121:

  ∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦ (as0 ≠ as → (as0 ∈ ass0 ↔ (as0, 0) ∈ asn-s)) ∧ ((as1, n) = (as, 0) ∨ (as1, n) ∈ asn-s → n = 0)

Rule argument

Additional information

Proof step 121 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 122:

  ¬(as0 ∈ ass0 ↔ (as0, 0) ∈ asn-s), as0 ≠ as, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s ⊦

• Proof step 123:

  n ≠ 0, ∀ asn. asn ∈ asn-s → asn._2 = 0, ∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s, (as1, n) = (as, 0) ∨ (as1, n) ∈ asn-s ⊦

Rule argument

Additional information

Proof step 122 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And closed the goal!

Rule argument

Additional information

Used terms: as0

Proof step 123 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 124:

  # asn-s ≠ 0, (as1, n) ≠ (as, 0), asn-s ≠ ∅, n ≠ 0, (as1, n) ∈ asn-s, ∀ as. as ∈ ass0 ↔ (as, 0) ∈ asn-s, ∀ asn. asn ∈ asn-s → asn._2 = 0 ⊦

Rule argument

Additional information

Used simplifier rules: size-zero-01: ⊦ s ≠ ∅ → # s ≠ 0; (forward) from specification set-basic ne-01: ⊦ a ∈ s → s ≠ ∅; (forward) from specification set-basic

Proof step 124 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

Additional information

Used terms: (as1, n)

Proof step 125 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 126:

  ⊦ finout(g) ↔ (∀ a. ∃ s. ∀ b. edge(g)(a, b) ↔ b ∈ s)

• Proof step 127:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∃ a. ¬ (∃ s. ∀ b. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, b) ↔ b ∈ s) ⊦

Rule argument

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))

Proof step 126 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 127 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 128:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ ∃ s. ∀ b. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn, b) ↔ b ∈ s

Rule argument

Additional information

Proof step 128 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule constructor cut

And obtained the following new goals

• Proof step 129:

  asn = (as3, n), ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦ ∃ s. ∀ b. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn, b) ↔ b ∈ s

Rule argument

Additional information

Proof step 129 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 130:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ ∃ s. ∀ b. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((as3, n), b) ↔ b ∈ s

Rule argument

Additional information

Proof step 130 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule cut formula

And obtained the following new goals

• Proof step 131:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as3), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦ ∃ s. ∀ b. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((as3, n), b) ↔ b ∈ s

• Proof step 176:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ aINV(as3), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦ ∃ s. ∀ b. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((as3, n), b) ↔ b ∈ s

Rule argument

Additional information

Used formulas: aINV(as3)

Proof step 131 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 132:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as3), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), aINV(as3) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ ∃ s. ∀ b. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((as3, n), b) ↔ b ∈ s

Rule argument

Additional information

Used terms: as3, cext !(caf(n) ')

Proof step 132 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 133:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as3), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ as2. move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ aINV(as2) ↔ as2 ∈ ass ⊦ ∃ s. ∀ b. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((as3, n), b) ↔ b ∈ s

Rule argument

Additional information

Proof step 133 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule cut formula

And obtained the following new goals

• Proof step 134:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as3), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ as2. move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ aINV(as2) ↔ as2 ∈ ass, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∃ asn-s. ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as) ⊦ ∃ s. ∀ b. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((as3, n), b) ↔ b ∈ s

• Proof step 146:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as3), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ as2. move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ aINV(as2) ↔ as2 ∈ ass, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ ∃ s. ∀ b. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((as3, n), b) ↔ b ∈ s, ∃ asn-s. ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as)

Rule argument

Additional information

Used formulas: ∃ asn-s. ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as)

Proof step 134 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 135:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as3), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ as2. move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ aINV(as2) ↔ as2 ∈ ass ⊦ ∃ s. ∀ b. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((as3, n), b) ↔ b ∈ s

Rule argument

Additional information

Proof step 135 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule exists right

And obtained the following new goals

• Proof step 136:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as3), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ as2. move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ aINV(as2) ↔ as2 ∈ ass, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as) ⊦ ∀ b. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((as3, n), b) ↔ b ∈ asn-s

Rule argument

Additional information

Used terms: asn-s

Proof step 136 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 137:

  ⌜ef⌝ = cext !(⌜caf⌝ ), ¬ ( edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((as3, n), asn) ↔ asn ∈ asn-s), aINV(as3), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ as2. move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ aINV(as2) ↔ as2 ∈ ass ⊦

Rule argument

Additional information

Proof step 137 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule constructor cut

And obtained the following new goals

• Proof step 138:

  asn = (as1, n0), ⌜ef⌝ = cext !(⌜caf⌝ ), ¬ ( edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((as3, n), asn) ↔ asn ∈ asn-s), aINV(as3), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ as2. move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ aINV(as2) ↔ as2 ∈ ass, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as) ⊦

Rule argument

Additional information

Proof step 138 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 139:

  ⌜ef⌝ = cext !(⌜caf⌝ ), ¬ ( edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((as3, n), (as1, n0)) ↔ (as1, n0) ∈ asn-s), aINV(as3), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ as2. move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ aINV(as2) ↔ as2 ∈ ass ⊦

Rule argument

Additional information

Proof step 139 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 140:

  (as1, n0) ∈ asn-s ↔ as1 ∈ ass ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as1) ∧ aINV(as1), ⌜ef⌝ = cext !(⌜caf⌝ ), ¬ ( edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((as3, n), (as1, n0)) ↔ (as1, n0) ∈ asn-s), aINV(as3), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ as2. move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ aINV(as2) ↔ as2 ∈ ass, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

Rule argument

Additional information

Used terms: as1, n0

Proof step 140 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 141:

  ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b)

• Proof step 142:

  (as1, n0) ∈ asn-s ↔ as1 ∈ ass ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as1) ∧ aINV(as1), ⌜ef⌝ = cext !(⌜caf⌝ ), ¬ ( ( aINV((as3, n)._1) ∧ aINV((as1, n0)._1) ∧ (as1, n0)._2 = (as3, n)._2 + 1 ∧ move(IOAut(astart, astep, aext))((as3, n)._1, cext !(caf((as3, n)._2) '), (as1, n0)._1)) ∧ (t(csf((as3, n)._2), (as3, n)._1) ∧ aINV((as3, n)._1)) ∧ t(csf((as1, n0)._2), (as1, n0)._1) ∧ aINV((as1, n0)._1) ↔ (as1, n0) ∈ asn-s), aINV(as3), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ as2. move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ aINV(as2) ↔ as2 ∈ ass ⊦

Rule argument

Additional information

Used terms: λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1), λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1), (as3, n), (as1, n0)

Proof step 141 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 142 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 143:

  (as1, n0) ∈ asn-s ↔ as1 ∈ ass ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as1) ∧ aINV(as1), ⌜ef⌝ = cext !(⌜caf⌝ ), ¬(aINV(as1) ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as1) ↔ (as1, n0) ∈ asn-s), aINV(as3), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ as2. move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ aINV(as2) ↔ as2 ∈ ass, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

Rule argument

Additional information

Proof step 143 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 144:

  (as1, n0) ∈ asn-s ↔ as1 ∈ ass ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as1) ∧ aINV(as1), n0 = n + 1, ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as3), aINV(as1), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1), t(csf(n), as3), t(csf(n + 1), as1), ¬ traceω(IOAut(astart, astep, aext))(ef), ¬ (as1, n0) ∈ asn-s, ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ as2. move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ aINV(as2) ↔ as2 ∈ ass ⊦

Rule argument

Additional information

Proof step 144 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 145:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as1), aINV(as3), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1), t(csf(n + 1), as1), t(csf(n), as3), ¬ traceω(IOAut(astart, astep, aext))(ef), ¬ (as1, n + 1) ∈ asn-s, ¬ as1 ∈ ass, ∀ as2. move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ aINV(as2) ↔ as2 ∈ ass, ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

Rule argument

Additional information

Proof step 145 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

Additional information

Used terms: as1

Proof step 146 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule weakening

And obtained the following new goals

• Proof step 147:

  ⊦ ∃ asn-s. ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as)

Rule argument

Additional information

Proof step 147 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule structural induction

And obtained the following new goals

• Proof step 148:

  ⊦ ∃ asn-s. ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ∅ ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as)

• Proof step 150:

  ∀ n, astart, astep, aext, as3, cext, caf, t, csf, aINV. ∃ asn-s. ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as) ⊦ ∃ asn-s. ∀ as0, m0. (as0, m0) ∈ asn-s ↔ as0 ∈ ass0 ++ as ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as0) ∧ aINV(as0)

Rule argument

Additional information

Used simplifier rules: Set('a) generated by ∅, ++;;

Proof step 148 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 149:

  ⊦ ∃ asn-s. ∀ as, n0. ¬ (as, n0) ∈ asn-s

Rule argument

Additional information

Used simplifier rules: ⊦ ¬ a ∈ ∅; (s)

Proof step 149 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule exists right

And closed the goal!

Rule argument

Additional information

Used simplifier rules: ⊦ ¬ a ∈ ∅; (s) Used terms: ∅

Proof step 150 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 151:

  ∀ n, astart, astep, aext, as3, cext, caf, t, csf, aINV. ∃ asn-s. ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as) ⊦ ∃ asn-s. ∀ as0, n0. (as0, n0) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as0) ∧ aINV(as0)

Rule argument

Additional information

Used simplifier rules: ⊦ a ∈ s ++ b ↔ a = b ∨ a ∈ s; (s)

Proof step 151 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 152:

  ∃ asn-s. ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as) ⊦ ∃ asn-s. ∀ as0, n0. (as0, n0) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as0) ∧ aINV(as0)

Rule argument

Additional information

Used terms: n, astart, astep, aext, as3, cext, caf, t, csf, aINV

Proof step 152 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 153:

  ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as) ⊦ ∃ asn-s. ∀ as0, n0. (as0, n0) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as0) ∧ aINV(as0)

Rule argument

Additional information

Proof step 153 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule exists right

And obtained the following new goals

• Proof step 154:

  ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as) ⊦ ∀ as0, n0. (as0, n0) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as0) ∧ aINV(as0), ∃ asn-s. ∀ as0, n0. (as0, n0) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as0) ∧ aINV(as0)

Rule argument

Additional information

Used terms: asn-s

Proof step 154 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 155:

  ¬ ( (as0, n0) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as0) ∧ aINV(as0)), ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as) ⊦ ∃ asn-s. ∀ as0, n0. (as0, n0) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as0) ∧ aINV(as0)

Rule argument

Additional information

Proof step 155 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule exists right

And obtained the following new goals

• Proof step 156:

  ¬ ( (as0, n0) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as0) ∧ aINV(as0)), ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as) ⊦ ∀ as0, n0. (as0, n0) ∈ asn-s ++ (as, n + 1) ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as0) ∧ aINV(as0)

Rule argument

Additional information

Used terms: asn-s ++ (as, n + 1)

Proof step 156 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 157:

  ¬ ( (as0, n0) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as0) ∧ aINV(as0)), ¬ ( (as1, n1) = (as, n + 1) ∨ (as1, n1) ∈ asn-s ↔ (as1 = as ∨ as1 ∈ ass0) ∧ n1 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as1) ∧ aINV(as1)), ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ a ∈ s ++ b ↔ a = b ∨ a ∈ s; (s)

Proof step 157 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 158:

  ¬ ( (as0, n0) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as0) ∧ aINV(as0)), ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as), (as1, n1) = (as, n + 1) ∨ (as1, n1) ∈ asn-s ⊦ (as1 = as ∨ as1 ∈ ass0) ∧ n1 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as1) ∧ aINV(as1)

• Proof step 170:

  n1 = n + 1, (as1, n1) ≠ (as, n + 1), ¬ ( (as0, n0) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as0) ∧ aINV(as0)), aINV(as1), move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1), t(csf(n), as3), t(csf(n + 1), as1), ¬ (as1, n1) ∈ asn-s, ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as), as1 = as ∨ as1 ∈ ass0 ⊦

Rule argument

Additional information

Proof step 158 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 159:

  (as0, n0) ∈ asn-s, ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as), (as1, n1) = (as, n + 1) ∨ (as1, n1) ∈ asn-s ⊦ (as1 = as ∨ as1 ∈ ass0) ∧ n1 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as1) ∧ aINV(as1), (as0 = as ∨ as0 ∈ ass0) ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as0) ∧ aINV(as0)

• Proof step 164:

  n0 = n + 1, aINV(as0), move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0), t(csf(n), as3), t(csf(n + 1), as0), ¬ (as0, n0) ∈ asn-s, ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as), (as1, n1) = (as, n + 1) ∨ (as1, n1) ∈ asn-s, as0 = as ∨ as0 ∈ ass0 ⊦ (as1 = as ∨ as1 ∈ ass0) ∧ n1 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as1) ∧ aINV(as1)

Rule argument

Additional information

Proof step 159 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 160:

  # asn-s ≠ 0, asn-s ≠ ∅, (as0, n0) ∈ asn-s, ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as), (as1, n1) = (as, n + 1) ∨ (as1, n1) ∈ asn-s ⊦ (as1 = as ∨ as1 ∈ ass0) ∧ n1 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as1) ∧ aINV(as1), (as0 = as ∨ as0 ∈ ass0) ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as0) ∧ aINV(as0)

Rule argument

Additional information

Used simplifier rules: size-zero-01: ⊦ s ≠ ∅ → # s ≠ 0; (forward) from specification set-basic ne-01: ⊦ a ∈ s → s ≠ ∅; (forward) from specification set-basic

Proof step 160 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 161:

  (as1, n1) = (as, n + 1), # asn-s ≠ 0, asn-s ≠ ∅, (as0, n0) ∈ asn-s, ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as) ⊦ (as0 = as ∨ as0 ∈ ass0) ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as0) ∧ aINV(as0), (as1 = as ∨ as1 ∈ ass0) ∧ n1 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as1) ∧ aINV(as1)

• Proof step 163:

  # asn-s ≠ 0, asn-s ≠ ∅, (as0, n0) ∈ asn-s, (as1, n1) ∈ asn-s, ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as) ⊦ (as0 = as ∨ as0 ∈ ass0) ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as0) ∧ aINV(as0), (as1 = as ∨ as1 ∈ ass0) ∧ n1 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as1) ∧ aINV(as1)

Rule argument

Additional information

Proof step 161 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 162:

  # asn-s ≠ 0, asn-s ≠ ∅, (as0, n0) ∈ asn-s, ∀ as, m0. (as, m0) ∈ asn-s ↔ as ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as) ⊦ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as) ∧ aINV(as), (as0 = as ∨ as0 ∈ ass0) ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0) ∧ t(csf(n), as3) ∧ t(csf(n + 1), as0) ∧ aINV(as0)

Rule argument

Additional information

Proof step 162 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And closed the goal!

Rule argument

Additional information

Used terms: as0, n0

Proof step 163 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And closed the goal!

Rule argument

Additional information

Used terms: as1, n1

Proof step 164 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 165:

  aINV(as0), move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0), t(csf(n + 1), as0), t(csf(n), as3), ¬ (as0, n + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ t(csf(n + 1), as2) ∧ aINV(as2), as0 = as ∨ as0 ∈ ass0, (as1, n1) = (as, n + 1) ∨ (as1, n1) ∈ asn-s ⊦ (as1 = as ∨ as1 ∈ ass0) ∧ n1 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1) ∧ t(csf(n + 1), as1) ∧ aINV(as1)

Rule argument

Additional information

Proof step 165 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 166:

  (as0, n + 1) ∈ asn-s ↔ as0 ∈ ass0 ∧ n + 1 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0) ∧ t(csf(n + 1), as0) ∧ aINV(as0), aINV(as0), move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0), t(csf(n), as3), t(csf(n + 1), as0), ¬ (as0, n + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ t(csf(n + 1), as2) ∧ aINV(as2), (as1, n1) = (as, n + 1) ∨ (as1, n1) ∈ asn-s, as0 = as ∨ as0 ∈ ass0 ⊦ (as1 = as ∨ as1 ∈ ass0) ∧ n1 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1) ∧ t(csf(n + 1), as1) ∧ aINV(as1)

Rule argument

Additional information

Used terms: as0, n + 1

Proof step 166 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 167:

  aINV(as), move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as), t(csf(n), as3), t(csf(n + 1), as), ¬ as ∈ ass0, ¬ (as, n + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ t(csf(n + 1), as2) ∧ aINV(as2), (as1, n1) = (as, n + 1) ∨ (as1, n1) ∈ asn-s ⊦ (as1 = as ∨ as1 ∈ ass0) ∧ n1 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1) ∧ t(csf(n + 1), as1) ∧ aINV(as1)

Rule argument

Additional information

Proof step 167 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 168:

  aINV(as), move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as), t(csf(n + 1), as), t(csf(n), as3), (as1, n1) ∈ asn-s, ¬ as ∈ ass0, ¬ (as, n + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ t(csf(n + 1), as2) ∧ aINV(as2) ⊦ (as1 = as ∨ as1 ∈ ass0) ∧ n1 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1) ∧ t(csf(n + 1), as1) ∧ aINV(as1)

Rule argument

Additional information

Proof step 168 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 169:

  # asn-s ≠ 0, asn-s ≠ ∅, aINV(as), move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as), t(csf(n + 1), as), t(csf(n), as3), (as1, n1) ∈ asn-s, ¬ (as, n + 1) ∈ asn-s, ¬ as ∈ ass0, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ t(csf(n + 1), as2) ∧ aINV(as2) ⊦ as1 ∈ ass0 ∧ n1 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1) ∧ t(csf(n + 1), as1) ∧ aINV(as1)

Rule argument

Additional information

Used simplifier rules: size-zero-01: ⊦ s ≠ ∅ → # s ≠ 0; (forward) from specification set-basic ne-01: ⊦ a ∈ s → s ≠ ∅; (forward) from specification set-basic

Proof step 169 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And closed the goal!

Rule argument

Additional information

Used terms: as1, n1

Proof step 170 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 171:

  # ass0 ≠ 0, ¬ ( (as0, n0) ∈ asn-s ↔ (as0 = as ∨ as0 ∈ ass0) ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0) ∧ t(csf(n + 1), as0) ∧ aINV(as0)), as1 ≠ as, ass0 ≠ ∅, aINV(as1), move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1), t(csf(n), as3), t(csf(n + 1), as1), as1 ∈ ass0, ¬ (as1, n + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ t(csf(n + 1), as2) ∧ aINV(as2) ⊦

Rule argument

Additional information

Used simplifier rules: size-zero-01: ⊦ s ≠ ∅ → # s ≠ 0; (forward) from specification set-basic ne-01: ⊦ a ∈ s → s ≠ ∅; (forward) from specification set-basic

Proof step 171 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 172:

  # ass0 ≠ 0, as1 ≠ as, ass0 ≠ ∅, aINV(as1), move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1), t(csf(n + 1), as1), t(csf(n), as3), as1 ∈ ass0, (as0, n0) ∈ asn-s, ¬ (as1, n + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ t(csf(n + 1), as2) ∧ aINV(as2) ⊦ (as0 = as ∨ as0 ∈ ass0) ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0) ∧ t(csf(n + 1), as0) ∧ aINV(as0)

• Proof step 174:

  n0 = n + 1, # ass0 ≠ 0, as1 ≠ as, ass0 ≠ ∅, aINV(as1), aINV(as0), move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1), move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0), t(csf(n + 1), as1), t(csf(n), as3), t(csf(n + 1), as0), as1 ∈ ass0, ¬ (as0, n0) ∈ asn-s, ¬ (as1, n + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ t(csf(n + 1), as2) ∧ aINV(as2), as0 = as ∨ as0 ∈ ass0 ⊦

Rule argument

Additional information

Proof step 172 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 173:

  # ass0 ≠ 0, # asn-s ≠ 0, as1 ≠ as, asn-s ≠ ∅, ass0 ≠ ∅, aINV(as1), move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1), t(csf(n + 1), as1), t(csf(n), as3), as1 ∈ ass0, (as0, n0) ∈ asn-s, ¬ (as1, n + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ t(csf(n + 1), as2) ∧ aINV(as2) ⊦ (as0 = as ∨ as0 ∈ ass0) ∧ n0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0) ∧ t(csf(n + 1), as0) ∧ aINV(as0)

Rule argument

Additional information

Used simplifier rules: size-zero-01: ⊦ s ≠ ∅ → # s ≠ 0; (forward) from specification set-basic ne-01: ⊦ a ∈ s → s ≠ ∅; (forward) from specification set-basic

Proof step 173 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And closed the goal!

Rule argument

Additional information

Used terms: as1, n + 1

Proof step 174 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 175:

  # ass0 ≠ 0, as1 ≠ as, ass0 ≠ ∅, aINV(as0), aINV(as1), move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as0), move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as1), t(csf(n + 1), as0), t(csf(n), as3), t(csf(n + 1), as1), as1 ∈ ass0, ¬ (as0, n + 1) ∈ asn-s, ¬ (as1, n + 1) ∈ asn-s, ∀ as2, m0. (as2, m0) ∈ asn-s ↔ as2 ∈ ass0 ∧ m0 = n + 1 ∧ move(IOAut(astart, astep, aext))(as3, cext !(caf(n) '), as2) ∧ t(csf(n + 1), as2) ∧ aINV(as2), as0 = as ∨ as0 ∈ ass0 ⊦

Rule argument

Additional information

Proof step 175 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And closed the goal!

Rule argument

Additional information

Used terms: as1, n + 1

Proof step 176 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule exists right

And closed the goal!

Rule argument

Additional information

Used simplifier rules: ⊦ ¬ a ∈ ∅; (s) ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b); (ws) Used terms: ∅

Proof step 177 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 178:

  ⊦ allreachable(g) ↔ (∀ b. dom(g)(b) → (∃ a. isroot(g)(a) ∧ path(g)(a, b)))

• Proof step 179:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∃ b. ¬ ( dom ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (b) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, b))) ⊦

Rule argument

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))

Proof step 178 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 179 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 180:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(asn._1), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(asn._2), asn._1), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, asn)

Rule argument

Additional information

Used simplifier rules: ⊦ dom(vs × es) = vs; (s)

Proof step 180 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 181:

  asn = (as, n), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, asn)

Rule argument

Additional information

Used terms: as, n

Proof step 181 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 182:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n))

Rule argument

Additional information

Proof step 182 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule structural induction

And obtained the following new goals

• Proof step 183:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0))

• Proof step 194:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 +1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ ef, cext, caf, aINV, as, cstart, csf, cstep, t, astart, astep, aext, cINV. ⌜ef⌝ = cext !(⌜caf⌝ ) ∧ aINV(as) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(n0), as) ∧ ¬ traceω(IOAut(astart, astep, aext))(ef) ∧ (∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el)) ∧ (∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass)) ∧ (∀ cs. cstart(cs) → cINV(cs)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as))) ∧ (∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs)) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0))) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 +1))

Rule argument

Additional information

Used simplifier rules: Nat freely generated by 0, +1;;

Proof step 183 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule exists right

And obtained the following new goals

• Proof step 184:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((as, 0)) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((as, 0), (as, 0))

Rule argument

Additional information

Used terms: (as, 0)

Proof step 184 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 185:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((as, 0)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦

• Proof step 187:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((as, 0), (as, 0)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦

Rule argument

Additional information

Proof step 185 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 186:

  ⊦ isroot(g)(b) ↔ dom(g)(b) ∧ (∀ a. ¬ edge(g)(a, b))

Rule argument

Additional information

Used simplifier rules: ⊦ dom(vs × es) = vs; (s) ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b); (ws) ⊦ m + 1 ≠ 0; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1)), (as, 0)

Proof step 186 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 187 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 188:

  ⊦ path(g)(a, b) ↔ (∃ x. pathp(g)(⌜x⌝ ) ∧ x ≠ [] ∧ a = x.head ∧ b = x.last)

• Proof step 189:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ x. ¬ ( pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜x⌝ ) ∧ x ≠ [] ∧ (as, 0) = x.head ∧ (as, 0) = x.last) ⊦

Rule argument

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1)), (as, 0), (as, 0)

Proof step 188 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 189 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 190:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ x. ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜x⌝ ) ∨ x = [] ∨ (as, 0) ≠ x.head ∨ (as, 0) ≠ x.last ⊦

Rule argument

Additional information

Proof step 190 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 191:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜(as, 0) '⌝ ) ∨ (as, 0) ' = [] ∨ (as, 0) ≠ (as, 0) '.head ∨ (as, 0) ≠ (as, 0) '.last ⊦

Rule argument

Additional information

Used terms: (as, 0) '

Proof step 191 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 192:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜(as, 0) '⌝ ), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ a '.last = a; (s) ⊦ a '.head = a; (s) ⊦ a ' ≠ []; (s)

Proof step 192 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 193:

  ⊦ pathp(g)(σ) ↔ (∀ n. ⌜n⌝ < # σ → dom(g)(σ[n])) ∧ (∀ n. ⌜n + 1⌝ < # σ → edge(g)(σ[n], σ[n + 1]))

Rule argument

Additional information

Used simplifier rules: ⊦ m < 1 ↔ m = 0; (s) ⊦ ⌜x⌝ [n] = x[n]; (s) ⊦ a '[0] = a; (s) ⊦ dom(vs × es) = vs; (s) ⊦ ⌜m + n⌝ = ⌜m⌝ + ⌜n⌝ ; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic ⊦ # ⌜x⌝ = ⌜# x⌝ ; (s) ⊦ # a ' = 0 +1; (s) ⊦ m ≤ n → (⌜(* m)⌝ + n∞2 < ⌜(* n)⌝ ↔ n∞2 < ⌜n - m⌝ ); (s) ⊦ ⌜m⌝ < ⌜n⌝ ↔ m < n; (s) ⊦ ¬ n < 0; (s) add-assoc: ⊦ (n∞ + n∞1) + n∞2 = n∞ + n∞1 + n∞2; from specification nat-inf add-comm: ⊦ n∞1 + n∞2 = n∞2 + n∞1; from specification nat-inf Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1)), ⌜(as, 0) '⌝

Proof step 193 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 194 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 195:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ ef, cext, caf, aINV, as, cstart, csf, cstep, t, astart, astep, aext, cINV. ⌜ef⌝ = cext !(⌜caf⌝ ) ∧ aINV(as) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(n0), as) ∧ ¬ traceω(IOAut(astart, astep, aext))(ef) ∧ (∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el)) ∧ (∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass)) ∧ (∀ cs. cstart(cs) → cINV(cs)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as))) ∧ (∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs)) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0))), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1))

Rule argument

Additional information

Used simplifier rules: ⊦ m +1 = m + 1; (s)

Proof step 195 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 196:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ csf(n0) = csl.last) → cINV(csf(n0)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ ef, cext, caf, aINV, as, cstart, csf, cstep, t, astart, astep, aext, cINV. ⌜ef⌝ = cext !(⌜caf⌝ ) ∧ aINV(as) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(n0), as) ∧ ¬ traceω(IOAut(astart, astep, aext))(ef) ∧ (∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el)) ∧ (∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass)) ∧ (∀ cs. cstart(cs) → cINV(cs)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as))) ∧ (∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs)) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0))) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1))

Rule argument

Additional information

Used terms: csf(n0)

Proof step 196 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 197:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ ef, cext, caf, aINV, as, cstart, csf, cstep, t, astart, astep, aext, cINV. ⌜ef⌝ = cext !(⌜caf⌝ ) ∧ aINV(as) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(n0), as) ∧ ¬ traceω(IOAut(astart, astep, aext))(ef) ∧ (∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el)) ∧ (∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass)) ∧ (∀ cs. cstart(cs) → cINV(cs)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as))) ∧ (∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs)) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0))), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1)), ∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ csf(n0) = csl.last

• Proof step 201:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cINV(csf(n0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ ef, cext, caf, aINV, as, cstart, csf, cstep, t, astart, astep, aext, cINV. ⌜ef⌝ = cext !(⌜caf⌝ ) ∧ aINV(as) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(n0), as) ∧ ¬ traceω(IOAut(astart, astep, aext))(ef) ∧ (∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el)) ∧ (∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass)) ∧ (∀ cs. cstart(cs) → cINV(cs)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as))) ∧ (∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs)) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0))), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1))

Rule argument

Additional information

Proof step 197 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule exists right

And obtained the following new goals

• Proof step 198:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ ef, cext, caf, aINV, as, cstart, csf, cstep, t, astart, astep, aext, cINV. ⌜ef⌝ = cext !(⌜caf⌝ ) ∧ aINV(as) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(n0), as) ∧ ¬ traceω(IOAut(astart, astep, aext))(ef) ∧ (∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el)) ∧ (∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass)) ∧ (∀ cs. cstart(cs) → cINV(cs)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as))) ∧ (∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs)) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0))) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1)), frag*(IOAut(cstart, cstep, cext))(csf.take(n0 + 1), caf.take(n0)) ∧ cstart(csf.take(n0 + 1)[0]) ∧ csf(n0) = (csf.take(n0 + 1)).last

Rule argument

Additional information

Used terms: csf.take(n0 + 1), caf.take(n0)

Proof step 198 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 199:

  ⌜ef⌝ = cext !(⌜caf⌝ ), csf(n0) ≠ (csf.take(n0 + 1)).last, aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ ef, cext, caf, aINV, as, cstart, csf, cstep, t, astart, astep, aext, cINV. ⌜ef⌝ = cext !(⌜caf⌝ ) ∧ aINV(as) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(n0), as) ∧ ¬ traceω(IOAut(astart, astep, aext))(ef) ∧ (∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el)) ∧ (∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass)) ∧ (∀ cs. cstart(cs) → cINV(cs)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as))) ∧ (∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs)) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0))), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1))

Rule argument

Additional information

Used simplifier rules: m < n ⊦ nf.take(n)[m] = nf(m); (s) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m + 1 ≠ 0; (s) ⊦ 0 < m ↔ m ≠ 0; (s) ⊦ fragω(IOAut(start, step, ext))(sf, af) → (frag*(IOAut(start, step, ext))(sf.take(n + 1), af.take(n)) ↔ true); (ss)

Proof step 199 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 200:

  ⊦ nf.take(m + 1) = nf.take(m) + nf(m) '

Rule argument

Additional information

Used simplifier rules: ⊦ (x + a ').last = a; (s) a: ⊦ (x + y) + z = x + y + z; from specification list Used terms: csf, n0

Proof step 200 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 201 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 202:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cINV(csf(n0)), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), cINV(csf(n0)) ∧ cstep(csf(n0), caf(n0), csf(n0 + 1)) ∧ t(csf(n0 + 1), as) ∧ aINV(as) → (∃ as1. aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as) ∧ t(csf(n0), as1)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ ef, cext, caf, aINV, as, cstart, csf, cstep, t, astart, astep, aext, cINV. ⌜ef⌝ = cext !(⌜caf⌝ ) ∧ aINV(as) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(n0), as) ∧ ¬ traceω(IOAut(astart, astep, aext))(ef) ∧ (∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el)) ∧ (∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass)) ∧ (∀ cs. cstart(cs) → cINV(cs)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as))) ∧ (∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs)) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0))) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1))

Rule argument

Additional information

Used terms: csf(n0), caf(n0), csf(n0 + 1), as

Proof step 202 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 203:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), aINV(as1), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0 + 1), as), t(csf(n0), as1), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ ef, cext, caf, aINV, as, cstart, csf, cstep, t, astart, astep, aext, cINV. ⌜ef⌝ = cext !(⌜caf⌝ ) ∧ aINV(as) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(n0), as) ∧ ¬ traceω(IOAut(astart, astep, aext))(ef) ∧ (∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el)) ∧ (∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass)) ∧ (∀ cs. cstart(cs) → cINV(cs)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as))) ∧ (∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs)) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0))) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1))

Rule argument

Additional information

Used simplifier rules: ⊦ ¬ step(sf(n), af(n), sf(n + 1)) → (fragω(IOAut(start, step, ext))(sf, af) ↔ false); (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic

Proof step 203 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 204:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ⌜ef⌝ = cext !(⌜caf⌝ ) ∧ aINV(as1) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(n0), as1) ∧ ¬ traceω(IOAut(astart, astep, aext))(ef) ∧ (∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el)) ∧ (∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass)) ∧ (∀ cs. cstart(cs) → cINV(cs)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as))) ∧ (∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs)) → (∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as1, n0))), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1))

Rule argument

Additional information

Used terms: ef, cext, caf, aINV, as1, cstart, csf, cstep, t, astart, astep, aext, cINV

Proof step 204 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 205:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), aINV(as1), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn, (as1, n0)), t(csf(n0 + 1), as), t(csf(n0), as1), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦ ∃ a. isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n0 + 1))

Rule argument

Additional information

Proof step 205 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule exists right

And obtained the following new goals

• Proof step 206:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn, (as1, n0)), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn) ∧ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn, (as, n0 + 1))

Rule argument

Additional information

Used terms: asn

Proof step 206 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 207:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), aINV(as1), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn, (as1, n0)), t(csf(n0 + 1), as), t(csf(n0), as1), ¬ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn, (as, n0 + 1)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦

Rule argument

Additional information

Proof step 207 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 208:

  ⊦ path(g)(a, b) ↔ (∃ x. pathp(g)(⌜x⌝ ) ∧ x ≠ [] ∧ a = x.head ∧ b = x.last)

• Proof step 209:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn, (as, n0 + 1)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∃ x. pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜x⌝ ) ∧ x ≠ [] ∧ asn = x.head ∧ (as1, n0) = x.last ⊦

Rule argument

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1)), asn, (as1, n0)

Proof step 208 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 209 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 210:

  (as1, n0) = x.last, ⌜ef⌝ = cext !(⌜caf⌝ ), x ≠ [], aINV(as), aINV(as1), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (x.head), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜x⌝ ), t(csf(n0 + 1), as), t(csf(n0), as1), ¬ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (x.head, (as, n0 + 1)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦

Rule argument

Additional information

Proof step 210 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 211:

  (as1, n0) = x.last, x = asn1 + x0, ⌜ef⌝ = cext !(⌜caf⌝ ), x ≠ [], aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜x⌝ ), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1, (as, n0 + 1)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ x ≠ [] → (head = x.head ∧ tail = x.tail ↔ x = head + tail); (elim) Used terms: x, asn1, x0

Proof step 211 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 212:

  (as1, n0) = (asn1 ' + x0).last, ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), aINV(as1), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜asn1 '⌝ + ⌜x0⌝ ), t(csf(n0 + 1), as), t(csf(n0), as1), ¬ path ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1, (as, n0 + 1)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ ⌜x + y⌝ = ⌜x⌝ + ⌜y⌝ ; (s) ⊦ a + x = a ' + x; (s) ⊦ a ' ≠ []; (s) ⊦ x + y = [] ↔ x = [] ∧ y = []; (s)

Proof step 212 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 213:

  ⊦ path(g)(a, b) ↔ (∃ x. pathp(g)(⌜x⌝ ) ∧ x ≠ [] ∧ a = x.head ∧ b = x.last)

• Proof step 214:

  (as1, n0) = (asn1 ' + x0).last, ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜asn1 '⌝ + ⌜x0⌝ ), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ x. ¬ ( pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜x⌝ ) ∧ x ≠ [] ∧ asn1 = x.head ∧ (as, n0 + 1) = x.last) ⊦

Rule argument

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1)), asn1, (as, n0 + 1)

Proof step 213 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 214 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 215:

  (as1, n0) = (asn1 ' + x0).last, ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), aINV(as1), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜asn1 '⌝ + ⌜x0⌝ ), t(csf(n0 + 1), as), t(csf(n0), as1), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ x. ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜x⌝ ) ∨ x = [] ∨ asn1 ≠ x.head ∨ (as, n0 + 1) ≠ x.last ⊦

Rule argument

Additional information

Proof step 215 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 216:

  (as1, n0) = (asn1 ' + x0).last, ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜asn1 '⌝ + ⌜x0⌝ ), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜asn1 ' + (x0 + (as, n0 + 1))⌝ ) ∨ asn1 ' + (x0 + (as, n0 + 1)) = [] ∨ asn1 ≠ (asn1 ' + (x0 + (as, n0 + 1))).head ∨ (as, n0 + 1) ≠ (asn1 ' + (x0 + (as, n0 + 1))).last ⊦

Rule argument

Additional information

Used terms: asn1 ' + (x0 + (as, n0 + 1))

Proof step 216 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 217:

  (as1, n0) = (asn1 ' + x0).last, ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), aINV(as1), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜asn1 '⌝ + ⌜x0⌝ ), t(csf(n0 + 1), as), t(csf(n0), as1), ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜asn1 '⌝ + ⌜x0⌝ + ⌜(as, n0 + 1) '⌝ ), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ (a ' + x + b ').last = b; (s) ⊦ x + a = x + a '; (s) ⊦ (a ' + x).head = a; (s) ⊦ a ' ≠ []; (s) ⊦ x + y = [] ↔ x = [] ∧ y = []; (s) ⊦ ⌜x + y⌝ = ⌜x⌝ + ⌜y⌝ ; (s)

Proof step 217 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 218:

  ⊦ pathp(g)(σ) ↔ (∀ n. ⌜n⌝ < # σ → dom(g)(σ[n])) ∧ (∀ n. ⌜n + 1⌝ < # σ → edge(g)(σ[n], σ[n + 1]))

• Proof step 219:

  (as1, n0) = (asn1 ' + x0).last, ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜asn1 '⌝ + ⌜x0⌝ + ⌜(as, n0 + 1) '⌝ ), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ n. ⌜n⌝ < #(⌜asn1 '⌝ + ⌜x0⌝ ) → dom ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((⌜asn1 '⌝ + ⌜x0⌝ )[n]), ∀ n. ⌜n + 1⌝ < #(⌜asn1 '⌝ + ⌜x0⌝ ) → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((⌜asn1 '⌝ + ⌜x0⌝ )[n], (⌜asn1 '⌝ + ⌜x0⌝ )[n + 1]) ⊦

Rule argument

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1)), ⌜asn1 '⌝ + ⌜x0⌝

Proof step 218 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 219 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 220:

  (as1, n0) = (asn1 ' + x0).last, ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), aINV(as1), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0 + 1), as), t(csf(n0), as1), ¬ pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜asn1 '⌝ + ⌜x0⌝ + ⌜(as, n0 + 1) '⌝ ), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ dom(vs × es) = vs; (s) append-assoc: ⊦ (σ + σ1) + σ2 = σ + σ1 + σ2; from specification stream ⊦ (⌜x⌝ + ⌜x0⌝ )[m] = (x + x0)[m]; (s) add-comm: ⊦ n∞1 + n∞2 = n∞2 + n∞1; from specification nat-inf add-assoc: ⊦ (n∞ + n∞1) + n∞2 = n∞ + n∞1 + n∞2; from specification nat-inf ⊦ ⌜m⌝ < ⌜n⌝ ↔ m < n; (s) ⊦ ⌜n⌝ < ⌜1⌝ + n∞ ↔ ¬ n∞ < ⌜n⌝ ; (s) ⊦ # ⌜x⌝ = ⌜# x⌝ ; (s) ⊦ # a ' = 0 +1; (s) ⊦ #(σ + σ1) = # σ + # σ1; (s) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ ⌜x⌝ [n] = x[n]; (s) ⊦ (⌜a '⌝ + σ)[n + 1] = σ[n]; (s) ⊦ n∞ + ⌜0⌝ = n∞; (s) ⊦ m ≤ n → (⌜(* m)⌝ + n∞2 < ⌜(* n)⌝ + n∞1 ↔ n∞2 < ⌜n - m⌝ + n∞1); (s) ⊦ ⌜m + n⌝ = ⌜m⌝ + ⌜n⌝ ; (s)

Proof step 220 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 221:

  ⊦ pathp(g)(σ) ↔ (∀ n. ⌜n⌝ < # σ → dom(g)(σ[n])) ∧ (∀ n. ⌜n + 1⌝ < # σ → edge(g)(σ[n], σ[n + 1]))

• Proof step 222:

  (as1, n0) = (asn1 ' + x0).last, ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), (∃ n. ¬ ( ⌜n⌝ < #(⌜asn1 '⌝ + ⌜x0⌝ + ⌜(as, n0 + 1) '⌝ ) → dom ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((⌜asn1 '⌝ + ⌜x0⌝ + ⌜(as, n0 + 1) '⌝ )[n]))) ∨ (∃ n. ¬ ( ⌜n + 1⌝ < #(⌜asn1 '⌝ + ⌜x0⌝ + ⌜(as, n0 + 1) '⌝ ) → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((⌜asn1 '⌝ + ⌜x0⌝ + ⌜(as, n0 + 1) '⌝ )[n], (⌜asn1 '⌝ + ⌜x0⌝ + ⌜(as, n0 + 1) '⌝ )[n + 1]))) ⊦

Rule argument

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1)), ⌜asn1 '⌝ + ⌜x0⌝ + ⌜(as, n0 + 1) '⌝

Proof step 221 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 222 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 223:

  (as1, n0) = (asn1 ' + x0).last, ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), aINV(as1), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0 + 1), as), t(csf(n0), as1), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), ¬ ( n < 2 + # x0 → t(csf((asn1 ' + x0 + (as, n0 + 1) ')[n]._2), (asn1 ' + x0 + (as, n0 + 1) ')[n]._1) ∧ aINV((asn1 ' + x0 + (as, n0 + 1) ')[n]._1)) ∨ ¬ ( ¬ # x0 < n1 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0 + (as, n0 + 1) ')[n1], (x0 + (as, n0 + 1) ')[n1])) ⊦

Rule argument

Additional information

Used simplifier rules: append-assoc: ⊦ (σ + σ1) + σ2 = σ + σ1 + σ2; from specification stream c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ (⌜x⌝ + ⌜x0⌝ )[m] = (x + x0)[m]; (s) ⊦ (⌜a '⌝ + σ)[n + 1] = σ[n]; (s) ⊦ (⌜x⌝ + ⌜x0⌝ + ⌜x1⌝ )[m] = (x + x0 + x1)[m]; (s) add-comm: ⊦ n∞1 + n∞2 = n∞2 + n∞1; from specification nat-inf add-assoc: ⊦ (n∞ + n∞1) + n∞2 = n∞ + n∞1 + n∞2; from specification nat-inf ⊦ ⌜m⌝ < ⌜n⌝ ↔ m < n; (s) ⊦ ⌜n⌝ < ⌜1⌝ + n∞ ↔ ¬ n∞ < ⌜n⌝ ; (s) ⊦ m ≤ n → (⌜(* m)⌝ + n∞2 < ⌜(* n)⌝ + n∞1 ↔ n∞2 < ⌜n - m⌝ + n∞1); (s) ⊦ ⌜(* n)⌝ + ⌜(* m)⌝ = ⌜n + m⌝ ; (s) ⊦ # a ' = 0 +1; (s) ⊦ # ⌜x⌝ = ⌜# x⌝ ; (s) ⊦ #(σ + σ1) = # σ + # σ1; (s) ⊦ ⌜m + n⌝ = ⌜m⌝ + ⌜n⌝ ; (s) ⊦ dom(vs × es) = vs; (s) ⊦ ⌜n⌝ < ⌜m⌝ + ⌜n0⌝ ↔ n < m + n0; (s)

Proof step 223 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 224:

  (as1, n0) = (asn1 ' + x0).last, (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ¬(n < 2 + # x0 → t(csf(n2), as0) ∧ aINV(as0)) ∨ ¬ ( ¬ # x0 < n1 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0 + (as, n0 + 1) ')[n1], (x0 + (as, n0 + 1) ')[n1])) ⊦

Rule argument

Additional information

Used terms: as0, n2

Proof step 224 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 225:

  (as1, n0) = (asn1 ' + x0).last, (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), ⌜ef⌝ = cext !(⌜caf⌝ ), n < 2 + # x0, aINV(as), aINV(as1), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0 + 1), as), t(csf(n0), as1), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1) ⊦ t(csf(n2), as0) ∧ aINV(as0)

• Proof step 234:

  (as1, n0) = (asn1 ' + x0).last, (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), aINV(as1), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0 + 1), as), t(csf(n0), as1), ¬ # x0 < n1, ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0 + (as, n0 + 1) ')[n1], (x0 + (as, n0 + 1) ')[n1]), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1) ⊦

Rule argument

Additional information

Proof step 225 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 226:

  (as1, n0) = (asn1 ' + x0).last, (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), ⌜ef⌝ = cext !(⌜caf⌝ ), n < 2 + # x0, aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ t(csf(n2), as0) ∧ aINV(as0)

Rule argument

Additional information

Used terms: n

Proof step 226 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 227:

  (as1, n0) = (asn1 ' + x0).last, (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), (asn1 ' + x0)[n] = (as2, n1), ⌜ef⌝ = cext !(⌜caf⌝ ), n < 2 + # x0, aINV(as), aINV(as1), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0 + 1), as), t(csf(n0), as1), ¬ traceω(IOAut(astart, astep, aext))(ef), ¬ # x0 < n → t(csf(n1), as2) ∧ aINV(as2), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1) ⊦ t(csf(n2), as0) ∧ aINV(as0)

Rule argument

Additional information

Used terms: as2, n1

Proof step 227 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 228:

  ⊦ n < # x → (x + y)[n] = x[n]

• Proof step 229:

  (as1, n0) = (asn1 ' + x0).last, (asn1 ' + x0)[n] = (as2, n1), (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), ⌜ef⌝ = cext !(⌜caf⌝ ), n < 2 + # x0, aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ n < # asn1 ', ¬ traceω(IOAut(astart, astep, aext))(ef), ¬ # x0 < n → t(csf(n1), as2) ∧ aINV(as2), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ t(csf(n2), as0) ∧ aINV(as0)

Rule argument

Additional information

Used simplifier rules: ⊦ n < # x → (x + y)[n] = x[n]; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ # a ' = 0 +1; (s) ⊦ m < 1 ↔ m = 0; (s) f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic lf-02: ⊦ m < n ∧ m = n0 → n0 < n; (forward) from specification nat-basic ⊦ a '[0] = a; (s) ⊦ 0 < m ↔ m ≠ 0; (s) n < n0 ⊦ (* n) ≠ m0 + (* n0); (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic ⊦ ¬ n < 0; (s) Used terms: asn1 ', x0 + (as, n0 + 1) ', n

Proof step 228 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 229 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 230:

  (as1, n0) = (asn1 ' + x0).last, x0[n - 1] = (as2, n1), (x0 + (as, n0 + 1) ')[n - 1] = (as0, n2), ⌜ef⌝ = cext !(⌜caf⌝ ), n ≠ 0, n < 2 + # x0, aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ¬ # x0 < n → t(csf(n1), as2) ∧ aINV(as2), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ t(csf(n2), as0) ∧ aINV(as0)

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic n < n0 ⊦ (* n) ≠ m0 + (* n0); (s) f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic ⊦ m < 1 ↔ m = 0; (s) ⊦ # a ' = 0 +1; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ ¬ n < # x → (x + y)[n] = y[n - # x]; (s)

Proof step 230 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 231:

  (as1, n0) = (asn1 ' + x0).last, (x0 + (as, n0 + 1) ')[n3] = (as0, n2), x0[n3] = (as2, n1), n = n3 + 1, ⌜ef⌝ = cext !(⌜caf⌝ ), n ≠ 0, n < 2 + # x0, aINV(as), aINV(as1), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0 + 1), as), t(csf(n0), as1), ¬ traceω(IOAut(astart, astep, aext))(ef), ¬ # x0 < n → t(csf(n1), as2) ∧ aINV(as2), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1) ⊦ t(csf(n2), as0) ∧ aINV(as0)

Rule argument

Additional information

Used simplifier rules: n ≠ 0 ⊦ m = n - 1 ↔ n = m + 1; (elim) Used terms: n, n3

Proof step 231 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 232:

  (as1, n0) = (asn1 ' + x0).last, x0[n3] = (as2, n1), (x0 + (as, n0 + 1) ')[n3] = (as0, n2), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0), as1), t(csf(n0 + 1), as), n3 ≤ # x0, ¬ traceω(IOAut(astart, astep, aext))(ef), n3 < # x0 → t(csf(n1), as2) ∧ aINV(as2), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦ t(csf(n2), as0) ∧ aINV(as0)

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m < n + 1 ↔ ¬ n < m; (s) ⊦ m < n ↔ ¬ n ≤ m; (ss) n < n0 ⊦ m + (* n) < m0 + (* n0) ↔ m < m0 + (n0 - n); (s) ⊦ m + 1 ≠ 0; (s)

Proof step 232 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 233:

  ⊦ n < # x → (x + y)[n] = x[n]

Rule argument

Additional information

Used simplifier rules: ⊦ m < n → m ≤ n; (s) f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic ⊦ # x = 0 ↔ x = []; (s) ⊦ x ≠ [] → (a ' + x).last = x.last; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ ¬ n < # x → (x + y)[n] = y[n - # x]; (s) ⊦ m < n ↔ ¬ n ≤ m; (ss) ⊦ m ≤ n → (n ≤ m ↔ m = n); (s) ⊦ m - m = 0; (s) ⊦ a '[0] = a; (s) ⊦ m ≤ m; (s) ⊦ ¬ n < n; (s) Used terms: x0, (as, n0 + 1) ', n3

Proof step 233 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 234 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 235:

  (as1, n0) = (asn1 ' + x0).last, (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ # x0 < n1, ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0 + (as, n0 + 1) ')[n1], (x0 + (as, n0 + 1) ')[n1]), ¬ traceω(IOAut(astart, astep, aext))(ef), n1 < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n1], x0[n1]), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

Rule argument

Additional information

Used terms: n1

Proof step 235 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 236:

  (as1, n0) = (asn1 ' + x0).last, (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), aINV(as1), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0 + 1), as), t(csf(n0), as1), n1 ≤ # x0, ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0 + (as, n0 + 1) ')[n1], (x0 + (as, n0 + 1) ')[n1]), ¬ traceω(IOAut(astart, astep, aext))(ef), n1 < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n1], x0[n1]), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1) ⊦

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ m < n ↔ ¬ n ≤ m; (ss)

Proof step 236 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule cut formula

And obtained the following new goals

• Proof step 237:

  (as1, n0) = (asn1 ' + x0).last, (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), ⌜ef⌝ = cext !(⌜caf⌝ ), n1 < # x0, aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0), as1), t(csf(n0 + 1), as), n1 ≤ # x0, ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0 + (as, n0 + 1) ')[n1], (x0 + (as, n0 + 1) ')[n1]), ¬ traceω(IOAut(astart, astep, aext))(ef), n1 < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n1], x0[n1]), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

• Proof step 254:

  (as1, n0) = (asn1 ' + x0).last, (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0), as1), t(csf(n0 + 1), as), n1 ≤ # x0, ¬ n1 < # x0, ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0 + (as, n0 + 1) ')[n1], (x0 + (as, n0 + 1) ')[n1]), ¬ traceω(IOAut(astart, astep, aext))(ef), n1 < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n1], x0[n1]), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

Rule argument

Additional information

Used formulas: n1 < # x0

Proof step 237 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 238:

  (as1, n0) = x0.last, x0[n1]._2 = (asn1 ' + x0)[n1]._2 + 1, (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), ⌜ef⌝ = cext !(⌜caf⌝ ), x0 ≠ [], n1 < # x0, aINV(x0[n1]._1), aINV((asn1 ' + x0)[n1]._1), aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))((asn1 ' + x0)[n1]._1, cext !(caf((asn1 ' + x0)[n1]._2) '), x0[n1]._1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(x0[n1]._2), x0[n1]._1), t(csf((asn1 ' + x0)[n1]._2), (asn1 ' + x0)[n1]._1), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0 + (as, n0 + 1) ')[n1], x0[n1]), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ x ≠ [] → (a ' + x).last = x.last; (s) ⊦ # x = 0 ↔ x = []; (s) f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b); (ws) ⊦ n < # x → (x + a ')[n] = x[n]; (s) ⊦ m < n → m ≤ n; (s)

Proof step 238 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 239:

  (as1, n0) = x0.last, (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), x0[n1] = (as2, n3), n3 = (asn1 ' + x0)[n1]._2 + 1, ⌜ef⌝ = cext !(⌜caf⌝ ), x0 ≠ [], n1 < # x0, aINV(as), aINV(as1), aINV((asn1 ' + x0)[n1]._1), aINV(as2), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), move(IOAut(astart, astep, aext))((asn1 ' + x0)[n1]._1, cext !(caf((asn1 ' + x0)[n1]._2) '), as2), t(csf(n0 + 1), as), t(csf(n0), as1), t(csf((asn1 ' + x0)[n1]._2), (asn1 ' + x0)[n1]._1), t(csf(n3), as2), ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0 + (as, n0 + 1) ')[n1], x0[n1]), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1) ⊦

Rule argument

Additional information

Used terms: as2, n3

Proof step 239 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 240:

  (as1, n0) = x0.last, x0[n1] = (as2, (asn1 ' + x0)[n1]._2 + 1), (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), ⌜ef⌝ = cext !(⌜caf⌝ ), x0 ≠ [], n1 < # x0, aINV(as2), aINV((asn1 ' + x0)[n1]._1), aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))((asn1 ' + x0)[n1]._1, cext !(caf((asn1 ' + x0)[n1]._2) '), as2), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf((asn1 ' + x0)[n1]._2 + 1), as2), t(csf((asn1 ' + x0)[n1]._2), (asn1 ' + x0)[n1]._1), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0 + (as, n0 + 1) ')[n1], x0[n1]), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list

Proof step 240 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 241:

  (as1, n0) = x0.last, (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), x0[n1] = (as2, n3 + 1), (asn1 ' + x0)[n1] = (as3, n3), ⌜ef⌝ = cext !(⌜caf⌝ ), x0 ≠ [], n1 < # x0, aINV(as), aINV(as1), aINV(as3), aINV(as2), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), move(IOAut(astart, astep, aext))(as3, cext !(caf(n3) '), as2), t(csf(n0 + 1), as), t(csf(n0), as1), t(csf(n3), as3), t(csf(n3 + 1), as2), ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0 + (as, n0 + 1) ')[n1], x0[n1]), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1) ⊦

Rule argument

Additional information

Used terms: as3, n3

Proof step 241 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 242:

  ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b)

• Proof step 243:

  (as1, n0) = x0.last, (asn1 ' + x0)[n1] = (as3, n3), x0[n1] = (as2, n3 + 1), (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), ⌜ef⌝ = cext !(⌜caf⌝ ), x0 ≠ [], n1 < # x0, aINV(as2), aINV(as3), aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as3, cext !(caf(n3) '), as2), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n3 + 1), as2), t(csf(n3), as3), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ( ¬ aINV((asn1 ' + x0 + (as, n0 + 1) ')[n1]._1) ∨ ¬ aINV(x0[n1]._1) ∨ x0[n1]._2 ≠ (asn1 ' + x0 + (as, n0 + 1) ')[n1]._2 + 1 ∨ ¬ move(IOAut(astart, astep, aext))((asn1 ' + x0 + (as, n0 + 1) ')[n1]._1, cext !(caf((asn1 ' + x0 + (as, n0 + 1) ')[n1]._2) '), x0[n1]._1)) ∨ (¬ t(csf((asn1 ' + x0 + (as, n0 + 1) ')[n1]._2), (asn1 ' + x0 + (as, n0 + 1) ')[n1]._1) ∨ ¬ aINV((asn1 ' + x0 + (as, n0 + 1) ')[n1]._1)) ∨ ¬ t(csf(x0[n1]._2), x0[n1]._1) ∨ ¬ aINV(x0[n1]._1) ⊦

Rule argument

Additional information

Used terms: λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1), λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1), (asn1 ' + x0 + (as, n0 + 1) ')[n1], x0[n1]

Proof step 242 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 243 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 244:

  (as1, n0) = x0.last, (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), x0[n1] = (as2, n3 + 1), (asn1 ' + x0)[n1] = (as3, n3), ⌜ef⌝ = cext !(⌜caf⌝ ), x0 ≠ [], n1 < # x0, aINV(as), aINV(as1), aINV(as3), aINV(as2), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), move(IOAut(astart, astep, aext))(as3, cext !(caf(n3) '), as2), t(csf(n0 + 1), as), t(csf(n0), as1), t(csf(n3), as3), t(csf(n3 + 1), as2), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), x0[n1]._2 ≠ (asn1 ' + x0 + (as, n0 + 1) ')[n1]._2 + 1 ∨ ¬ move(IOAut(astart, astep, aext))((asn1 ' + x0 + (as, n0 + 1) ')[n1]._1, cext !(caf((asn1 ' + x0 + (as, n0 + 1) ')[n1]._2) '), x0[n1]._1) ∨ ¬ t(csf((asn1 ' + x0 + (as, n0 + 1) ')[n1]._2), (asn1 ' + x0 + (as, n0 + 1) ')[n1]._1) ∨ ¬ aINV((asn1 ' + x0 + (as, n0 + 1) ')[n1]._1) ∨ ¬ t(csf(x0[n1]._2), x0[n1]._1) ∨ ¬ aINV(x0[n1]._1) ⊦

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list

Proof step 244 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 245:

  (as1, n0) = x0.last, (asn1 ' + x0)[n1] = (as3, n3), x0[n1] = (as2, n3 + 1), (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), x0[n1] = (as4, n4), ⌜ef⌝ = cext !(⌜caf⌝ ), x0 ≠ [], n1 < # x0, aINV(as2), aINV(as3), aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as3, cext !(caf(n3) '), as2), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n3 + 1), as2), t(csf(n3), as3), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), n4 ≠ (asn1 ' + x0 + (as, n0 + 1) ')[n1]._2 + 1 ∨ ¬ move(IOAut(astart, astep, aext))((asn1 ' + x0 + (as, n0 + 1) ')[n1]._1, cext !(caf((asn1 ' + x0 + (as, n0 + 1) ')[n1]._2) '), as4) ∨ ¬ t(csf((asn1 ' + x0 + (as, n0 + 1) ')[n1]._2), (asn1 ' + x0 + (as, n0 + 1) ')[n1]._1) ∨ ¬ aINV((asn1 ' + x0 + (as, n0 + 1) ')[n1]._1) ∨ ¬ t(csf(n4), as4) ∨ ¬ aINV(as4) ⊦

Rule argument

Additional information

Used terms: as4, n4

Proof step 245 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 246:

  (as1, n0) = x0.last, (asn1 ' + x0)[n1] = (as3, n3), x0[n1] = (as2, n3 + 1), (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), ⌜ef⌝ = cext !(⌜caf⌝ ), x0 ≠ [], n1 < # x0, aINV(as), aINV(as1), aINV(as3), aINV(as2), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), move(IOAut(astart, astep, aext))(as3, cext !(caf(n3) '), as2), t(csf(n0 + 1), as), t(csf(n0), as1), t(csf(n3), as3), t(csf(n3 + 1), as2), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), n3 ≠ (asn1 ' + x0 + (as, n0 + 1) ')[n1]._2 ∨ ¬ move(IOAut(astart, astep, aext))((asn1 ' + x0 + (as, n0 + 1) ')[n1]._1, cext !(caf((asn1 ' + x0 + (as, n0 + 1) ')[n1]._2) '), as2) ∨ ¬ t(csf((asn1 ' + x0 + (as, n0 + 1) ')[n1]._2), (asn1 ' + x0 + (as, n0 + 1) ')[n1]._1) ∨ ¬ aINV((asn1 ' + x0 + (as, n0 + 1) ')[n1]._1) ⊦

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m + n = m + n0 ↔ n = n0; (s) a: ⊦ (x + y) + z = x + y + z; from specification list

Proof step 246 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 247:

  (as1, n0) = x0.last, (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), x0[n1] = (as2, n3 + 1), (asn1 ' + x0)[n1] = (as3, n3), (asn1 ' + x0 + (as, n0 + 1) ')[n1] = (as4, n4), ⌜ef⌝ = cext !(⌜caf⌝ ), x0 ≠ [], n1 < # x0, aINV(as2), aINV(as3), aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as3, cext !(caf(n3) '), as2), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n3 + 1), as2), t(csf(n3), as3), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), n3 ≠ n4 ∨ ¬ move(IOAut(astart, astep, aext))(as4, cext !(caf(n4) '), as2) ∨ ¬ t(csf(n4), as4) ∨ ¬ aINV(as4) ⊦

Rule argument

Additional information

Used terms: as4, n4

Proof step 247 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 248:

  ⊦ n < # x → (x + y)[n] = x[n]

• Proof step 249:

  (as1, n0) = x0.last, (asn1 ' + x0 + (as, n0 + 1) ')[n1] = (as4, n4), (asn1 ' + x0)[n1] = (as3, n3), x0[n1] = (as2, n3 + 1), (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), ⌜ef⌝ = cext !(⌜caf⌝ ), x0 ≠ [], n1 < # x0, aINV(as), aINV(as1), aINV(as3), aINV(as2), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), move(IOAut(astart, astep, aext))(as3, cext !(caf(n3) '), as2), t(csf(n0 + 1), as), t(csf(n0), as1), t(csf(n3), as3), t(csf(n3 + 1), as2), ¬ n1 < # asn1 ', ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), n3 ≠ n4 ∨ ¬ move(IOAut(astart, astep, aext))(as4, cext !(caf(n4) '), as2) ∨ ¬ t(csf(n4), as4) ∨ ¬ aINV(as4) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ n < # x → (x + y)[n] = x[n]; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ # a ' = 0 +1; (s) ⊦ m < 1 ↔ m = 0; (s) lf-02: ⊦ m < n ∧ m = n0 → n0 < n; (forward) from specification nat-basic ⊦ a '[0] = a; (s) ⊦ x ≠ [] → x[0] = x.head; (s) ⊦ 0 < m ↔ m ≠ 0; (s) ⊦ # x = 0 ↔ x = []; (s) Used terms: asn1 ', x0 + (as, n0 + 1) ', n1

Proof step 248 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 249 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 250:

  (as1, n0) = x0.last, (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), x0[n1] = (as2, n3 + 1), x0[n1 - 1] = (as3, n3), (x0 + (as, n0 + 1) ')[n1 - 1] = (as4, n4), ⌜ef⌝ = cext !(⌜caf⌝ ), n1 ≠ 0, x0 ≠ [], n1 < # x0, aINV(as2), aINV(as3), aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as3, cext !(caf(n3) '), as2), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n3 + 1), as2), t(csf(n3), as3), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), n3 ≠ n4 ∨ ¬ move(IOAut(astart, astep, aext))(as4, cext !(caf(n4) '), as2) ∨ ¬ t(csf(n4), as4) ∨ ¬ aINV(as4) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ m < 1 ↔ m = 0; (s) ⊦ # a ' = 0 +1; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ ¬ n < # x → (x + y)[n] = y[n - # x]; (s)

Proof step 250 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 251:

  (as1, n0) = x0.last, (x0 + (as, n0 + 1) ')[n5] = (as4, n4), x0[n5] = (as3, n3), x0[n1] = (as2, n3 + 1), (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), n1 = n5 + 1, ⌜ef⌝ = cext !(⌜caf⌝ ), n1 ≠ 0, x0 ≠ [], n1 < # x0, aINV(as), aINV(as1), aINV(as3), aINV(as2), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), move(IOAut(astart, astep, aext))(as3, cext !(caf(n3) '), as2), t(csf(n0 + 1), as), t(csf(n0), as1), t(csf(n3), as3), t(csf(n3 + 1), as2), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), n3 ≠ n4 ∨ ¬ move(IOAut(astart, astep, aext))(as4, cext !(caf(n4) '), as2) ∨ ¬ t(csf(n4), as4) ∨ ¬ aINV(as4) ⊦

Rule argument

Additional information

Used simplifier rules: n ≠ 0 ⊦ m = n - 1 ↔ n = m + 1; (elim) Used terms: n1, n5

Proof step 251 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 252:

  (as1, n0) = x0.last, (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), x0[n5 + 1] = (as2, n3 + 1), x0[n5] = (as3, n3), (x0 + (as, n0 + 1) ')[n5] = (as4, n4), ⌜ef⌝ = cext !(⌜caf⌝ ), x0 ≠ [], n5 + 1 < # x0, aINV(as2), aINV(as3), aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as3, cext !(caf(n3) '), as2), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n3 + 1), as2), t(csf(n3), as3), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), n3 ≠ n4 ∨ ¬ move(IOAut(astart, astep, aext))(as4, cext !(caf(n4) '), as2) ∨ ¬ t(csf(n4), as4) ∨ ¬ aINV(as4) ⊦

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m + 1 ≠ 0; (s)

Proof step 252 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 253:

  ⊦ n < # x → (x + y)[n] = x[n]

Rule argument

Additional information

Used simplifier rules: ⊦ ¬ n < # x → (x + y)[n] = y[n - # x]; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ ¬ m < n → ¬ m + m0 < n; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic Used terms: x0, (as, n0 + 1) ', n5

Proof step 253 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 254 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 255:

  (as1, n0) = (asn1 ' + x0).last, (asn1 ' + x0 + (as, n0 + 1) ')[n] = (as0, n2), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as1), aINV(as), cINV(csf(n0)), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asn1), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((as1, n0), (as, n0 + 1)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. ¬ # x0 < n → t(csf((asn1 ' + x0)[n]._2), (asn1 ' + x0)[n]._1) ∧ aINV((asn1 ' + x0)[n]._1), ∀ n. n < # x0 → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((asn1 ' + x0)[n], x0[n]), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ ¬ n < n; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ (a ' + x + y)[# x] = (a ' + x).last; (s) ⊦ m ≤ m; (s) ⊦ n = # x → (x + a ')[n] = a; (s) ⊦ m ≤ n → (n ≤ m ↔ m = n); (s) ⊦ m < n ↔ ¬ n ≤ m; (ss)

Proof step 255 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 256:

  ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b)

Rule argument

Additional information

Used simplifier rules: ⊦ m + n = m + n0 ↔ n = n0; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic Used terms: λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1), λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1), (as1, n0), (as, n0 + 1)

Proof step 256 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 257 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 258:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(0)), pathp ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜asnf⌝ ), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs) ⊦

Rule argument

Additional information

Proof step 258 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 259:

  ⊦ pathp(g)(σ) ↔ (∀ n. ⌜n⌝ < # σ → dom(g)(σ[n])) ∧ (∀ n. ⌜n + 1⌝ < # σ → edge(g)(σ[n], σ[n + 1]))

• Proof step 260:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(0)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ n. ⌜n⌝ < # ⌜asnf⌝ → dom ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜asnf⌝ [n]), ∀ n. ⌜n + 1⌝ < # ⌜asnf⌝ → edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (⌜asnf⌝ [n], ⌜asnf⌝ [n + 1]) ⊦

Rule argument

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1)), ⌜asnf⌝

Proof step 259 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 260 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 261:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), isroot ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(0)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ dom(vs × es) = vs; (s) ⊦ ⌜nf⌝ [n] = nf(n); (s) ⊦ ⌜m⌝ < ∞; (s) ⊦ # ⌜nf⌝ = ∞; (s) add-comm: ⊦ n∞1 + n∞2 = n∞2 + n∞1; from specification nat-inf add-assoc: ⊦ (n∞ + n∞1) + n∞2 = n∞ + n∞1 + n∞2; from specification nat-inf ⊦ ⌜n⌝ ≠ ∞; (s) ⊦ ⌜m⌝ + n∞ = ∞ ↔ n∞ = ∞; (s) ⊦ n∞ < ∞ ↔ n∞ ≠ ∞; (s) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ ⌜m + n⌝ = ⌜m⌝ + ⌜n⌝ ; (s)

Proof step 261 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 262:

  ⊦ isroot(g)(b) ↔ dom(g)(b) ∧ (∀ a. ¬ edge(g)(a, b))

• Proof step 263:

  ⌜ef⌝ = cext !(⌜caf⌝ ), cstart(csf(0)), dom ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, asnf(0)) ⊦

Rule argument

Additional information

Used terms: (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1)), asnf(0)

Proof step 262 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 263 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 264:

  ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(asnf(0)._1), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(asnf(0)._2), asnf(0)._1), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, asnf(0)), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ dom(vs × es) = vs; (s)

Proof step 264 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 265:

  asnf(0) = (as, n), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, asnf(0)) ⊦

Rule argument

Additional information

Used terms: as, n

Proof step 265 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 266:

  asnf(0) = (as, n), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n)), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1) ⊦

Rule argument

Additional information

Proof step 266 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule cut formula

And obtained the following new goals

• Proof step 267:

  asnf(0) = (as, n), n = 0, ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n)) ⊦

• Proof step 289:

  asnf(0) = (as, n), ⌜ef⌝ = cext !(⌜caf⌝ ), n ≠ 0, aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n)) ⊦

Rule argument

Additional information

Used formulas: n = 0

Proof step 267 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 268:

  asnf(0) = (as, 0), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0)), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1) ⊦

Rule argument

Additional information

Proof step 268 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule cut formula

And obtained the following new goals

• Proof step 269:

  asnf(0) = (as, 0), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0)), ∀ n. asnf(n)._2 = n ⊦

• Proof step 280:

  asnf(0) = (as, 0), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0)) ⊦ ∀ n. asnf(n)._2 = n

Rule argument

Additional information

Used formulas: ∀ n. asnf(n)._2 = n

Proof step 269 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule cut formula

And obtained the following new goals

• Proof step 270:

  asnf(0) = (as, 0), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. asnf(n)._2 = n, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0)), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ n. move(IOAut(astart, astep, aext))(asnf(n)._1, cext !(caf(n) '), asnf(n + 1)._1) ⊦

• Proof step 274:

  asnf(0) = (as, 0), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. asnf(n)._2 = n, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0)), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1) ⊦ ∀ n. move(IOAut(astart, astep, aext))(asnf(n)._1, cext !(caf(n) '), asnf(n + 1)._1)

Rule argument

Additional information

Used formulas: ∀ n. move(IOAut(astart, astep, aext))(asnf(n)._1, cext !(caf(n) '), asnf(n + 1)._1)

Proof step 270 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply lemma

And obtained the following new goals

• Proof step 271:

  start(sf(0)), ∀ n. move(IOAut(start, step, ext))(sf(n), cext !(caf(n) '), sf(n + 1)) ⊦ trace(IOAut(start, step, ext))(cext !(⌜caf⌝ ))

• Proof step 272:

  asnf(0) = (as, 0), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ astart(asnf(0)._1), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. move(IOAut(astart, astep, aext))(asnf(n)._1, cext !(caf(n) '), asnf(n + 1)._1), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0)), ∀ n. asnf(n)._2 = n ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ trace(ioa)(⌜ef⌝ ) ↔ traceω(ioa)(ef); (s) Used terms: λ n. asnf(n)._1, aext, astep, astart, caf, cext

Proof step 271 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 272 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 273:

  asnf(0) = (as, 0), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ astart(as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. move(IOAut(astart, astep, aext))(asnf(n)._1, cext !(caf(n) '), asnf(n + 1)._1), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0)), ∀ n. asnf(n)._2 = n ⊦

Rule argument

Additional information

Proof step 273 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

Additional information

Used terms: csf(0), as

Proof step 274 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 275:

  asnf(0) = (as, 0), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ move(IOAut(astart, astep, aext))(asnf(n)._1, cext !(caf(n) '), asnf(n + 1)._1), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0)), ∀ n. asnf(n)._2 = n ⊦

Rule argument

Additional information

Proof step 275 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 276:

  asnf(0) = (as, 0), asnf(n) = (as0, n0), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ move(IOAut(astart, astep, aext))(as0, cext !(caf(n) '), asnf(n + 1)._1), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. asnf(n)._2 = n, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0)), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1) ⊦

Rule argument

Additional information

Used terms: as0, n0

Proof step 276 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 277:

  asnf(n) = (as0, n0), asnf(0) = (as, 0), asnf(n + 1) = (as1, n1), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ move(IOAut(astart, astep, aext))(as0, cext !(caf(n) '), as1), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0)), ∀ n. asnf(n)._2 = n ⊦

Rule argument

Additional information

Used terms: as1, n1

Proof step 277 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 278:

  asnf(n + 1) = (as1, n1), asnf(0) = (as, 0), asnf(n) = (as0, n0), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ move(IOAut(astart, astep, aext))(as0, cext !(caf(n) '), as1), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. asnf(n)._2 = n, ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0)), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1) ⊦

Rule argument

Additional information

Used terms: n

Proof step 278 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 279:

  asnf(n) = (as0, n0), asnf(0) = (as, 0), asnf(n + 1) = (as1, n0 + 1), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as0), aINV(as1), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as0, cext !(caf(n0) '), as1), t(csf(n0), as0), t(csf(n0 + 1), as1), t(csf(0), as), ¬ move(IOAut(astart, astep, aext))(as0, cext !(caf(n) '), as1), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0)), ∀ n. asnf(n)._2 = n ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b); (ws)

Proof step 279 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And closed the goal!

Rule argument

Additional information

Used terms: n

Proof step 280 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 281:

  asnf(0) = (as, 0), ⌜ef⌝ = cext !(⌜caf⌝ ), asnf(n)._2 ≠ n, aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0)), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1) ⊦

Rule argument

Additional information

Proof step 281 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 282:

  asnf(0) = (as, 0), asnf(n) = (as0, n0), ⌜ef⌝ = cext !(⌜caf⌝ ), n0 ≠ n, aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0)) ⊦

Rule argument

Additional information

Used terms: as0, n0

Proof step 282 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule weakening

And obtained the following new goals

• Proof step 283:

  asnf(n) = (as0, n0), asnf(0) = (as, 0), ⌜ef⌝ = cext !(⌜caf⌝ ), n0 ≠ n, aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0)), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1) ⊦

Rule argument

Additional information

Proof step 283 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule structural induction

And obtained the following new goals

• Proof step 284:

  asnf(0) = (as, 0), asnf(n1 +1) = (as0, n0), ⌜ef⌝ = cext !(⌜caf⌝ ), n0 ≠ n1 +1, aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0)), ∀ asnf, as0, n0, as, ef, cext, caf, aINV, cstart, csf, cstep, t, astart, astep, aext, cINV. ¬ ( asnf(n1) = (as0, n0) ∧ asnf(0) = (as, 0) ∧ ⌜ef⌝ = cext !(⌜caf⌝ ) ∧ n0 ≠ n1 ∧ aINV(as) ∧ cstart(csf(0)) ∧ fragω(IOAut(cstart, cstep, cext))(csf, caf) ∧ t(csf(0), as) ∧ (∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0))) ∧ (∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el)) ∧ (∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass)) ∧ (∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass)) ∧ (∀ cs. cstart(cs) → cINV(cs)) ∧ (∀ as. astart(as) → aINV(as)) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ∧ (∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0)) ∧ (∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as))) ∧ (∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as)) ∧ (∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as))) ∧ (∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs)) ∧ (∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1))) ∧ (∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1))) ⊦

Rule argument

Additional information

Used simplifier rules: Nat freely generated by 0, +1;;

Proof step 284 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 285:

  asnf(0) = (as, 0), asnf(n1 + 1) = (as0, n0), ⌜ef⌝ = cext !(⌜caf⌝ ), n0 ≠ n1 + 1, aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0)), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ asnf0, as1, n, as2, ef0, cext0, caf0, aINV0, cstart0, csf0, cstep0, t0, astart0, astep0, aext0, cINV0. asnf0(n1) ≠ (as1, n) ∨ asnf0(0) ≠ (as2, 0) ∨ ⌜ef0⌝ ≠ cext0 !(⌜caf0⌝ ) ∨ n = n1 ∨ ¬ aINV0(as2) ∨ ¬ cstart0(csf0(0)) ∨ ¬ fragω(IOAut(cstart0, cstep0, cext0))(csf0, caf0) ∨ ¬ t0(csf0(0), as2) ∨ ¬ (∀ a. ¬ edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, cext0 !(caf0(asn._2) '), asn0._1))) (a, (as2, 0))) ∨ ¬(∀ el. trace*(IOAut(cstart0, cstep0, cext0))(el) → trace*(IOAut(astart0, astep0, aext0))(el)) ∨ ¬(∀ cs. cstart0(cs) → (∃ ass. ∀ as. t0(cs, as) ∧ aINV0(as) ↔ as ∈ ass)) ∨ ¬(∀ as1, el. aINV0(as1) → (∃ ass. ∀ as2. move(IOAut(astart0, astep0, aext0))(as1, el, as2) ∧ aINV0(as2) ↔ as2 ∈ ass)) ∨ ¬(∀ cs. cstart0(cs) → cINV0(cs)) ∨ ¬(∀ as. astart0(as) → aINV0(as)) ∨ ¬(∀ cs, ca, cs0. cINV0(cs) ∧ cstep0(cs, ca, cs0) → cINV0(cs0)) ∨ ¬(∀ as, aa, as0. aINV0(as) ∧ astep0(as, aa, as0) → aINV0(as0)) ∨ ¬(∀ cs. cINV0(cs) → (∃ as. t0(cs, as) ∧ aINV0(as))) ∨ ¬(∀ cs, as. cstart0(cs) ∧ t0(cs, as) ∧ aINV0(as) → astart0(as)) ∨ ¬ (∀ cs, ca, cs0, as0. cINV0(cs) ∧ cstep0(cs, ca, cs0) ∧ t0(cs0, as0) ∧ aINV0(as0) → (∃ as. aINV0(as) ∧ move(IOAut(astart0, astep0, aext0))(as, cext0 !(ca '), as0) ∧ t0(cs, as))) ∨ ¬(∀ cs. (∃ csl, cal. frag*(IOAut(cstart0, cstep0, cext0))(csl, cal) ∧ cstart0(csl[0]) ∧ cs = csl.last) → cINV0(cs)) ∨ ¬ (∀ n. edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, cext0 !(caf0(asn._2) '), asn0._1))) (asnf0(n), asnf0(n + 1))) ∨ ¬(∀ n. t0(csf0(asnf0(n)._2), asnf0(n)._1) ∧ aINV0(asnf0(n)._1)) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ m +1 = m + 1; (s)

Proof step 285 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 286:

  asnf(n1 + 1) = (as0, n0), asnf(0) = (as, 0), ⌜ef⌝ = cext !(⌜caf⌝ ), n0 ≠ n1 + 1, aINV(as), cstart(csf(0)), edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n1), asnf(n1 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(0), as), ∀ asnf0, as1, n, as2, ef0, cext0, caf0, aINV0, cstart0, csf0, cstep0, t0, astart0, astep0, aext0, cINV0. asnf0(n1) ≠ (as1, n) ∨ asnf0(0) ≠ (as2, 0) ∨ ⌜ef0⌝ ≠ cext0 !(⌜caf0⌝ ) ∨ n = n1 ∨ ¬ aINV0(as2) ∨ ¬ cstart0(csf0(0)) ∨ ¬ fragω(IOAut(cstart0, cstep0, cext0))(csf0, caf0) ∨ ¬ t0(csf0(0), as2) ∨ ¬ (∀ a. ¬ edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, cext0 !(caf0(asn._2) '), asn0._1))) (a, (as2, 0))) ∨ ¬(∀ el. trace*(IOAut(cstart0, cstep0, cext0))(el) → trace*(IOAut(astart0, astep0, aext0))(el)) ∨ ¬(∀ cs. cstart0(cs) → (∃ ass. ∀ as. t0(cs, as) ∧ aINV0(as) ↔ as ∈ ass)) ∨ ¬(∀ as1, el. aINV0(as1) → (∃ ass. ∀ as2. move(IOAut(astart0, astep0, aext0))(as1, el, as2) ∧ aINV0(as2) ↔ as2 ∈ ass)) ∨ ¬(∀ cs. cstart0(cs) → cINV0(cs)) ∨ ¬(∀ as. astart0(as) → aINV0(as)) ∨ ¬(∀ cs, ca, cs0. cINV0(cs) ∧ cstep0(cs, ca, cs0) → cINV0(cs0)) ∨ ¬(∀ as, aa, as0. aINV0(as) ∧ astep0(as, aa, as0) → aINV0(as0)) ∨ ¬(∀ cs. cINV0(cs) → (∃ as. t0(cs, as) ∧ aINV0(as))) ∨ ¬(∀ cs, as. cstart0(cs) ∧ t0(cs, as) ∧ aINV0(as) → astart0(as)) ∨ ¬ (∀ cs, ca, cs0, as0. cINV0(cs) ∧ cstep0(cs, ca, cs0) ∧ t0(cs0, as0) ∧ aINV0(as0) → (∃ as. aINV0(as) ∧ move(IOAut(astart0, astep0, aext0))(as, cext0 !(ca '), as0) ∧ t0(cs, as))) ∨ ¬(∀ cs. (∃ csl, cal. frag*(IOAut(cstart0, cstep0, cext0))(csl, cal) ∧ cstart0(csl[0]) ∧ cs = csl.last) → cINV0(cs)) ∨ ¬ (∀ n. edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, cext0 !(caf0(asn._2) '), asn0._1))) (asnf0(n), asnf0(n + 1))) ∨ ¬(∀ n. t0(csf0(asnf0(n)._2), asnf0(n)._1) ∧ aINV0(asnf0(n)._1)), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0)) ⊦

Rule argument

Additional information

Used terms: n1

Proof step 286 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 287:

  asnf(0) = (as, 0), asnf(n1 + 1) = (as0, asnf(n1)._2 + 1), ⌜ef⌝ = cext !(⌜caf⌝ ), asnf(n1)._2 ≠ n1, aINV(asnf(n1)._1), aINV(as0), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(asnf(n1)._1, cext !(caf(asnf(n1)._2) '), as0), t(csf(asnf(n1)._2), asnf(n1)._1), t(csf(asnf(n1)._2 + 1), as0), t(csf(0), as), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0)), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ asnf0, as1, n, as2, ef0, cext0, caf0, aINV0, cstart0, csf0, cstep0, t0, astart0, astep0, aext0, cINV0. asnf0(n1) ≠ (as1, n) ∨ asnf0(0) ≠ (as2, 0) ∨ ⌜ef0⌝ ≠ cext0 !(⌜caf0⌝ ) ∨ n = n1 ∨ ¬ aINV0(as2) ∨ ¬ cstart0(csf0(0)) ∨ ¬ fragω(IOAut(cstart0, cstep0, cext0))(csf0, caf0) ∨ ¬ t0(csf0(0), as2) ∨ ¬ (∀ a. ¬ edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, cext0 !(caf0(asn._2) '), asn0._1))) (a, (as2, 0))) ∨ ¬(∀ el. trace*(IOAut(cstart0, cstep0, cext0))(el) → trace*(IOAut(astart0, astep0, aext0))(el)) ∨ ¬(∀ cs. cstart0(cs) → (∃ ass. ∀ as. t0(cs, as) ∧ aINV0(as) ↔ as ∈ ass)) ∨ ¬(∀ as1, el. aINV0(as1) → (∃ ass. ∀ as2. move(IOAut(astart0, astep0, aext0))(as1, el, as2) ∧ aINV0(as2) ↔ as2 ∈ ass)) ∨ ¬(∀ cs. cstart0(cs) → cINV0(cs)) ∨ ¬(∀ as. astart0(as) → aINV0(as)) ∨ ¬(∀ cs, ca, cs0. cINV0(cs) ∧ cstep0(cs, ca, cs0) → cINV0(cs0)) ∨ ¬(∀ as, aa, as0. aINV0(as) ∧ astep0(as, aa, as0) → aINV0(as0)) ∨ ¬(∀ cs. cINV0(cs) → (∃ as. t0(cs, as) ∧ aINV0(as))) ∨ ¬(∀ cs, as. cstart0(cs) ∧ t0(cs, as) ∧ aINV0(as) → astart0(as)) ∨ ¬ (∀ cs, ca, cs0, as0. cINV0(cs) ∧ cstep0(cs, ca, cs0) ∧ t0(cs0, as0) ∧ aINV0(as0) → (∃ as. aINV0(as) ∧ move(IOAut(astart0, astep0, aext0))(as, cext0 !(ca '), as0) ∧ t0(cs, as))) ∨ ¬(∀ cs. (∃ csl, cal. frag*(IOAut(cstart0, cstep0, cext0))(csl, cal) ∧ cstart0(csl[0]) ∧ cs = csl.last) → cINV0(cs)) ∨ ¬ (∀ n. edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, cext0 !(caf0(asn._2) '), asn0._1))) (asnf0(n), asnf0(n + 1))) ∨ ¬(∀ n. t0(csf0(asnf0(n)._2), asnf0(n)._1) ∧ aINV0(asnf0(n)._1)) ⊦

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m + n = m + n0 ↔ n = n0; (s) ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b); (ws)

Proof step 287 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 288:

  asnf(n1 + 1) = (as0, n + 1), asnf(0) = (as, 0), asnf(n1) = (as1, n), ⌜ef⌝ = cext !(⌜caf⌝ ), n ≠ n1, aINV(as), aINV(as0), aINV(as1), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, cext !(caf(n) '), as0), t(csf(0), as), t(csf(n + 1), as0), t(csf(n), as1), ∀ asnf0, as1, n, as2, ef0, cext0, caf0, aINV0, cstart0, csf0, cstep0, t0, astart0, astep0, aext0, cINV0. asnf0(n1) ≠ (as1, n) ∨ asnf0(0) ≠ (as2, 0) ∨ ⌜ef0⌝ ≠ cext0 !(⌜caf0⌝ ) ∨ n = n1 ∨ ¬ aINV0(as2) ∨ ¬ cstart0(csf0(0)) ∨ ¬ fragω(IOAut(cstart0, cstep0, cext0))(csf0, caf0) ∨ ¬ t0(csf0(0), as2) ∨ ¬ (∀ a. ¬ edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, cext0 !(caf0(asn._2) '), asn0._1))) (a, (as2, 0))) ∨ ¬(∀ el. trace*(IOAut(cstart0, cstep0, cext0))(el) → trace*(IOAut(astart0, astep0, aext0))(el)) ∨ ¬(∀ cs. cstart0(cs) → (∃ ass. ∀ as. t0(cs, as) ∧ aINV0(as) ↔ as ∈ ass)) ∨ ¬(∀ as1, el. aINV0(as1) → (∃ ass. ∀ as2. move(IOAut(astart0, astep0, aext0))(as1, el, as2) ∧ aINV0(as2) ↔ as2 ∈ ass)) ∨ ¬(∀ cs. cstart0(cs) → cINV0(cs)) ∨ ¬(∀ as. astart0(as) → aINV0(as)) ∨ ¬(∀ cs, ca, cs0. cINV0(cs) ∧ cstep0(cs, ca, cs0) → cINV0(cs0)) ∨ ¬(∀ as, aa, as0. aINV0(as) ∧ astep0(as, aa, as0) → aINV0(as0)) ∨ ¬(∀ cs. cINV0(cs) → (∃ as. t0(cs, as) ∧ aINV0(as))) ∨ ¬(∀ cs, as. cstart0(cs) ∧ t0(cs, as) ∧ aINV0(as) → astart0(as)) ∨ ¬ (∀ cs, ca, cs0, as0. cINV0(cs) ∧ cstep0(cs, ca, cs0) ∧ t0(cs0, as0) ∧ aINV0(as0) → (∃ as. aINV0(as) ∧ move(IOAut(astart0, astep0, aext0))(as, cext0 !(ca '), as0) ∧ t0(cs, as))) ∨ ¬(∀ cs. (∃ csl, cal. frag*(IOAut(cstart0, cstep0, cext0))(csl, cal) ∧ cstart0(csl[0]) ∧ cs = csl.last) → cINV0(cs)) ∨ ¬ (∀ n. edge ( (λ asn. t0(csf0(asn._2), asn._1) ∧ aINV0(asn._1)) × (λ asn, asn0. aINV0(asn._1) ∧ aINV0(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart0, astep0, aext0))(asn._1, cext0 !(caf0(asn._2) '), asn0._1))) (asnf0(n), asnf0(n + 1))) ∨ ¬(∀ n. t0(csf0(asnf0(n)._2), asnf0(n)._1) ∧ aINV0(asnf0(n)._1)), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, 0)) ⊦

Rule argument

Additional information

Used terms: as1, n

Proof step 288 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And closed the goal!

Rule argument

Additional information

Used terms: asnf, as1, n, as, ef, cext, caf, aINV, cstart, csf, cstep, t, astart, astep, aext, cINV

Proof step 289 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 290:

  asnf(0) = (as, n), ⌜ef⌝ = cext !(⌜caf⌝ ), n ≠ 0, aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as), ¬ traceω(IOAut(astart, astep, aext))(ef), cINV(csf(n - 1)) ∧ cstep(csf(n - 1), caf(n - 1), csf(n)) ∧ t(csf(n), as) ∧ aINV(as) → (∃ as1. aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n - 1) '), as) ∧ t(csf(n - 1), as1)), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n)), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1) ⊦

Rule argument

Additional information

Used terms: csf(n - 1), caf(n - 1), csf(n), as

Proof step 290 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 291:

  asnf(0) = (as, n), ⌜ef⌝ = cext !(⌜caf⌝ ), n ≠ 0, aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as), ¬ traceω(IOAut(astart, astep, aext))(ef), cINV(csf(n - 1)) ∧ cstep(csf(n - 1), caf(n - 1), csf(n)) → aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n - 1) '), as) ∧ t(csf(n - 1), as1), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n)) ⊦

Rule argument

Additional information

Proof step 291 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 292:

  asnf(0) = (as, n), n = n0 + 1, ⌜ef⌝ = cext !(⌜caf⌝ ), n ≠ 0, aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n), as), ¬ traceω(IOAut(astart, astep, aext))(ef), cINV(csf(n0)) ∧ cstep(csf(n0), caf(n0), csf(n)) → aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as) ∧ t(csf(n0), as1), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, (as, n)), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1) ⊦

Rule argument

Additional information

Used simplifier rules: n ≠ 0 ⊦ m = n - 1 ↔ n = m + 1; (elim) Used terms: n, n0

Proof step 292 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 293:

  asnf(0) = (as, n0 + 1), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), cINV(csf(n0)) ∧ cstep(csf(n0), caf(n0), csf(n0 + 1)) → aINV(as1) ∧ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as) ∧ t(csf(n0), as1), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, asnf(0)) ⊦

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m + 1 ≠ 0; (s)

Proof step 293 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 294:

  asnf(0) = (as, n0 + 1), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, asnf(0)), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1) ⊦ cINV(csf(n0)) ∧ cstep(csf(n0), caf(n0), csf(n0 + 1))

• Proof step 301:

  asnf(0) = (as, n0 + 1), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), aINV(as1), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0 + 1), as), t(csf(n0), as1), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, asnf(0)), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1) ⊦

Rule argument

Additional information

Proof step 294 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 295:

  asnf(0) = (as, n0 + 1), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 + 1), as), ¬ cINV(csf(n0)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, asnf(0)), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ ¬ step(sf(n), af(n), sf(n + 1)) → (fragω(IOAut(start, step, ext))(sf, af) ↔ false); (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic

Proof step 295 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 296:

  asnf(0) = (as, n0 + 1), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 + 1), as), ¬ cINV(csf(n0)), ¬ traceω(IOAut(astart, astep, aext))(ef), (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ csf(n0) = csl.last) → cINV(csf(n0)), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, asnf(0)) ⊦

Rule argument

Additional information

Used terms: csf(n0)

Proof step 296 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 297:

  asnf(0) = (as, n0 + 1), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 + 1), as), ¬ cINV(csf(n0)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, asnf(0)), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1) ⊦ ∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ csf(n0) = csl.last

Rule argument

Additional information

Proof step 297 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule exists right

And obtained the following new goals

• Proof step 298:

  asnf(0) = (as, n0 + 1), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 + 1), as), ¬ cINV(csf(n0)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, asnf(0)) ⊦ frag*(IOAut(cstart, cstep, cext))(csf.take(n0 + 1), caf.take(n0)) ∧ cstart(csf.take(n0 + 1)[0]) ∧ csf(n0) = (csf.take(n0 + 1)).last

Rule argument

Additional information

Used terms: csf.take(n0 + 1), caf.take(n0)

Proof step 298 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 299:

  asnf(0) = (as, n0 + 1), ⌜ef⌝ = cext !(⌜caf⌝ ), csf(n0) ≠ (csf.take(n0 + 1)).last, aINV(as), cstart(csf(0)), cstep(csf(n0), caf(n0), csf(n0 + 1)), fragω(IOAut(cstart, cstep, cext))(csf, caf), t(csf(n0 + 1), as), ¬ cINV(csf(n0)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ a. ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (a, asnf(0)), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1) ⊦

Rule argument

Additional information

Used simplifier rules: m < n ⊦ nf.take(n)[m] = nf(m); (s) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m + 1 ≠ 0; (s) ⊦ 0 < m ↔ m ≠ 0; (s) ⊦ fragω(IOAut(start, step, ext))(sf, af) → (frag*(IOAut(start, step, ext))(sf.take(n + 1), af.take(n)) ↔ true); (ss)

Proof step 299 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 300:

  ⊦ nf.take(m + 1) = nf.take(m) + nf(m) '

Rule argument

Additional information

Used simplifier rules: ⊦ (x + a ').last = a; (s) a: ⊦ (x + y) + z = x + y + z; from specification list Used terms: csf, n0

Proof step 300 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 301 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 302:

  asnf(0) = (as, n0 + 1), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as1), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) ((as1, n0), asnf(0)), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el) ⊦

Rule argument

Additional information

Used terms: (as1, n0)

Proof step 302 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 303:

  ⊦ edge(vs × es)(a, b) ↔ es(a, b) ∧ vs(a) ∧ vs(b)

• Proof step 304:

  asnf(0) = (as, n0 + 1), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as), aINV(as1), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0 + 1), as), t(csf(n0), as1), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ( ¬ aINV((as1, n0)._1) ∨ ¬ aINV(asnf(0)._1) ∨ asnf(0)._2 ≠ (as1, n0)._2 + 1 ∨ ¬ move(IOAut(astart, astep, aext))((as1, n0)._1, cext !(caf((as1, n0)._2) '), asnf(0)._1)) ∨ (¬ t(csf((as1, n0)._2), (as1, n0)._1) ∨ ¬ aINV((as1, n0)._1)) ∨ ¬ t(csf(asnf(0)._2), asnf(0)._1) ∨ ¬ aINV(asnf(0)._1) ⊦

Rule argument

Additional information

Used terms: λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1), λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1), (as1, n0), asnf(0)

Proof step 303 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 304 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 305:

  asnf(0) = (as, n0 + 1), ⌜ef⌝ = cext !(⌜caf⌝ ), aINV(as1), aINV(as), cstart(csf(0)), fragω(IOAut(cstart, cstep, cext))(csf, caf), move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), as), t(csf(n0), as1), t(csf(n0 + 1), as), ¬ traceω(IOAut(astart, astep, aext))(ef), ∀ n. t(csf(asnf(n)._2), asnf(n)._1) ∧ aINV(asnf(n)._1), ∀ n. edge ( (λ asn. t(csf(asn._2), asn._1) ∧ aINV(asn._1)) × (λ asn, asn0. aINV(asn._1) ∧ aINV(asn0._1) ∧ asn0._2 = asn._2 + 1 ∧ move(IOAut(astart, astep, aext))(asn._1, cext !(caf(asn._2) '), asn0._1))) (asnf(n), asnf(n + 1)), ∀ cs. (∃ csl, cal. frag*(IOAut(cstart, cstep, cext))(csl, cal) ∧ cstart(csl[0]) ∧ cs = csl.last) → cINV(cs), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ cs. cstart(cs) → cINV(cs), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ el. trace*(IOAut(cstart, cstep, cext))(el) → trace*(IOAut(astart, astep, aext))(el), asnf(0)._2 ≠ n0 + 1 ∨ ¬ move(IOAut(astart, astep, aext))(as1, cext !(caf(n0) '), asnf(0)._1) ∨ ¬ t(csf(asnf(0)._2), asnf(0)._1) ∨ ¬ aINV(asnf(0)._1) ⊦

Rule argument

Additional information

Proof step 305 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And closed the goal!

Rule argument

Additional information

Used terms: as0, n

Proof step 306 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 307:

  C_≤*T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), ¬ C_≤T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), ¬ cINV(csl.last), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → cINV(cs), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ IOAut(start, step, ext).start = start; (s) ⊦ exec*(ioa)(sl, al) ↔ frag*(ioa)(sl, al) ∧ ioa.start(sl[0]); (s)

Proof step 307 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 308:

  C_≤*T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), ¬ C_≤T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), ¬ cINV(csl.last), cstart(csl[0]) → cINV(csl[0]), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as. astart(as) → aINV(as), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass) ⊦

Rule argument

Additional information

Used terms: csl[0]

Proof step 308 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 309:

  C_≤*T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), cINV(csl[0]), cstart(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), ¬ C_≤T_A(IOAut(cstart, cstep, cext), IOAut(astart, astep, aext)), ¬ cINV(csl.last), ∀ cs. cstart(cs) → (∃ ass. ∀ as. t(cs, as) ∧ aINV(as) ↔ as ∈ ass), ∀ as1, el. aINV(as1) → (∃ ass. ∀ as2. move(IOAut(astart, astep, aext))(as1, el, as2) ∧ aINV(as2) ↔ as2 ∈ ass), ∀ as. astart(as) → aINV(as), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ as, aa, as0. aINV(as) ∧ astep(as, aa, as0) → aINV(as0), ∀ cs. cINV(cs) → (∃ as. t(cs, as) ∧ aINV(as)), ∀ cs, as. cstart(cs) ∧ t(cs, as) ∧ aINV(as) → astart(as), ∀ cs, ca, cs0, as0. cINV(cs) ∧ cstep(cs, ca, cs0) ∧ t(cs0, as0) ∧ aINV(as0) → (∃ as. aINV(as) ∧ move(IOAut(astart, astep, aext))(as, cext !(ca '), as0) ∧ t(cs, as)) ⊦

Rule argument

Additional information

Proof step 309 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule weakening

And obtained the following new goals

• Proof step 310:

  cINV(csl[0]), frag*(IOAut(cstart, cstep, cext))(csl, cal), ¬ cINV(csl.last), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0) ⊦

Rule argument

Additional information

Proof step 310 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule structural induction

And obtained the following new goals

• Proof step 311:

  cINV((cs + csl0)[0]), frag*(IOAut(cstart, cstep, cext))(cs + csl0, cal), ¬ cINV((cs + csl0).last), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ cINV, cstart, cstep, cext, cal. ¬(cINV(csl0[0]) ∧ frag*(IOAut(cstart, cstep, cext))(csl0, cal) ∧ ¬ cINV(csl0.last) ∧ (∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0))) ⊦

Rule argument

Additional information

Used simplifier rules: List('a) freely generated by [], +;; ⊦ ¬ frag*(IOAut(start, step, ext))([], al); (s)

Proof step 311 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 312:

  cINV(cs), frag*(IOAut(cstart, cstep, cext))(cs ' + csl0, cal), ¬ cINV((cs ' + csl0).last), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ cINV0, cstart0, cstep0, cext0, cal0. ¬ cINV0(csl0[0]) ∨ ¬ frag*(IOAut(cstart0, cstep0, cext0))(csl0, cal0) ∨ cINV0(csl0.last) ∨ ¬(∀ cs, ca, cs0. cINV0(cs) ∧ cstep0(cs, ca, cs0) → cINV0(cs0)) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ a + x = a ' + x; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ (a ' + x)[0] = a; (s)

Proof step 312 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule constructor cut

And obtained the following new goals

• Proof step 313:

  cal = ca0 + cal1, cINV(cs), frag*(IOAut(cstart, cstep, cext))(cs ' + csl0, cal), ¬ cINV((cs ' + csl0).last), ∀ cINV0, cstart0, cstep0, cext0, cal0. ¬ cINV0(csl0[0]) ∨ ¬ frag*(IOAut(cstart0, cstep0, cext0))(csl0, cal0) ∨ cINV0(csl0.last) ∨ ¬(∀ cs, ca, cs0. cINV0(cs) ∧ cstep0(cs, ca, cs0) → cINV0(cs0)), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0) ⊦

Rule argument

Additional information

Used simplifier rules: List('a) freely generated by [], +;; ⊦ frag*(IOAut(start, step, ext))(sl, []) ↔ sl = sl.head '; (s) ⊦ (a ' + x).head = a; (s) ⊦ a ' = a0 ' + x ↔ a = a0 ∧ x = []; (ws) ⊦ x + [] = x; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a '.last = a; (s) ⊦ ¬ frag*(IOAut(start, step, ext))([], al); (s)

Proof step 313 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 314:

  cINV(cs), frag*(IOAut(cstart, cstep, cext))(cs ' + csl0, ca0 ' + cal1), ¬ cINV((cs ' + csl0).last), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ cINV0, cstart0, cstep0, cext0, cal0. ¬ cINV0(csl0[0]) ∨ ¬ frag*(IOAut(cstart0, cstep0, cext0))(csl0, cal0) ∨ cINV0(csl0.last) ∨ ¬(∀ cs, ca, cs0. cINV0(cs) ∧ cstep0(cs, ca, cs0) → cINV0(cs0)) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ a + x = a ' + x; (s)

Proof step 314 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 315:

  ⊦ frag*(IOAut(start, step, ext))(s ' + sl, a ' + al) ↔ step(s, a, sl.head) ∧ frag*(IOAut(start, step, ext))(sl, al)

• Proof step 316:

  cINV(cs), cstep(cs, ca0, csl0.head), frag*(IOAut(cstart, cstep, cext))(csl0, cal1), ¬ cINV((cs ' + csl0).last), ∀ cINV0, cstart0, cstep0, cext0, cal0. ¬ cINV0(csl0[0]) ∨ ¬ frag*(IOAut(cstart0, cstep0, cext0))(csl0, cal0) ∨ cINV0(csl0.last) ∨ ¬(∀ cs, ca, cs0. cINV0(cs) ∧ cstep0(cs, ca, cs0) → cINV0(cs0)), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0) ⊦

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list Used terms: cext, cs, cal1, ca0, cstep, cstart, csl0

Proof step 315 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 316 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 317:

  cINV(cs), cstep(cs, ca0, csl0.head), frag*(IOAut(cstart, cstep, cext))(csl0, cal1), ¬ cINV((cs ' + csl0).last), cINV(cs) ∧ cstep(cs, ca0, hd(⌜csl0⌝ )) → cINV(hd(⌜csl0⌝ )), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ∀ cINV0, cstart0, cstep0, cext0, cal0. ¬ cINV0(csl0[0]) ∨ ¬ frag*(IOAut(cstart0, cstep0, cext0))(csl0, cal0) ∨ cINV0(csl0.last) ∨ ¬(∀ cs, ca, cs0. cINV0(cs) ∧ cstep0(cs, ca, cs0) → cINV0(cs0)) ⊦

Rule argument

Additional information

Used terms: cs, ca0, hd(⌜csl0⌝ )

Proof step 317 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 318:

  cINV(cs), cstep(cs, ca0, csl0.head), frag*(IOAut(cstart, cstep, cext))(csl0, cal1), ¬ cINV((cs ' + csl0).last), cstep(cs, ca0, hd(⌜csl0⌝ )) → cINV(hd(⌜csl0⌝ )), ∀ cINV0, cstart0, cstep0, cext0, cal0. ¬ cINV0(csl0[0]) ∨ ¬ frag*(IOAut(cstart0, cstep0, cext0))(csl0, cal0) ∨ cINV0(csl0.last) ∨ ¬(∀ cs, ca, cs0. cINV0(cs) ∧ cstep0(cs, ca, cs0) → cINV0(cs0)), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0) ⊦

Rule argument

Additional information

Proof step 318 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 319:

  cINV(cs), cstep(cs, ca0, csl0.head), frag*(IOAut(cstart, cstep, cext))(csl0, cal1), ¬ cINV((cs ' + csl0).last), cstep(cs, ca0, hd(⌜csl0⌝ )) → cINV(hd(⌜csl0⌝ )), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ¬ cINV(csl0[0]) ∨ ¬ frag*(IOAut(cstart, cstep, cext))(csl0, cal1) ∨ cINV(csl0.last) ∨ ¬(∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0)) ⊦

Rule argument

Additional information

Used terms: cINV, cstart, cstep, cext, cal1

Proof step 319 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 320:

  cINV(cs), cstep(cs, ca0, csl0.head), frag*(IOAut(cstart, cstep, cext))(csl0, cal1), ¬ cINV((cs ' + csl0).last), cstep(cs, ca0, hd(⌜csl0⌝ )) → cINV(hd(⌜csl0⌝ )), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ¬ cINV(csl0[0]) ∨ cINV(csl0.last) ⊦

Rule argument

Additional information

Proof step 320 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 321:

  ⊦ x ≠ [] → (a ' + x).last = x.last

• Proof step 322:

  csl0 ≠ [], cINV(cs), cstep(cs, ca0, csl0.head), frag*(IOAut(cstart, cstep, cext))(csl0, cal1), ¬ cINV(csl0.last), cstep(cs, ca0, hd(⌜csl0⌝ )) → cINV(hd(⌜csl0⌝ )), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0), ¬ cINV(csl0[0]) ∨ cINV(csl0.last) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ ¬ frag*(IOAut(start, step, ext))([], al); (s) Used terms: cs, csl0

Proof step 321 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

A spec-lemma

Proof step 322 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 323:

  csl0 ≠ [], cINV(cs), cstep(cs, ca0, csl0.head), frag*(IOAut(cstart, cstep, cext))(csl0, cal1), ¬ cINV(csl0.last), ¬ cINV(csl0.head), cstep(cs, ca0, hd(⌜csl0⌝ )) → cINV(hd(⌜csl0⌝ )), ∀ cs, ca, cs0. cINV(cs) ∧ cstep(cs, ca, cs0) → cINV(cs0) ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ x ≠ [] → x[0] = x.head; (s)

Proof step 323 from proof startfin-weakfin-bwinv-is-leqrefine (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And closed the goal!

Rule argument

Additional information

Used simplifier rules: ⊦ x + y = [] ↔ x = [] ∧ y = []; (s) ⊦ a ' ≠ []; (s) ⊦ a + x = a ' + x; (s) ⊦ ⌜x + y⌝ = ⌜x⌝ + ⌜y⌝ ; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ hd(⌜a '⌝ + ⌜x⌝ ) = a; (s) append-assoc: ⊦ (σ + σ1) + σ2 = σ + σ1 + σ2; from specification stream ⊦ x ≠ [] → (head = x.head ∧ tail = x.tail ↔ x = head + tail); (elim) Used terms: csl0, cs1, csl