Proof step 1 from proof allinserts-finished-false-implies-notin-ind (conclusion) (back to tree)

System applied rule normalize

And obtained the following new goals

• Proof step 2:

  n < # sl, exec*(IOAut(setInit, setStep, setExt))(sl, al), ∀ tid, al1, al2. al = al1 + (AInvInsert(tid, e) + al2) → (∃ al3, al4. al2 = al3 + (ARetInsert(tid, false) + al4) ∧ ¬ tid ∈ setExt !(al3).map(.tid)) ⊦ ¬ e ∈ sl[n].gstate.set ∧ (sl[n].pcf(tid) = retInsert ∧ sl[n].lsf(tid).le = e → ¬ sl[n].lsf(tid).lb)

Rule argument

Additional information

Proof step 2 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule structural induction

And obtained the following new goals

• Proof step 3:

  0 < # sl, exec*(IOAut(setInit, setStep, setExt))(sl, al), ∀ tid, al1, al2. al = al1 + (AInvInsert(tid, e) + al2) → (∃ al3, al4. al2 = al3 + (ARetInsert(tid, false) + al4) ∧ ¬ tid ∈ setExt !(al3).map(.tid)) ⊦ ¬ e ∈ sl[0].gstate.set ∧ (sl[0].pcf(tid) = retInsert ∧ sl[0].lsf(tid).le = e → ¬ sl[0].lsf(tid).lb)

• Proof step 7:

  n0 +1 < # sl, exec*(IOAut(setInit, setStep, setExt))(sl, al), ∀ tid, al1, al2. al = al1 + (AInvInsert(tid, e) + al2) → (∃ al3, al4. al2 = al3 + (ARetInsert(tid, false) + al4) ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ sl, al, e, tid. n0 < # sl ∧ exec*(IOAut(setInit, setStep, setExt))(sl, al) ∧ (∀ tid, al1, al2. al = al1 + (AInvInsert(tid, e) + al2) → (∃ al3, al4. al2 = al3 + (ARetInsert(tid, false) + al4) ∧ ¬ tid ∈ setExt !(al3).map(.tid))) → ¬ e ∈ sl[n0].gstate.set ∧ (sl[n0].pcf(tid) = retInsert ∧ sl[n0].lsf(tid).le = e → ¬ sl[n0].lsf(tid).lb) ⊦ ¬ e ∈ sl[n0 +1].gstate.set ∧ (sl[n0 +1].pcf(tid) = retInsert ∧ sl[n0 +1].lsf(tid).le = e → ¬ sl[n0 +1].lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: Nat freely generated by 0, +1;;

Proof step 3 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 4:

  sl ≠ [], frag*(IOAut(setInit, setStep, setExt))(sl, al), setInit(sl.head), ∀ tid0, al1, al2. al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)) ⊦ ¬ e ∈ sl.head.gstate.set ∧ (sl.head.pcf(tid) = retInsert ∧ sl.head.lsf(tid).le = e → ¬ sl.head.lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ x ≠ [] → x[0] = x.head; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a + x = a ' + x; (s) ⊦ # x = 0 ↔ x = []; (s) ⊦ 0 < m ↔ m ≠ 0; (s) ⊦ IOAut(start, step, ext).start = start; (s) ⊦ exec*(ioa)(sl, al) ↔ frag*(ioa)(sl, al) ∧ ioa.start(sl[0]); (s)

Proof step 4 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 5:

  sl = s + sl0, sl ≠ [], frag*(IOAut(setInit, setStep, setExt))(sl, al), setInit(s), ∀ tid0, al1, al2. al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)) ⊦ ¬ e ∈ s.gstate.set ∧ (s.pcf(tid) = retInsert ∧ s.lsf(tid).le = e → ¬ s.lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ x ≠ [] → (head = x.head ∧ tail = x.tail ↔ x = head + tail); (elim) Used terms: sl, s, sl0

Proof step 5 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 6:

  frag*(IOAut(setInit, setStep, setExt))(s ' + sl0, al), setInit(s), ∀ tid0, al1, al2. al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)) ⊦ ¬ e ∈ s.gstate.set ∧ (s.pcf(tid) = retInsert ∧ s.lsf(tid).le = e → ¬ s.lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ a + x = a ' + x; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ' ≠ []; (s) ⊦ x + y = [] ↔ x = [] ∧ y = []; (s)

Proof step 6 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And closed the goal!

Rule argument

Additional information

Used simplifier rules: ⊦ setInit(mkstate(gs, lsf, pcf)) ↔ (gs.set = ∅ ∧ pcf = (λ tid. idle)) ∧ (∀ tid. lsf(tid).tid = tid); (s) ⊦ ¬ a ∈ ∅; (s) ⊦ idle ≠ retInsert; (s) ⊦ (gstate = s.gstate ∧ lsf = s.lsf) ∧ pcf = s.pcf ↔ s = mkstate(gstate, lsf, pcf); (elim) Used terms: s, gstate, lsf, pcf

Proof step 7 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 8:

  sl ≠ [], n0 + 1 < # sl, frag*(IOAut(setInit, setStep, setExt))(sl, al), setInit(sl.head), ∀ tid0, al1, al2. al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), ∀ sl0, al0, e0, tid0. n0 < # sl0 ∧ frag*(IOAut(setInit, setStep, setExt))(sl0, al0) ∧ setInit(sl0[0]) ∧ (∀ tid1, al1, al2. al0 = al1 + AInvInsert(tid1, e0) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid1, false) ' + al4 ∧ ¬ tid1 ∈ setExt !(al3).map(.tid))) → ¬ e0 ∈ sl0[n0].gstate.set ∧ (sl0[n0].pcf(tid0) = retInsert ∧ sl0[n0].lsf(tid0).le = e0 → ¬ sl0[n0].lsf(tid0).lb) ⊦ ¬ e ∈ sl[n0 + 1].gstate.set ∧ (sl[n0 + 1].pcf(tid) = retInsert ∧ sl[n0 + 1].lsf(tid).le = e → ¬ sl[n0 + 1].lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ x ≠ [] → x[0] = x.head; (s) ⊦ # x = 0 ↔ x = []; (s) f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic ⊦ m +1 = m + 1; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a + x = a ' + x; (s) ⊦ IOAut(start, step, ext).start = start; (s) ⊦ exec*(ioa)(sl, al) ↔ frag*(ioa)(sl, al) ∧ ioa.start(sl[0]); (s)

Proof step 8 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 9:

  sl = s + sl1, sl ≠ [], n0 + 1 < # sl, frag*(IOAut(setInit, setStep, setExt))(sl, al), setInit(s), ∀ sl0, al0, e0, tid0. n0 < # sl0 ∧ frag*(IOAut(setInit, setStep, setExt))(sl0, al0) ∧ setInit(sl0[0]) ∧ (∀ tid1, al1, al2. al0 = al1 + AInvInsert(tid1, e0) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid1, false) ' + al4 ∧ ¬ tid1 ∈ setExt !(al3).map(.tid))) → ¬ e0 ∈ sl0[n0].gstate.set ∧ (sl0[n0].pcf(tid0) = retInsert ∧ sl0[n0].lsf(tid0).le = e0 → ¬ sl0[n0].lsf(tid0).lb), ∀ tid0, al1, al2. al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)) ⊦ ¬ e ∈ sl[n0 + 1].gstate.set ∧ (sl[n0 + 1].pcf(tid) = retInsert ∧ sl[n0 + 1].lsf(tid).le = e → ¬ sl[n0 + 1].lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ x ≠ [] → (head = x.head ∧ tail = x.tail ↔ x = head + tail); (elim) Used terms: sl, s, sl1

Proof step 9 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 10:

  sl1 ≠ [], n0 < # sl1, frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al), setInit(s), ∀ sl0, al0, e0, tid0. n0 < # sl0 ∧ frag*(IOAut(setInit, setStep, setExt))(sl0, al0) ∧ setInit(sl0[0]) ∧ (∀ tid1, al1, al2. al0 = al1 + AInvInsert(tid1, e0) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid1, false) ' + al4 ∧ ¬ tid1 ∈ setExt !(al3).map(.tid))) → ¬ e0 ∈ sl0[n0].gstate.set ∧ (sl0[n0].pcf(tid0) = retInsert ∧ sl0[n0].lsf(tid0).le = e0 → ¬ sl0[n0].lsf(tid0).lb), ∀ tid0, al1, al2. al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)) ⊦ ¬ e ∈ sl1[n0].gstate.set ∧ (sl1[n0].pcf(tid) = retInsert ∧ sl1[n0].lsf(tid).le = e → ¬ sl1[n0].lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ # x = 0 ↔ x = []; (s) f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic a: ⊦ (x + y) + z = x + y + z; from specification list c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ (a ' + x)[n + 1] = x[n]; (s) ⊦ a + x = a ' + x; (s) ⊦ m + n < m + n0 ↔ n < n0; (s) ⊦ m +1 = m + 1; (s) ⊦ #(a ' + x) = (# x)+1; (s) ⊦ a ' ≠ []; (s) ⊦ x + y = [] ↔ x = [] ∧ y = []; (s)

Proof step 10 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 11:

  sl1[n0] = mkstate(gstate, lsf, pcf), sl1 ≠ [], n0 < # sl1, frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al), setInit(s), ∀ tid0, al1, al2. al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), ∀ sl0, al0, e0, tid0. n0 < # sl0 ∧ frag*(IOAut(setInit, setStep, setExt))(sl0, al0) ∧ setInit(sl0[0]) ∧ (∀ tid1, al1, al2. al0 = al1 + AInvInsert(tid1, e0) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid1, false) ' + al4 ∧ ¬ tid1 ∈ setExt !(al3).map(.tid))) → ¬ e0 ∈ sl0[n0].gstate.set ∧ (sl0[n0].pcf(tid0) = retInsert ∧ sl0[n0].lsf(tid0).le = e0 → ¬ sl0[n0].lsf(tid0).lb) ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ (gstate = s.gstate ∧ lsf = s.lsf) ∧ pcf = s.pcf ↔ s = mkstate(gstate, lsf, pcf); (elim) Used terms: sl1[n0], gstate, lsf, pcf

Proof step 11 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 12:

  sl1[n0] = mkstate(gstate, lsf, pcf), sl1 ≠ [], n0 < # sl1, frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al), setInit(s), n0 < #(s ' + sl1) ∧ frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al) ∧ setInit((s ' + sl1)[0]) ∧ (∀ tid1, al1, al2. al = al1 + AInvInsert(tid1, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid1, false) ' + al4 ∧ ¬ tid1 ∈ setExt !(al3).map(.tid))) → ¬ e ∈ (s ' + sl1)[n0].gstate.set ∧ ((s ' + sl1)[n0].pcf(tid) = retInsert ∧ (s ' + sl1)[n0].lsf(tid).le = e → ¬ (s ' + sl1)[n0].lsf(tid).lb), ∀ tid0, al1, al2. al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)) ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used terms: s ' + sl1, al, e, tid

Proof step 12 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 13:

  sl1[n0] = mkstate(gstate, lsf, pcf), sl1 ≠ [], n0 < # sl1, frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al), setInit(s), (al = al1 + AInvInsert(tid1, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid1, false) ' + al4 ∧ ¬ tid1 ∈ setExt !(al3).map(.tid))) → ¬ e ∈ (s ' + sl1)[n0].gstate.set ∧ ((s ' + sl1)[n0].pcf(tid) = retInsert ∧ (s ' + sl1)[n0].lsf(tid).le = e → ¬ (s ' + sl1)[n0].lsf(tid).lb), ∀ tid0, al1, al2. al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)) ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ (a ' + x)[0] = a; (s) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m < n → ¬ n < m; (s) ⊦ m < n + 1 ↔ ¬ n < m; (s) ⊦ m +1 = m + 1; (s) ⊦ #(a ' + x) = (# x)+1; (s)

Proof step 13 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 14:

  sl1[n0] = mkstate(gstate, lsf, pcf), (s ' + sl1)[n0] = mkstate(gstate0, lsf0, pcf0), sl1 ≠ [], n0 < # sl1, frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al), setInit(s), (al = al1 + AInvInsert(tid1, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid1, false) ' + al4 ∧ ¬ tid1 ∈ setExt !(al3).map(.tid))) → ¬ e ∈ gstate0.set ∧ (pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb), ∀ tid0, al1, al2. al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)) ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ (gstate = s.gstate ∧ lsf = s.lsf) ∧ pcf = s.pcf ↔ s = mkstate(gstate, lsf, pcf); (elim) Used terms: (s ' + sl1)[n0], gstate0, lsf0, pcf0

Proof step 14 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 15:

  (s ' + sl1)[n0] = mkstate(gstate0, lsf0, pcf0), sl1[n0] = mkstate(gstate, lsf, pcf), al = al1 + AInvInsert(tid1, e) ' + al2, sl1 ≠ [], n0 < # sl1, frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al), setInit(s), ∀ tid0, al1, al2. al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)) ⊦ ∃ al3, al4. al2 = al3 + ARetInsert(tid1, false) ' + al4 ∧ ¬ tid1 ∈ setExt !(al3).map(.tid), ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

• Proof step 19:

  (s ' + sl1)[n0] = mkstate(gstate0, lsf0, pcf0), sl1[n0] = mkstate(gstate, lsf, pcf), sl1 ≠ [], n0 < # sl1, frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)) ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Proof step 15 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 16:

  sl1[n0] = mkstate(gstate, lsf, pcf), (s ' + sl1)[n0] = mkstate(gstate0, lsf0, pcf0), sl1 ≠ [], n0 < # sl1, frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al1 + AInvInsert(tid1, e) ' + al2), setInit(s), ∀ tid0, al0, al3. al1 + AInvInsert(tid1, e) ' + al2 = al0 + AInvInsert(tid0, e) ' + al3 → (∃ al, al4. al3 = al + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al).map(.tid)) ⊦ ∃ al3, al4. al2 = al3 + ARetInsert(tid1, false) ' + al4 ∧ ¬ tid1 ∈ setExt !(al3).map(.tid), ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Proof step 16 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 17:

  (s ' + sl1)[n0] = mkstate(gstate0, lsf0, pcf0), sl1[n0] = mkstate(gstate, lsf, pcf), sl1 ≠ [], n0 < # sl1, frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al1 + AInvInsert(tid1, e) ' + al2), setInit(s), al1 + AInvInsert(tid1, e) ' + al2 = al1 + AInvInsert(tid1, e) ' + al2 → (∃ al, al4. al2 = al + ARetInsert(tid1, false) ' + al4 ∧ ¬ tid1 ∈ setExt !(al).map(.tid)) ⊦ ∃ al3, al4. al2 = al3 + ARetInsert(tid1, false) ' + al4 ∧ ¬ tid1 ∈ setExt !(al3).map(.tid), ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used terms: tid1, al1, al2

Proof step 17 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 18:

  (s ' + sl1)[n0] = mkstate(gstate0, lsf0, pcf0), sl1[n0] = mkstate(gstate, lsf, pcf), sl1 ≠ [], n0 < # sl1, frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al1 + AInvInsert(tid1, e) ' + al + ARetInsert(tid1, false) ' + al4), setInit(s), ¬ tid1 ∈ setExt !(al).map(.tid) ⊦ ∃ al3, al0. al + ARetInsert(tid1, false) ' + al4 = al3 + ARetInsert(tid1, false) ' + al0 ∧ ¬ tid1 ∈ setExt !(al3).map(.tid), ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list

Proof step 18 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic quantifier closing applied rule exists right

And closed the goal!

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list Used terms: al, al4

Proof step 19 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 20:

  ⊦ ¬ # al < n ∧ n < # sl → ( frag*(IOAut(start, step, ext))(sl, al) ↔ frag*(IOAut(start, step, ext))(sl.take(n + 1), al.take(n)) ∧ frag*(IOAut(start, step, ext))(sl.drop(n), al.drop(n)))

• Proof step 21:

  sl1[n0] = mkstate(gstate, lsf, pcf), (s ' + sl1)[n0] = mkstate(gstate0, lsf0, pcf0), sl1 ≠ [], n0 < # sl1, frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)) ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb), ¬ # al < n0 ∧ n0 < #(s ' + sl1)

• Proof step 24:

  sl1[n0] = mkstate(gstate, lsf, pcf), (s ' + sl1)[n0] = mkstate(gstate0, lsf0, pcf0), sl1 ≠ [], n0 < # sl1, n0 < #(s ' + sl1), frag*(IOAut(setInit, setStep, setExt))((s ' + sl1).take(n0 + 1), al.take(n0)), frag*(IOAut(setInit, setStep, setExt))((s ' + sl1).drop(n0), al.drop(n0)), setInit(s), ¬ # al < n0, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)) ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used terms: al, setExt, s ' + sl1, setInit, n0, setStep

Proof step 20 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 21 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 22:

  sl1[n0] = mkstate(gstate, lsf, pcf), (s ' + sl1)[n0] = mkstate(gstate0, lsf0, pcf0), sl1 ≠ [], # al < # sl1, # al < n0, n0 < # sl1, # al + 1 < # sl1, frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)) ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ m +1 = m + 1; (s) ⊦ m < n → n ≠ 0; (s) trans-Nat: ⊦ n < n0 ∧ n0 < n1 → n < n1; (forward) from specification nat-basic lf: ⊦ m < n ∧ n < n0 → m +1 < n0; (forward) from specification nat-basic f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m < n → ¬ n < m; (s) ⊦ m < n + 1 ↔ ¬ n < m; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ #(a ' + x) = (# x)+1; (s)

Proof step 22 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 23:

  ⊦ frag*(ioa)(sl, al) ↔ # sl = # al + 1 ∧ (∀ n. n < # al → ioa.step(sl[n], al[n], sl[n +1]))

Rule argument

Additional information

Used simplifier rules: ⊦ #(a ' + x) = (# x)+1; (s) ⊦ m + n = m + n0 ↔ n = n0; (s) ⊦ (a ' + x)[n + 1] = x[n]; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ IOAut(start, step, ext).step = step; (s) f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic lf-01: ⊦ m < n ∧ n = n0 → m < n0; (forward) from specification nat-basic lf: ⊦ m < n ∧ n < n0 → m +1 < n0; (forward) from specification nat-basic lf-02: ⊦ m < n ∧ m = n0 → n0 < n; (forward) from specification nat-basic trans-Nat: ⊦ n < n0 ∧ n0 < n1 → n < n1; (forward) from specification nat-basic ⊦ # x = 0 ↔ x = []; (s) ⊦ m +1 = m + 1; (s) ⊦ m + m0 < n → ¬ n + n0 < m; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic Used terms: IOAut(setInit, setStep, setExt), s ' + sl1, al

Proof step 23 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 24 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 25:

  (s ' + sl1)[n0] = mkstate(gstate0, lsf0, pcf0), sl1[n0] = mkstate(gstate, lsf, pcf), sl1 ≠ [], n0 < # sl1, frag*(IOAut(setInit, setStep, setExt))((s ' + sl1).drop(n0), al.drop(n0)), frag*(IOAut(setInit, setStep, setExt))(s ' + sl1.take(n0), al.take(n0)), setInit(s), n0 ≤ # al, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)) ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ m < n ↔ ¬ n ≤ m; (ss) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m < n → ¬ n < m; (s) ⊦ m < n + 1 ↔ ¬ n < m; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ m +1 = m + 1; (s) ⊦ #(a ' + x) = (# x)+1; (s) ⊦ a + x = a ' + x; (s) ⊦ (a ' + x).take(n + 1) = a + x.take(n); (s)

Proof step 25 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 26:

  # al0 = n0, sl1[n0] = mkstate(gstate, lsf, pcf), (s ' + sl1)[n0] = mkstate(gstate0, lsf0, pcf0), al = al0 + al5, sl1 ≠ [], n0 < # sl1, frag*(IOAut(setInit, setStep, setExt))(s ' + sl1.take(n0), al0), frag*(IOAut(setInit, setStep, setExt))((s ' + sl1).drop(n0), al5), setInit(s), n0 ≤ # al, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)) ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ n ≤ # x → (y = x.take(n) ∧ z = x.drop(n) ↔ x = y + z ∧ # y = n); (elim) Used terms: al, n0, al0, al5

Proof step 26 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 27:

  (s ' + sl1)[# al0] = mkstate(gstate0, lsf0, pcf0), sl1[# al0] = mkstate(gstate, lsf, pcf), sl1 ≠ [], # al0 < # sl1, frag*(IOAut(setInit, setStep, setExt))((s ' + sl1).drop(# al0), al5), frag*(IOAut(setInit, setStep, setExt))(s ' + sl1.take(# al0), al0), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + al5 = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)) ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m ≤ m + n; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ #(x + y) = # x + # y; (s)

Proof step 27 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply elim lemma

And obtained the following new goals

• Proof step 28:

  # sl = # al0, sl1[# al0] = mkstate(gstate, lsf, pcf), (s ' + sl1)[# al0] = mkstate(gstate0, lsf0, pcf0), sl1 = sl + sl0, sl1 ≠ [], # al0 < # sl1, frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))((s ' + sl1).drop(# al0), al5), setInit(s), # al0 ≤ # sl1, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + al5 = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)) ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ m < n → m ≤ n; (s) ⊦ n ≤ # x → (y = x.take(n) ∧ z = x.drop(n) ↔ x = y + z ∧ # y = n); (elim) Used terms: sl1, # al0, sl, sl0

Proof step 28 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 29:

  # sl = # al0, (s ' + sl + sl0)[# al0] = mkstate(gstate0, lsf0, pcf0), (sl + sl0)[# al0] = mkstate(gstate, lsf, pcf), sl0 ≠ [], frag*(IOAut(setInit, setStep, setExt))((s ' + sl + sl0).drop(# al0), al5), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + al5 = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)) ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ # x = 0 ↔ x = []; (s) ⊦ m < m + n ↔ n ≠ 0; (s) ⊦ m < n → n ≠ 0; (s) lf-02: ⊦ m < n ∧ m = n0 → n0 < n; (forward) from specification nat-basic f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic ⊦ m < n → m ≤ n; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ #(x + y) = # x + # y; (s) ⊦ x + y = [] ↔ x = [] ∧ y = []; (s)

Proof step 29 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply elim lemma

And obtained the following new goals

• Proof step 30:

  # sl = # al0, # sl1 = # al0, s ' + sl + sl0 = sl1 + sl2, (sl + sl0)[# al0] = mkstate(gstate, lsf, pcf), (s ' + sl + sl0)[# al0] = mkstate(gstate0, lsf0, pcf0), sl0 ≠ [], frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(sl2, al5), setInit(s), # al0 ≤ #(s ' + sl + sl0), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + al5 = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)) ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ #(a ' + x) = (# x)+1; (s) ⊦ #(x + y) = # x + # y; (s) ⊦ m +1 = m + 1; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ m ≤ n ↔ ¬ n < m; (ss) f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic lf-01: ⊦ m < n ∧ n = n0 → m < n0; (forward) from specification nat-basic ⊦ # x = 0 ↔ x = []; (s) ⊦ ¬ m + n < m; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic ⊦ n ≤ # x → (y = x.take(n) ∧ z = x.drop(n) ↔ x = y + z ∧ # y = n); (elim) Used terms: s ' + sl + sl0, # al0, sl1, sl2

Proof step 30 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 31:

  # sl = # al0, # sl1 = # al0, s ' + sl + sl0 = sl1 + sl2, (sl + sl0)[# al0] = mkstate(gstate, lsf, pcf), (sl1 + sl2)[# al0] = mkstate(gstate0, lsf0, pcf0), sl0 ≠ [], frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(sl2, al5), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + al5 = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s ∈ sl2 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m ≤ m + n; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ x + y ↔ a ∈ x ∨ a ∈ y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ m +1 = m + 1; (s) ⊦ #(x + y) = # x + # y; (s) ⊦ #(a ' + x) = (# x)+1; (s)

Proof step 31 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 32:

  ⊦ ¬ n < # x → (x + y)[n] = y[n - # x]

• Proof step 33:

  # sl1 = # al0, # sl = # al0, s ' + sl + sl0 = sl1 + sl2, sl2[# al0 - # sl1] = mkstate(gstate0, lsf0, pcf0), (sl + sl0)[# al0] = mkstate(gstate, lsf, pcf), sl0 ≠ [], frag*(IOAut(setInit, setStep, setExt))(sl2, al5), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ # al0 < # sl1, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + al5 = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s ∈ sl2 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic lf-02: ⊦ m < n ∧ m = n0 → n0 < n; (forward) from specification nat-basic lf-01: ⊦ m < n ∧ n = n0 → m < n0; (forward) from specification nat-basic ⊦ n < # x → (x + y)[n] = x[n]; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ # x = 0 ↔ x = []; (s) ⊦ m < n → ¬ n < m; (s) Used terms: # al0, sl1, sl2

Proof step 32 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 33 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 34:

  # sl1 = # al0, # sl = # al0, s ' + sl + sl0 = sl1 + sl2, (sl + sl0)[# al0] = mkstate(gstate, lsf, pcf), sl2[0] = mkstate(gstate0, lsf0, pcf0), sl0 ≠ [], frag*(IOAut(setInit, setStep, setExt))(sl2, al5), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + al5 = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s ∈ sl2 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ m ≤ m; (s) ⊦ m - m = 0; (s) ⊦ m < n ↔ ¬ n ≤ m; (ss)

Proof step 34 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 35:

  ⊦ ¬ n < # x → (x + y)[n] = y[n - # x]

• Proof step 36:

  # sl = # al0, # sl1 = # al0, s ' + sl + sl0 = sl1 + sl2, sl2[0] = mkstate(gstate0, lsf0, pcf0), sl0[# al0 - # sl] = mkstate(gstate, lsf, pcf), sl0 ≠ [], frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(sl2, al5), setInit(s), ¬ # al0 < # sl, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + al5 = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s ∈ sl2 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ n < # x → (x + y)[n] = x[n]; (s) a: ⊦ (x + y) + z = x + y + z; from specification list f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic lf-02: ⊦ m < n ∧ m = n0 → n0 < n; (forward) from specification nat-basic lf-01: ⊦ m < n ∧ n = n0 → m < n0; (forward) from specification nat-basic ⊦ # x = 0 ↔ x = []; (s) ⊦ frag*(IOAut(start, step, ext))(s ' + sl, al) → (# sl < # al ↔ false); (s) Used terms: # al0, sl, sl0

Proof step 35 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 36 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 37:

  # sl = # al0, # sl1 = # al0, s ' + sl + sl0 = sl1 + sl2, sl0.head = mkstate(gstate, lsf, pcf), sl2[0] = mkstate(gstate0, lsf0, pcf0), sl0 ≠ [], frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(sl2, al5), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + al5 = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s ∈ sl2 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ x ≠ [] → x[0] = x.head; (s) ⊦ m - m = 0; (s) ⊦ frag*(IOAut(start, step, ext))(s ' + sl, al) → (# al < # sl ↔ false); (ss) a: ⊦ (x + y) + z = x + y + z; from specification list

Proof step 37 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 38:

  # sl1 = # al0, # sl = # al0, s ' + sl + sl0 = sl1 + sl2, sl2[0] = mkstate(gstate0, lsf0, pcf0), s0 = mkstate(gstate, lsf, pcf), sl0 = s0 + sl3, sl0 ≠ [], frag*(IOAut(setInit, setStep, setExt))(sl2, al5), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + al5 = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s ∈ sl2 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ x ≠ [] → (head = x.head ∧ tail = x.tail ↔ x = head + tail); (elim) Used terms: sl0, s0, sl3

Proof step 38 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 39:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + sl2, sl2[0] = mkstate(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(sl2, al5), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + al5 = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s ∈ sl2 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ' ≠ []; (s) ⊦ x + y = [] ↔ x = [] ∧ y = []; (s) ⊦ a + x = a ' + x; (s)

Proof step 39 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule constructor cut

And obtained the following new goals

• Proof step 40:

  # sl1 = # al0, # sl = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + sl2, sl2[0] = mkstate(gstate0, lsf0, pcf0), sl2 = s0 + sl0, frag*(IOAut(setInit, setStep, setExt))(sl2, al5), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + al5 = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s ∈ sl2 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: List('a) freely generated by [], +;; ⊦ x + [] = x; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ ¬ frag*(IOAut(start, step, ext))([], al); (s)

Proof step 40 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 41:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, al5), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + al5 = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl0 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ a0 ' + x ↔ a = a0 ∨ a ∈ x; (s) ⊦ a ∈ x + y ↔ a ∈ x ∨ a ∈ y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ a + x = a ' + x; (s) ⊦ (a ' + x)[0] = a; (s)

Proof step 41 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule constructor cut

And obtained the following new goals

• Proof step 42:

  # sl1 = # al0, # sl = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, al5 = [], frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, al5), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + al5 = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl0 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

• Proof step 45:

  # sl1 = # al0, # sl = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, al5 = a + al, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, al5), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + al5 = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl0 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: List('a) freely generated by [], +;;

Proof step 42 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 43:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ', frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0), mkstate(gstate0, lsf0, pcf0) = s ∨ mkstate(gstate0, lsf0, pcf0) ∈ sl ∨ mkstate(gstate0, lsf0, pcf0) = mkstate(gstate, lsf, pcf) ∨ mkstate(gstate0, lsf0, pcf0) ∈ sl3 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ a0 ' + x ↔ a = a0 ∨ a ∈ x; (s) ⊦ a ∈ x + y ↔ a ∈ x ∨ a ∈ y; (s) ⊦ a ∈ a0 ' ↔ a = a0; (s) in-15: ⊦ x + a ' = y → a ∈ y; (forward) from specification list in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ ¬ a ∈ []; (s) ⊦ x + [] = x; (s) ⊦ a ' = a0 ' + x ↔ a = a0 ∧ x = []; (ws) ⊦ (a ' + x).head = a; (s) ⊦ frag*(IOAut(start, step, ext))(sl, []) ↔ sl = sl.head '; (s)

Proof step 43 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 44:

  ⊦ x = y ↔ # x = # y ∧ (∀ n. n < # x → x[n] = y[n])

Rule argument

Additional information

Used simplifier rules: ⊦ #(a ' + x) = (# x)+1; (s) ⊦ m +1 = m + 1; (s) n < n0 ⊦ m + (* n) = m0 + (* n0) ↔ m = m0 + (n0 - n); (s) ⊦ #(x + y) = # x + # y; (s) ⊦ # a ' = 0 +1; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ m < n + 1 ↔ ¬ n < m; (s) ⊦ m = m + n ↔ n = 0; (s) ⊦ m + n = 0 ↔ m = 0 ∧ n = 0; (ws) ⊦ # x = 0 ↔ x = []; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic Used terms: s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3, sl1 + mkstate(gstate0, lsf0, pcf0) '

Proof step 44 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 45 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 46:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, a ' + al), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl0 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a + x = a ' + x; (s)

Proof step 46 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule cut formula

And obtained the following new goals

• Proof step 47:

  # sl1 = # al0, # sl = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), mkstate(gstate, lsf, pcf) = sl0.head, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, a ' + al), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl0 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

• Proof step 240:

  # sl1 = # al0, # sl = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, a ' + al), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl0 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb), (s ' + sl).last = mkstate(gstate0, lsf0, pcf0) ∧ mkstate(gstate, lsf, pcf) = sl0.head

Rule argument

Additional information

Used formulas: (s ' + sl).last = mkstate(gstate0, lsf0, pcf0) ∧ mkstate(gstate, lsf, pcf) = sl0.head

Proof step 47 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule cut formula

And obtained the following new goals

• Proof step 48:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), mkstate(gstate, lsf, pcf) = sl0.head, frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, a ' + al), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), ∃ tid. a = ADoInsert(tid, true), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl0 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

• Proof step 215:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), mkstate(gstate, lsf, pcf) = sl0.head, frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, a ' + al), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl0 ⊦ ∃ tid. a = ADoInsert(tid, true), ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used formulas: ∃ tid. a = ADoInsert(tid, true)

Proof step 48 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 49:

  # sl1 = # al0, # sl = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), mkstate(gstate, lsf, pcf) = sl0.head, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl0 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Proof step 49 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply lemma

And obtained the following new goals

• Proof step 50:

  # sl = # al + 2, SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf), frag*(IOAut(setInit, setStep, setExt))(sl, al + ADoInsert(tid, b) ') ⊦ (∃ n. n < # al ∧ al[n] = AInvInsert(tid, sl.last.lsf(tid).le) ∧ sl[n].pcf(tid) = idle ∧ (∀ m. n < m ∧ m < # al → al[m] ≠ τ ∧ al[m].tid ≠ tid)) ∨ sl.last.lsf(tid).le = sl.head.lsf(tid).le ∧ sl.head.pcf(tid) = invInsert ∧ (∀ m. m < # al → al[m] ≠ τ ∧ al[m].tid ≠ tid)

• Proof step 51:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), mkstate(gstate, lsf, pcf) = sl0.head, frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, ADoInsert(tid0, true) ' + al), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl0 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb), #(s ' + (sl + sl0.head)) = # al0 + 2 ∧ SetInv((s ' + (sl + sl0.head)).head.gstate, (s ' + (sl + sl0.head)).head.lsf, (s ' + (sl + sl0.head)).head.pcf) ∧ frag*(IOAut(setInit, setStep, setExt))(s ' + (sl + sl0.head), al0 + ADoInsert(tid0, true) ')

• Proof step 64:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), mkstate(gstate, lsf, pcf) = sl0.head, frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, ADoInsert(tid0, true) ' + al), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl0, (∃ n. n < # al0 ∧ al0[n] = AInvInsert(tid0, (s ' + (sl + sl0.head)).last.lsf(tid0).le) ∧ (s ' + (sl + sl0.head))[n].pcf(tid0) = idle ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0)) ∨ (s ' + (sl + sl0.head)).last.lsf(tid0).le = (s ' + (sl + sl0.head)).head.lsf(tid0).le ∧ (s ' + (sl + sl0.head)).head.pcf(tid0) = invInsert ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0) ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used terms: s ' + (sl + sl0.head), al0, tid0, true

Proof step 50 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Lemma frag-DoIns

Proof step 51 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 52:

  # sl1 = # al0, # sl = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), mkstate(gstate, lsf, pcf) = sl0.head, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl0 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb), SetInv(s.gstate, s.lsf, s.pcf) ∧ frag*(IOAut(setInit, setStep, setExt))(s ' + sl + mkstate(gstate, lsf, pcf) ', al0 + ADoInsert(tid0, true) ')

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ x + a = x + a '; (s) ⊦ (a ' + x).head = a; (s) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m + n = m + n0 ↔ n = n0; (s) ⊦ m +1 = m + 1; (s) ⊦ # a ' = 0 +1; (s) ⊦ #(x + y) = # x + # y; (s) ⊦ #(a ' + x) = (# x)+1; (s)

Proof step 52 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 53:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), mkstate(gstate, lsf, pcf) = sl0.head, s = mkstate(gstate1, lsf1, pcf1), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, ADoInsert(tid0, true) ' + al), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl0 ⊦ SetInv(gstate1, lsf1, pcf1) ∧ frag*(IOAut(setInit, setStep, setExt))(s ' + sl + mkstate(gstate, lsf, pcf) ', al0 + ADoInsert(tid0, true) '), ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ (gstate = s.gstate ∧ lsf = s.lsf) ∧ pcf = s.pcf ↔ s = mkstate(gstate, lsf, pcf); (elim) Used terms: s, gstate1, lsf1, pcf1

Proof step 53 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 54:

  # sl1 = # al0, # sl = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, mkstate(gstate, lsf, pcf) = sl0.head, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ tid. lsf1(tid).tid = tid, mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1 ∨ mkstate(gstate1, lsf1, λ tid. idle) = mkstate(gstate0, lsf0, pcf0) ∨ mkstate(gstate1, lsf1, λ tid. idle) ∈ sl0 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb), SetInv(gstate1, lsf1, λ tid. idle) ∧ frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ', al0 + ADoInsert(tid0, true) ')

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ a0 ' + x ↔ a = a0 ∨ a ∈ x; (s) ⊦ a ∈ x + y ↔ a ∈ x ∨ a ∈ y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ setInit(mkstate(gs, lsf, pcf)) ↔ (gs.set = ∅ ∧ pcf = (λ tid. idle)) ∧ (∀ tid. lsf(tid).tid = tid); (s)

Proof step 54 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 55:

  # sl = # al0, # sl1 = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, mkstate(gstate, lsf, pcf) = sl0.head, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, ADoInsert(tid0, true) ' + al), ¬ SetInv(gstate1, lsf1, λ tid. idle), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1 ∨ mkstate(gstate1, lsf1, λ tid. idle) = mkstate(gstate0, lsf0, pcf0) ∨ mkstate(gstate1, lsf1, λ tid. idle) ∈ sl0 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

• Proof step 59:

  # sl = # al0, # sl1 = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, mkstate(gstate, lsf, pcf) = sl0.head, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, ADoInsert(tid0, true) ' + al), ¬ frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ', al0 + ADoInsert(tid0, true) '), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1 ∨ mkstate(gstate1, lsf1, λ tid. idle) = mkstate(gstate0, lsf0, pcf0) ∨ mkstate(gstate1, lsf1, λ tid. idle) ∈ sl0 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Proof step 55 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply lemma

And obtained the following new goals

• Proof step 56:

  (gs.set = ∅ ∧ pcf = (λ tid. idle)) ∧ (∀ tid. tid = lsf(tid).tid) ⊦ SetInv(gs, lsf, pcf)

• Proof step 57:

  # sl1 = # al0, # sl = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, mkstate(gstate, lsf, pcf) = sl0.head, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), ¬ SetInv(gstate1, lsf1, λ tid. idle), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ tid. lsf1(tid).tid = tid, mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1 ∨ mkstate(gstate1, lsf1, λ tid. idle) = mkstate(gstate0, lsf0, pcf0) ∨ mkstate(gstate1, lsf1, λ tid. idle) ∈ sl0 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb), (λ tid. idle) = (λ tid. idle) ∧ (∀ tid. tid = lsf1(tid).tid)

Rule argument

Additional information

Used terms: lsf1, gstate1, λ tid. idle

Proof step 56 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 57 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 58:

  # sl = # al0, # sl1 = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, mkstate(gstate, lsf, pcf) = sl0.head, tid1 ≠ lsf1(tid1).tid, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, ADoInsert(tid0, true) ' + al), ¬ SetInv(gstate1, lsf1, λ tid. idle), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1 ∨ mkstate(gstate1, lsf1, λ tid. idle) = mkstate(gstate0, lsf0, pcf0) ∨ mkstate(gstate1, lsf1, λ tid. idle) ∈ sl0 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Proof step 58 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

Additional information

Used terms: tid1

Proof step 59 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 60:

  ⊦ frag*(IOAut(start, step, ext))(sl + s ', al + a ') ↔ step(sl.last, a, s) ∧ frag*(IOAut(start, step, ext))(sl, al)

• Proof step 61:

  # sl1 = # al0, # sl = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, mkstate(gstate, lsf, pcf) = sl0.head, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ tid. lsf1(tid).tid = tid, mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1 ∨ mkstate(gstate1, lsf1, λ tid. idle) = mkstate(gstate0, lsf0, pcf0) ∨ mkstate(gstate1, lsf1, λ tid. idle) ∈ sl0, ¬ setStep((mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last, ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)) ∨ ¬ frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0) ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list Used terms: al0, mkstate(gstate, lsf, pcf), setExt, mkstate(gstate1, lsf1, λ tid. idle) ' + sl, ADoInsert(tid0, true), setInit, setStep

Proof step 60 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 61 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 62:

  # sl = # al0, # sl1 = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, mkstate(gstate, lsf, pcf) = sl0.head, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, ADoInsert(tid0, true) ' + al), ¬ setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1 ∨ mkstate(gstate1, lsf1, λ tid. idle) = mkstate(gstate0, lsf0, pcf0) ∨ mkstate(gstate1, lsf1, λ tid. idle) ∈ sl0 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Proof step 62 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 63:

  ⊦ frag*(IOAut(start, step, ext))(s ' + sl, a ' + al) ↔ step(s, a, sl.head) ∧ frag*(IOAut(start, step, ext))(sl, al)

Rule argument

Additional information

Used terms: al, mkstate(gstate0, lsf0, pcf0), setExt, sl0, ADoInsert(tid0, true), setInit, setStep

Proof step 63 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 64 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 65:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), mkstate(gstate, lsf, pcf) = sl0.head, frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, ADoInsert(tid0, true) ' + al), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl0, n < # al0 ∧ al0[n] = AInvInsert(tid0, lsf(tid0).le) ∧ (s ' + sl + mkstate(gstate, lsf, pcf) ')[n].pcf(tid0) = idle ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0) ∨ lsf(tid0).le = s.lsf(tid0).le ∧ s.pcf(tid0) = invInsert ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0) ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ mkstate(gstate, lsf, pcf).lsf = lsf; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ (a ' + x).head = a; (s) ⊦ x + a = x + a '; (s) ⊦ (a ' + x + b ').last = b; (s)

Proof step 65 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 66:

  # sl1 = # al0, # sl = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), mkstate(gstate, lsf, pcf) = sl0.head, s = mkstate(gstate1, lsf1, pcf1), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), n < # al0 ∧ al0[n] = AInvInsert(tid0, lsf(tid0).le) ∧ (s ' + sl + mkstate(gstate, lsf, pcf) ')[n].pcf(tid0) = idle ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0) ∨ lsf(tid0).le = lsf1(tid0).le ∧ pcf1(tid0) = invInsert ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl0 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ (gstate = s.gstate ∧ lsf = s.lsf) ∧ pcf = s.pcf ↔ s = mkstate(gstate, lsf, pcf); (elim) Used terms: s, gstate1, lsf1, pcf1

Proof step 66 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 67:

  # sl = # al0, # sl1 = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n].pcf(tid0) = idle, gstate1.set = ∅, al0[n] = AInvInsert(tid0, lsf(tid0).le), mkstate(gstate, lsf, pcf) = sl0.head, al0 ≠ [], n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, ADoInsert(tid0, true) ' + al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ tid. lsf1(tid).tid = tid ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ # x = 0 ↔ x = []; (s) f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic lf-01: ⊦ m < n ∧ n = n0 → m < n0; (forward) from specification nat-basic ⊦ mkstate(gstate, lsf, pcf) = mkstate(gstate0, lsf0, pcf0) ↔ gstate = gstate0 ∧ lsf = lsf0 ∧ pcf = pcf0; (ws) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ ¬ a ∈ y → (y + a0 ' + z = a ' + z0 ↔ y = [] ∧ a0 = a ∧ z = z0); (ws) ⊦ a ∈ a0 ' + x ↔ a = a0 ∨ a ∈ x; (s) ⊦ a ∈ x + y ↔ a ∈ x ∨ a ∈ y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ idle ≠ invInsert; (s) ⊦ setInit(mkstate(gs, lsf, pcf)) ↔ (gs.set = ∅ ∧ pcf = (λ tid. idle)) ∧ (∀ tid. lsf(tid).tid = tid); (s)

Proof step 67 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 68:

  # sl1 = # al0, # sl = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al0[n] = AInvInsert(tid0, lsf(tid0).le), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n] = mkstate(gstate2, lsf2, pcf1), mkstate(gstate, lsf, pcf) = sl0.head, pcf1(tid0) = idle, al0 ≠ [], n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ (gstate = s.gstate ∧ lsf = s.lsf) ∧ pcf = s.pcf ↔ s = mkstate(gstate, lsf, pcf); (elim) Used terms: (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n], gstate2, lsf2, pcf1

Proof step 68 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule constructor cut

And obtained the following new goals

• Proof step 69:

  # sl = # al0, # sl1 = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n] = mkstate(gstate2, lsf2, pcf1), al0[n] = AInvInsert(tid0, lsf(tid0).le), mkstate(gstate, lsf, pcf) = sl0.head, pcf1(tid0) = idle, sl0 = [], al0 ≠ [], n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, ADoInsert(tid0, true) ' + al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ tid. lsf1(tid).tid = tid ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

• Proof step 72:

  # sl = # al0, # sl1 = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n] = mkstate(gstate2, lsf2, pcf1), al0[n] = AInvInsert(tid0, lsf(tid0).le), mkstate(gstate, lsf, pcf) = sl0.head, pcf1(tid0) = idle, sl0 = s + sl2, al0 ≠ [], n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl0, ADoInsert(tid0, true) ' + al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ tid. lsf1(tid).tid = tid ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: List('a) freely generated by [], +;;

Proof step 69 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 70:

  # sl = # al0, # sl1 = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ', (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n] = mkstate(gstate2, lsf2, pcf1), al0[n] = AInvInsert(tid0, lsf(tid0).le), mkstate(gstate, lsf, pcf) = [].head, pcf1(tid0) = idle, al0 ≠ [], n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ', ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ tid. lsf1(tid).tid = tid, mkstate(gstate0, lsf0, pcf0) = mkstate(gstate1, lsf1, λ tid. idle) ∨ mkstate(gstate0, lsf0, pcf0) ∈ sl ∨ mkstate(gstate0, lsf0, pcf0) = mkstate(gstate, lsf, pcf) ∨ mkstate(gstate0, lsf0, pcf0) ∈ sl3 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ a0 ' + x ↔ a = a0 ∨ a ∈ x; (s) ⊦ a ∈ x + y ↔ a ∈ x ∨ a ∈ y; (s) ⊦ a ∈ x → a ∈ x + y; (s) in-15: ⊦ x + a ' = y → a ∈ y; (forward) from specification list in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ x + [] = x; (s)

Proof step 70 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 71:

  ⊦ frag*(ioa)(sl, al) ↔ # sl = # al + 1 ∧ (∀ n. n < # al → ioa.step(sl[n], al[n], sl[n +1]))

Rule argument

Additional information

Used simplifier rules: ⊦ # a ' = 0 +1; (s) ⊦ #(a ' + x) = (# x)+1; (s) ⊦ m +1 = m + 1; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ m ≠ 1 → (m + n = 1 ↔ m = 0 ∧ n = 1); (ws) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic Used terms: IOAut(setInit, setStep, setExt), mkstate(gstate0, lsf0, pcf0) ', ADoInsert(tid0, true) ' + al

Proof step 71 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 72 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 73:

  # sl1 = # al0, # sl = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al0[n] = AInvInsert(tid0, lsf(tid0).le), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, al0 ≠ [], n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ x → a ∈ x + y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ a + x = a ' + x; (s) ⊦ (a ' + x).head = a; (s)

Proof step 73 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule cut formula

And obtained the following new goals

• Proof step 74:

  # sl = # al0, # sl1 = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n] = mkstate(gstate2, lsf2, pcf1), al0[n] = AInvInsert(tid0, lsf(tid0).le), e = lsf(tid0).le, pcf1(tid0) = idle, al0 ≠ [], n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ tid. lsf1(tid).tid = tid ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

• Proof step 196:

  # sl = # al0, # sl1 = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n] = mkstate(gstate2, lsf2, pcf1), al0[n] = AInvInsert(tid0, lsf(tid0).le), pcf1(tid0) = idle, al0 ≠ [], e ≠ lsf(tid0).le, n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ tid. lsf1(tid).tid = tid ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used formulas: e = lsf(tid0).le

Proof step 74 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 75:

  # sl1 = # al0, # sl = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al0[n] = AInvInsert(tid0, lsf(tid0).le), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, al0 ≠ [], n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, lsf(tid0).le) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Proof step 75 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 76:

  # sl = # al0, # sl1 = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n] = mkstate(gstate2, lsf2, pcf1), al0[n] = AInvInsert(tid0, lsf(tid0).le), pcf1(tid0) = idle, al0 ≠ [], n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, al0 + ADoInsert(tid0, true) ' + al = al0.take(n) + AInvInsert(tid0, lsf(tid0).le) ' + (al0.drop(n)).tail + ADoInsert(tid0, true) ' + al → (∃ al3, al4. (al0.drop(n)).tail + ADoInsert(tid0, true) ' + al = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used terms: tid0, al0.take(n), (al0.drop(n)).tail + ADoInsert(tid0, true) ' + al

Proof step 76 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 77:

  # sl1 = # al0, # sl = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al0[n] = AInvInsert(tid0, lsf(tid0).le), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, al0 + ADoInsert(tid0, true) ' + al ≠ al0.take(n) + AInvInsert(tid0, lsf(tid0).le) ' + (al0.drop(n)).tail + ADoInsert(tid0, true) ' + al, al0 ≠ [], n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

• Proof step 81:

  # sl1 = # al0, # sl = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al0[n] = AInvInsert(tid0, lsf(tid0).le), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, al0 ≠ [], n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0, ∃ al3, al4. (al0.drop(n)).tail + ADoInsert(tid0, true) ' + al = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid) ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Proof step 77 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 78:

  # sl = # al0, # sl1 = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n] = mkstate(gstate2, lsf2, pcf1), al0[n] = AInvInsert(tid0, lsf(tid0).le), pcf1(tid0) = idle, al0 ≠ [], al0 ≠ al0.take(n) + AInvInsert(tid0, lsf(tid0).le) ' + (al0.drop(n)).tail, n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ # y = # y0 → (x + y = z + y0 ↔ x = z ∧ y = y0); (ws)

Proof step 78 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 79:

  # sl1 = # al0, # sl = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, al0.drop(n) = a + al1, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al0[n] = AInvInsert(tid0, lsf(tid0).le), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, al0.drop(n) ≠ [], al0 ≠ [], al0 ≠ al0.take(n) + AInvInsert(tid0, lsf(tid0).le) ' + al1, n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ n < # x → (x.drop(n) = [] ↔ false); (s) x ≠ [] ⊦ a = x.head ∧ y = x.tail ↔ x = a + y; (elim) Used terms: al0.drop(n), a, al1

Proof step 79 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 80:

  # sl = # al0, # sl1 = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, al0.drop(n) = a ' + al1, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n] = mkstate(gstate2, lsf2, pcf1), al0[n] = AInvInsert(tid0, lsf(tid0).le), pcf1(tid0) = idle, al0 ≠ [], al0 ≠ al0.take(n) + AInvInsert(tid0, lsf(tid0).le) ' + al1, n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, a ∈ al0.drop(n), ¬ lsf(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ n < # x → (x.drop(n) = [] ↔ false); (s) ⊦ a + x = a ' + x; (s)

Proof step 80 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply elim lemma

And closed the goal!

Rule argument

Additional information

Used simplifier rules: ⊦ (x + a ' + y)[# x] = a; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ m < n → m ≤ n; (s) ⊦ n ≤ # x → (y = x.take(n) ∧ z = x.drop(n) ↔ x = y + z ∧ # y = n); (elim) Used terms: al0, n, al2, al3

Proof step 81 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 82:

  # sl = # al0, # sl1 = # al0, (al0.drop(n)).tail + ADoInsert(tid0, true) ' + al = al3 + ARetInsert(tid0, false) ' + al4, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n] = mkstate(gstate2, lsf2, pcf1), al0[n] = AInvInsert(tid0, lsf(tid0).le), pcf1(tid0) = idle, al0 ≠ [], n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al3).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Proof step 82 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 83:

  # sl1 = # al0, # sl = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, al1 + ADoInsert(tid0, true) ' + al = al3 + ARetInsert(tid0, false) ' + al4, al0.drop(n) = a + al1, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al0[n] = AInvInsert(tid0, lsf(tid0).le), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, al0.drop(n) ≠ [], al0 ≠ [], n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al3).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ n < # x → (x.drop(n) = [] ↔ false); (s) x ≠ [] ⊦ a = x.head ∧ y = x.tail ↔ x = a + y; (elim) Used terms: al0.drop(n), a, al1

Proof step 83 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 84:

  # sl = # al0, # sl1 = # al0, al1 + ADoInsert(tid0, true) ' + al = al3 + ARetInsert(tid0, false) ' + al4, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, al0.drop(n) = a ' + al1, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n] = mkstate(gstate2, lsf2, pcf1), al0[n] = AInvInsert(tid0, lsf(tid0).le), pcf1(tid0) = idle, al0 ≠ [], n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, a ∈ al0.drop(n), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al3).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ n < # x → (x.drop(n) = [] ↔ false); (s) ⊦ a + x = a ' + x; (s)

Proof step 84 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply elim lemma

And obtained the following new goals

• Proof step 85:

  # sl1 = # al0, # sl = # al0, # al2 = n, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, al1 + ADoInsert(tid0, true) ' + al = al3 + ARetInsert(tid0, false) ' + al4, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al0[n] = AInvInsert(tid0, lsf(tid0).le), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n] = mkstate(gstate2, lsf2, pcf1), al0 = al2 + al5, al5 = a ' + al1, pcf1(tid0) = idle, al0 ≠ [], n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), a ∈ al5, mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, n ≤ # al0, ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al3).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ m < n → m ≤ n; (s) ⊦ n ≤ # x → (y = x.take(n) ∧ z = x.drop(n) ↔ x = y + z ∧ # y = n); (elim) Used terms: al0, n, al2, al5

Proof step 85 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 86:

  # sl1 = # al2 + # al1 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, al1 + ADoInsert(tid0, true) ' + al = al3 + ARetInsert(tid0, false) ' + al4, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ tid0 ∈ setExt !(al3).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al1 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m < n + 1 ↔ ¬ n < m; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ m +1 = m + 1; (s) ⊦ #(a ' + x) = (# x)+1; (s) ⊦ #(x + y) = # x + # y; (s) ⊦ ¬ m + n < m; (s) ⊦ a ∈ a0 ' + x ↔ a = a0 ∨ a ∈ x; (s) ⊦ m ≤ m + n; (s) ⊦ a ' ≠ []; (s) ⊦ x + y = [] ↔ x = [] ∧ y = []; (s) ⊦ (x + a ' + y)[# x] = a; (s)

Proof step 86 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule cut formula

And obtained the following new goals

• Proof step 87:

  # sl = # sl1, # sl1 = # al2 + # al1 + 1, al1 + ADoInsert(tid0, true) ' + al = al3 + ARetInsert(tid0, false) ' + al4, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, # al3 < # al1, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ tid0 ∈ setExt !(al3).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al1 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

• Proof step 94:

  # sl = # sl1, # sl1 = # al2 + # al1 + 1, al1 + ADoInsert(tid0, true) ' + al = al3 + ARetInsert(tid0, false) ' + al4, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ # al3 < # al1, ¬ tid0 ∈ setExt !(al3).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al1 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used formulas: # al3 < # al1

Proof step 87 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 88:

  # sl = # sl1, # sl1 = # al2 + # al1 + 1, al1 + ADoInsert(tid0, true) ' + al = al3 + ARetInsert(tid0, false) ' + al4, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, al1 ≠ [], # al3 < # al1, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al3).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al1 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ # x = 0 ↔ x = []; (s) f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic

Proof step 88 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 89:

  ⊦ x = y ↔ # x = # y ∧ (∀ n. n < # x → x[n] = y[n])

• Proof step 90:

  #(al3 + ARetInsert(tid0, false) ' + al4) = #(al1 + ADoInsert(tid0, true) ' + al), # sl1 = # al2 + # al1 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, al1 ≠ [], # al3 < # al1, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al3).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al1 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid, ∀ n. n < #(al3 + ARetInsert(tid0, false) ' + al4) → (al3 + ARetInsert(tid0, false) ' + al4)[n] = (al1 + ADoInsert(tid0, true) ' + al)[n] ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used terms: al1 + ADoInsert(tid0, true) ' + al, al3 + ARetInsert(tid0, false) ' + al4

Proof step 89 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 90 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 91:

  # sl = # sl1, # sl1 = # al2 + # al1 + 1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, # al3 + # al4 = # al1 + # al, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, al1 ≠ [], # al3 < # al1, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al3).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al1 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m].tid ≠ tid0, ∀ n. ¬ # al1 + # al < n → (al3 + ARetInsert(tid0, false) ' + al4)[n] = (al1 + ADoInsert(tid0, true) ' + al)[n] ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m < n + 1 ↔ ¬ n < m; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ m +1 = m + 1; (s) ⊦ #(a ' + x) = (# x)+1; (s) ⊦ #(x + y) = # x + # y; (s) ⊦ m + n = m + n0 ↔ n = n0; (s)

Proof step 91 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 92:

  # sl1 = # al2 + # al1 + 1, # sl = # sl1, # al3 + # al4 = # al1 + # al, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, al1 ≠ [], # al3 < # al1, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al3).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ¬ # al1 + # al < # al3 → (al3 + ARetInsert(tid0, false) ' + al4)[# al3] = (al1 + ADoInsert(tid0, true) ' + al)[# al3], ∀ n. ¬ # al1 + # al < n → (al3 + ARetInsert(tid0, false) ' + al4)[n] = (al1 + ADoInsert(tid0, true) ' + al)[n], ∀ m. # al2 < m ∧ ¬ # al2 + # al1 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used terms: # al3

Proof step 92 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 93:

  # sl1 = # al2 + # al1 + 1, # sl = # sl1, # al3 + # al4 = # al1 + # al, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, ARetInsert(tid0, false) = al1[# al3], (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, al1 ≠ [], # al3 < # al1, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, # al3 ≤ # al1 + # al, ¬ tid0 ∈ setExt !(al3).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ n. ¬ # al1 + # al < n → (al3 + ARetInsert(tid0, false) ' + al4)[n] = (al1 + ADoInsert(tid0, true) ' + al)[n], ∀ m. # al2 < m ∧ ¬ # al2 + # al1 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ m < n ↔ ¬ n ≤ m; (ss) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m + m0 < n → ¬ n + n0 < m; (s) ⊦ m +1 = m + 1; (s) ⊦ # x = 0 ↔ x = []; (s) trans-Nat: ⊦ n < n0 ∧ n0 < n1 → n < n1; (forward) from specification nat-basic lf-02: ⊦ m < n ∧ m = n0 → n0 < n; (forward) from specification nat-basic lf: ⊦ m < n ∧ n < n0 → m +1 < n0; (forward) from specification nat-basic f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ n < # x → (x + y)[n] = x[n]; (s) ⊦ (x + a ' + y)[# x] = a; (s)

Proof step 93 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule all left

And closed the goal!

Rule argument

Additional information

Used simplifier rules: ⊦ ¬ m + n < m; (s) ⊦ m + n < m + n0 ↔ n < n0; (s) ⊦ m < n + 1 ↔ ¬ n < m; (s) ⊦ (x + y)[n + # x] = y[n]; (s) ⊦ (a ' + x)[n + 1] = x[n]; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ ARetInsert(tid, b) ≠ τ; (s) ⊦ ARetInsert(tid, b).tid = tid; (s) Used terms: # al2 + # al3 + 1

Proof step 94 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 95:

  # sl1 = # al2 + # al1 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, al1 + ADoInsert(tid0, true) ' + al = al3 + ARetInsert(tid0, false) ' + al4, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, # al1 ≤ # al3, ¬ tid0 ∈ setExt !(al3).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al1 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ m < n ↔ ¬ n ≤ m; (ss)

Proof step 95 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule cut formula

And obtained the following new goals

• Proof step 96:

  # sl = # sl1, # sl1 = # al2 + # al1 + 1, al1 + ADoInsert(tid0, true) ' + al = al3 + ARetInsert(tid0, false) ' + al4, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), al3 = al3.take(# al1) + (ADoInsert(tid0, true) + (al3.drop(# al1)).tail), pcf1(tid0) = idle, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, # al1 ≤ # al3, ¬ tid0 ∈ setExt !(al3).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al1 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

• Proof step 192:

  # sl = # sl1, # sl1 = # al2 + # al1 + 1, al1 + ADoInsert(tid0, true) ' + al = al3 + ARetInsert(tid0, false) ' + al4, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, al3 ≠ al3.take(# al1) + (ADoInsert(tid0, true) + (al3.drop(# al1)).tail), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, # al1 ≤ # al3, ¬ tid0 ∈ setExt !(al3).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al1 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used formulas: al3 = al3.take(# al1) + (ADoInsert(tid0, true) + (al3.drop(# al1)).tail)

Proof step 96 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 97:

  # sl1 = # al2 + # al1 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, al1 + ADoInsert(tid0, true) ' + al = al3 + ARetInsert(tid0, false) ' + al4, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), al3 = al3.take(# al1) + ADoInsert(tid0, true) ' + (al3.drop(# al1)).tail, pcf1(tid0) = idle, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, # al1 ≤ # al3, ¬ tid0 ∈ setExt !(al3).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al1 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a + x = a ' + x; (s)

Proof step 97 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 98:

  # sl = # sl1, # sl1 = # al2 + # al1 + 1, # al0 = # al1, al1 + ADoInsert(tid0, true) ' + al = al3 + ARetInsert(tid0, false) ' + al4, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), al3 = al0 + ADoInsert(tid0, true) ' + al5.tail, al3 = al0 + al5, pcf1(tid0) = idle, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, # al1 ≤ # al3, ¬ tid0 ∈ setExt !(al3).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al1 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ n ≤ # x → (y = x.take(n) ∧ z = x.drop(n) ↔ x = y + z ∧ # y = n); (elim) Used terms: al3, # al1, al0, al5

Proof step 98 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 99:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, ADoInsert(tid0, true) ' + al = al5 + ARetInsert(tid0, false) ' + al4, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), al5 = ADoInsert(tid0, true) ' + al5.tail, pcf1(tid0) = idle, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), ADoInsert(tid0, true) ∈ al5, mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ tid0 ∈ setExt !(al5).map(.tid), ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m ≤ m + n; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ x → a ∈ x + y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ a ∈ x + y ↔ a ∈ x ∨ a ∈ y; (s) ⊦ (x + y).map(f) = x.map(f) + y.map(f); (s) ⊦ ext !(al + al0) = ext !(al) + ext !(al0); (s) ⊦ #(x + y) = # x + # y; (s) ⊦ # x = # z → (x + y = z + y0 ↔ x = z ∧ y = y0); (ws)

Proof step 99 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 100:

  # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al = al5 + ARetInsert(tid0, false) ' + al4, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), al5 = ADoInsert(tid0, true) ' + al1, al5 = a + al1, pcf1(tid0) = idle, al5 ≠ [], frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ADoInsert(tid0, true) ∈ al5, ¬ tid0 ∈ setExt !(al5).map(.tid), ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ x + y = [] ↔ x = [] ∧ y = []; (s) ⊦ a ' ≠ []; (s) a: ⊦ (x + y) + z = x + y + z; from specification list x ≠ [] ⊦ a = x.head ∧ y = x.tail ↔ x = a + y; (elim) Used terms: al5, a, al1

Proof step 100 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 101:

  # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al1 + ARetInsert(tid0, false) ' + al4), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ext-DoInsert: ⊦ setExt(ADoInsert(tid, b)) = τ; ⊦ ¬ a ∈ []; (s) ⊦ [].map(f) = []; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ x + y ↔ a ∈ x ∨ a ∈ y; (s) ⊦ (x + y).map(f) = x.map(f) + y.map(f); (s) ⊦ ext !(a ') = (ext(a) = τ ⊃ [];ext(a).e '); (s) ⊦ ext !(al + al0) = ext !(al) + ext !(al0); (s) ⊦ a + x = a ' + x; (s) ⊦ a ∈ a0 ' + x ↔ a = a0 ∨ a ∈ x; (s) ⊦ a ' ≠ []; (s) ⊦ x + y = [] ↔ x = [] ∧ y = []; (s) ⊦ a ' + x = a0 ' + y ↔ a = a0 ∧ x = y; (ws) ⊦ a ' = a0 ' ↔ a = a0; (s) ⊦ # y = # y0 → (x + y = z + y0 ↔ x = z ∧ y = y0); (ws)

Proof step 101 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 102:

  ⊦ frag*(IOAut(start, step, ext))(s ' + sl, a ' + al) ↔ step(s, a, sl.head) ∧ frag*(IOAut(start, step, ext))(sl, al)

• Proof step 103:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl2, al1 + ARetInsert(tid0, false) ' + al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), (mkstate(gstate, lsf, pcf) ' + sl2).head), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list Used terms: al1 + ARetInsert(tid0, false) ' + al4, mkstate(gstate0, lsf0, pcf0), setExt, mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true), setInit, setStep

Proof step 102 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 103 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 104:

  # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl2, al1 + ARetInsert(tid0, false) ' + al4), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ (a ' + x).head = a; (s)

Proof step 104 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply lemma

And obtained the following new goals

• Proof step 105:

  SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf), frag*(IOAut(setInit, setStep, setExt))(sl, al) ⊦ sl.head.gstate.set ⊆ sl.last.gstate.set ∧ SetInv(sl.last.gstate, sl.last.lsf, sl.last.pcf)

• Proof step 106:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl2, al1 + ARetInsert(tid0, false) ' + al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ SetInv ((mkstate(gstate1, lsf1, λ tid. idle) ' + sl).head.gstate, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).head.lsf, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).head.pcf), ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

• Proof step 110:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, SetInv ((mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last.gstate, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last.lsf, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last.pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl2, al1 + ARetInsert(tid0, false) ' + al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).head.gstate.set ⊆ (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last.gstate.set, ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used terms: mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0

Proof step 105 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Lemma frag-rely-inv

Proof step 106 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply lemma

And obtained the following new goals

• Proof step 107:

  (gs.set = ∅ ∧ pcf = (λ tid. idle)) ∧ (∀ tid. tid = lsf(tid).tid) ⊦ SetInv(gs, lsf, pcf)

• Proof step 108:

  # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl2, al1 + ARetInsert(tid0, false) ' + al4), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ SetInv ((mkstate(gstate1, lsf1, λ tid. idle) ' + sl).head.gstate, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).head.lsf, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).head.pcf), ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb), (λ tid. idle) = (λ tid. idle) ∧ (∀ tid. tid = lsf1(tid).tid)

Rule argument

Additional information

Used simplifier rules: ⊦ mkstate(gstate, lsf, pcf).gstate = gstate; (s) ⊦ mkstate(gstate, lsf, pcf).lsf = lsf; (s) ⊦ (a ' + x).head = a; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ mkstate(gstate, lsf, pcf).pcf = pcf; (s) Used terms: lsf1, gstate1, λ tid. idle

Proof step 107 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 108 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 109:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, tid1 ≠ lsf1(tid1).tid, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl2, al1 + ARetInsert(tid0, false) ' + al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ SetInv(gstate1, lsf1, λ tid. idle), ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ mkstate(gstate, lsf, pcf).pcf = pcf; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ (a ' + x).head = a; (s) ⊦ mkstate(gstate, lsf, pcf).lsf = lsf; (s) ⊦ mkstate(gstate, lsf, pcf).gstate = gstate; (s)

Proof step 109 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

Additional information

Used terms: tid1

Proof step 110 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 111:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl2, al1 + ARetInsert(tid0, false) ' + al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: SetInv-thm: ⊦ SetInv(gs, lsf, pcf) ∧ setStep(mkstate(gs, lsf, pcf), a, mkstate(gs0, lsf0, pcf0)) → SetInv(gs0, lsf0, pcf0); (forward) from specification Set-proofs ⊦ mkstate(gstate, lsf, pcf).pcf = pcf; (s) ⊦ mkstate(gstate, lsf, pcf).lsf = lsf; (s) ⊦ mkstate(gstate, lsf, pcf).gstate = gstate; (s) ⊦ ∅ ⊆ s; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ (a ' + x).head = a; (s)

Proof step 111 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 112:

  ⊦ ¬ # al < n ∧ n < # sl → ( frag*(IOAut(start, step, ext))(sl, al) ↔ frag*(IOAut(start, step, ext))(sl.take(n + 1), al.take(n)) ∧ frag*(IOAut(start, step, ext))(sl.drop(n), al.drop(n)))

• Proof step 113:

  # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl2, al1 + ARetInsert(tid0, false) ' + al4), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb), ¬ #(al1 + ARetInsert(tid0, false) ' + al4) < # al1 + 1 ∧ # al1 + 1 < #(mkstate(gstate, lsf, pcf) ' + sl2)

• Proof step 118:

  # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, # al1 + 1 < #(mkstate(gstate, lsf, pcf) ' + sl2), SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt)) ((mkstate(gstate, lsf, pcf) ' + sl2).take((# al1 + 1) + 1), (al1 + ARetInsert(tid0, false) ' + al4).take(# al1 + 1)), frag*(IOAut(setInit, setStep, setExt)) ((mkstate(gstate, lsf, pcf) ' + sl2).drop(# al1 + 1), (al1 + ARetInsert(tid0, false) ' + al4).drop(# al1 + 1)), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ #(al1 + ARetInsert(tid0, false) ' + al4) < # al1 + 1, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used terms: al1 + ARetInsert(tid0, false) ' + al4, setExt, mkstate(gstate, lsf, pcf) ' + sl2, setInit, # al1 + 1, setStep

Proof step 112 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 113 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 114:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl2, al1 + ARetInsert(tid0, false) ' + al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, # sl2 ≤ # al1, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ m < n ↔ ¬ n ≤ m; (ss) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m + n < m + n0 ↔ n < n0; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ m +1 = m + 1; (s) ⊦ #(a ' + x) = (# x)+1; (s) ⊦ ¬ m < n → ¬ m + m0 < n; (s) ⊦ #(x + y) = # x + # y; (s)

Proof step 114 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 115:

  ⊦ frag*(ioa)(sl, al) ↔ # sl = # al + 1 ∧ (∀ n. n < # al → ioa.step(sl[n], al[n], sl[n +1]))

• Proof step 116:

  #(mkstate(gstate, lsf, pcf) ' + sl2) = #(al1 + ARetInsert(tid0, false) ' + al4) + 1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, # sl2 ≤ # al1, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid, ∀ n. n < #(al1 + ARetInsert(tid0, false) ' + al4) → IOAut(setInit, setStep, setExt).step ((mkstate(gstate, lsf, pcf) ' + sl2)[n], (al1 + ARetInsert(tid0, false) ' + al4)[n], (mkstate(gstate, lsf, pcf) ' + sl2)[n +1]) ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used terms: IOAut(setInit, setStep, setExt), mkstate(gstate, lsf, pcf) ' + sl2, al1 + ARetInsert(tid0, false) ' + al4

Proof step 115 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 116 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 117:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl2 = # al1 + # al4 + 1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, # sl2 ≤ # al1, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ n. ¬ # al1 + # al4 < n → setStep((mkstate(gstate, lsf, pcf) ' + sl2)[n], (al1 + ARetInsert(tid0, false) ' + al4)[n], sl2[n]) ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ IOAut(start, step, ext).step = step; (s) a: ⊦ (x + y) + z = x + y + z; from specification list c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ (a ' + x)[n + 1] = x[n]; (s) ⊦ m +1 = m + 1; (s) ⊦ m < n + 1 ↔ ¬ n < m; (s) ⊦ #(a ' + x) = (# x)+1; (s) ⊦ #(x + y) = # x + # y; (s) n < n0 ⊦ m + (* n) = m0 + (* n0) ↔ m = m0 + (n0 - n); (s)

Proof step 117 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule subst equation

And closed the goal!

Rule argument

Additional information

Used simplifier rules: ⊦ m + 1 ≤ n ↔ m < n; (s) ⊦ ¬ m + n < m; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic

Proof step 118 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 119:

  # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, sl2 ≠ [], # al1 < # sl2, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))((mkstate(gstate, lsf, pcf) ' + sl2).take(2 + # al1), al1 + ARetInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(sl2.drop(# al1), al4), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ # x = 0 ↔ x = []; (s) f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ ¬ m < n → ¬ m + m0 < n; (s) ⊦ m + n < m + n0 ↔ n < n0; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ m +1 = m + 1; (s) ⊦ #(a ' + x) = (# x)+1; (s) ⊦ #(x + y) = # x + # y; (s) ⊦ (a ' + x).take(1) = a '; (s) ⊦ (x + y).take(# x + n) = x + y.take(n); (s) ⊦ (a ' + x).drop(1) = x; (s) ⊦ (x + y).drop(# x + n) = y.drop(n); (s) ⊦ (a ' + x).drop(n + 1) = x.drop(n); (s)

Proof step 119 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply elim lemma

And obtained the following new goals

• Proof step 120:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, sl2 = sl0 + sl4, sl2 ≠ [], # al1 < # sl2, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(sl4, al4), frag*(IOAut(setInit, setStep, setExt))((mkstate(gstate, lsf, pcf) ' + sl2).take(2 + # al1), al1 + ARetInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, # al1 ≤ # sl2, ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ m < n → m ≤ n; (s) ⊦ n ≤ # x → (y = x.take(n) ∧ z = x.drop(n) ↔ x = y + z ∧ # y = n); (elim) Used terms: sl2, # al1, sl0, sl4

Proof step 120 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 121:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + sl4, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, sl4 ≠ [], SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))((mkstate(gstate, lsf, pcf) ' + sl0 + sl4).take(2 + # al1), al1 + ARetInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(sl4, al4), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ # x = 0 ↔ x = []; (s) ⊦ m < m + n ↔ n ≠ 0; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ x → a ∈ x + y; (s) ⊦ m < n → n ≠ 0; (s) lf-02: ⊦ m < n ∧ m = n0 → n0 < n; (forward) from specification nat-basic f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ m < n → m ≤ n; (s) ⊦ #(x + y) = # x + # y; (s) ⊦ x + y = [] ↔ x = [] ∧ y = []; (s)

Proof step 121 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 122:

  n ≠ 0 ⊦ (a ' + x).take((* n)) = a ' + x.take(n -1)

• Proof step 123:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + sl4, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, 2 + # al1 ≠ 0, sl4 ≠ [], SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(sl4, al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + (sl0 + sl4).take((2 + # al1)-1), al1 + ARetInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ m + n = 0 ↔ m = 0 ∧ n = 0; (ws) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (x + y) + z = x + y + z; from specification list Used terms: 2 + # al1, mkstate(gstate, lsf, pcf), sl0 + sl4

Proof step 122 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 123 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 124:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + sl4, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, sl4 ≠ [], SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(sl4, al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + (sl0 + sl4).take(1 + # al1), al1 + ARetInsert(tid0, false) '), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ n ≤ m → m + n0 - n = (m - n) + n0; (s) ⊦ n -1 = n - 1; (s) n < n0 ⊦ (* n) ≠ m0 + (* n0); (s)

Proof step 124 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 125:

  ⊦ # x < n → (x + y).take(n) = x + y.take(n - # x)

• Proof step 126:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + sl4, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, sl4 ≠ [], # sl0 < 1 + # al1, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl0 + sl4.take(1 + # al1 - # sl0), al1 + ARetInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(sl4, al4), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ m < n + 1 ↔ ¬ n < m; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic lf-02: ⊦ m < n ∧ m = n0 → n0 < n; (forward) from specification nat-basic lf-01: ⊦ m < n ∧ n = n0 → m < n0; (forward) from specification nat-basic ⊦ # x = 0 ↔ x = []; (s) ⊦ m < n → ¬ n < m; (s) a: ⊦ (x + y) + z = x + y + z; from specification list Used terms: 1 + # al1, sl0, sl4

Proof step 125 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 126 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 127:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + sl4, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, sl4 ≠ [], SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(sl4, al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl0 + sl4.head ', al1 + ARetInsert(tid0, false) '), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ m ≤ m; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ x ≠ [] → x.take(1) = x.head '; (s) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m - m = 0; (s) ⊦ n ≤ m → m + n0 - n = (m - n) + n0; (s) ⊦ m < n ↔ ¬ n ≤ m; (ss) ⊦ m < n + 1 ↔ ¬ n < m; (s)

Proof step 127 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 128:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + sl4, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, sl4 = s + sl2, sl4 ≠ [], SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl0 + s ', al1 + ARetInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(sl4, al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ x ≠ [] → (head = x.head ∧ tail = x.tail ↔ x = head + tail); (elim) Used terms: sl4, s, sl2

Proof step 128 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 129:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + s ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(s ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl0 + s ', al1 + ARetInsert(tid0, false) '), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ x → a ∈ x + y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ a + x = a ' + x; (s) ⊦ a ' ≠ []; (s) ⊦ x + y = [] ↔ x = [] ∧ y = []; (s)

Proof step 129 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply lemma

And obtained the following new goals

• Proof step 130:

  # sl = # al + 2, SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf), frag*(IOAut(setInit, setStep, setExt))(sl, al + ARetInsert(tid, b) ') ⊦ (∃ n. n < # al ∧ al[n] = ADoInsert(tid, b) ∧ (b ↔ sl.last.lsf(tid).lb) ∧ sl[n].pcf(tid) = invInsert ∧ (∀ m. n < m ∧ m < # al → al[m] ≠ τ ∧ al[m].tid ≠ tid)) ∨ (b ↔ sl.head.lsf(tid).lb) ∧ (b ↔ sl.last.lsf(tid).lb) ∧ sl.head.pcf(tid) = retInsert ∧ (∀ m. m < # al → al[m] ≠ τ ∧ al[m].tid ≠ tid)

• Proof step 131:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + s ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl0 + s ', al1 + ARetInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(s ' + sl2, al4), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, (∃ n. n < # al1 ∧ al1[n] = ADoInsert(tid0, false) ∧ (false ↔ (mkstate(gstate, lsf, pcf) ' + sl0 + s ').last.lsf(tid0).lb) ∧ (mkstate(gstate, lsf, pcf) ' + sl0 + s ')[n].pcf(tid0) = invInsert ∧ (∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0)) ∨ (false ↔ (mkstate(gstate, lsf, pcf) ' + sl0 + s ').head.lsf(tid0).lb) ∧ (false ↔ (mkstate(gstate, lsf, pcf) ' + sl0 + s ').last.lsf(tid0).lb) ∧ (mkstate(gstate, lsf, pcf) ' + sl0 + s ').head.pcf(tid0) = retInsert ∧ (∀ m. m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0) ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ #(a ' + x) = (# x)+1; (s) ⊦ #(x + y) = # x + # y; (s) ⊦ # a ' = 0 +1; (s) ⊦ m +1 = m + 1; (s) ⊦ m + n = m + n0 ↔ n = n0; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic ⊦ mkstate(gstate, lsf, pcf).gstate = gstate; (s) ⊦ mkstate(gstate, lsf, pcf).lsf = lsf; (s) ⊦ (a ' + x).head = a; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ mkstate(gstate, lsf, pcf).pcf = pcf; (s) Used terms: mkstate(gstate, lsf, pcf) ' + sl0 + s ', al1, tid0, false

Proof step 130 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Lemma frag-retIns

Proof step 131 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 132:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + s ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(s ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl0 + s ', al1 + ARetInsert(tid0, false) '), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid, n < # al1 ∧ al1[n] = ADoInsert(tid0, false) ∧ ¬ s.lsf(tid0).lb ∧ (mkstate(gstate, lsf, pcf) ' + sl0 + s ')[n].pcf(tid0) = invInsert ∧ (∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0) ∨ ¬ lsf(tid0).lb ∧ ¬ s.lsf(tid0).lb ∧ pcf(tid0) = retInsert ∧ (∀ m. m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0) ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ mkstate(gstate, lsf, pcf).pcf = pcf; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ (a ' + x).head = a; (s) ⊦ (a ' + x + b ').last = b; (s) ⊦ mkstate(gstate, lsf, pcf).lsf = lsf; (s)

Proof step 132 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 133:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + s ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, s = mkstate(gstate3, lsf3, pcf2), SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl0 + s ', al1 + ARetInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(s ' + sl2, al4), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, n < # al1 ∧ al1[n] = ADoInsert(tid0, false) ∧ ¬ lsf3(tid0).lb ∧ (mkstate(gstate, lsf, pcf) ' + sl0 + s ')[n].pcf(tid0) = invInsert ∧ (∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0) ∨ ¬ lsf(tid0).lb ∧ ¬ lsf3(tid0).lb ∧ pcf(tid0) = retInsert ∧ (∀ m. m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0) ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ (gstate = s.gstate ∧ lsf = s.lsf) ∧ pcf = s.pcf ↔ s = mkstate(gstate, lsf, pcf); (elim) Used terms: s, gstate3, lsf3, pcf2

Proof step 133 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 134:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ', al1 + ARetInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, n < # al1 ∧ al1[n] = ADoInsert(tid0, false) ∧ ¬ lsf3(tid0).lb ∧ (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n].pcf(tid0) = invInsert ∧ (∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0) ∨ ¬ lsf(tid0).lb ∧ ¬ lsf3(tid0).lb ∧ pcf(tid0) = retInsert ∧ (∀ m. m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0) ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ x → a ∈ x + y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list

Proof step 134 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 135:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), pcf1(tid0) = idle, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ', al1 + ARetInsert(tid0, false) '), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid, n < # al1 ∧ al1[n] = ADoInsert(tid0, false) ∧ ¬ lsf3(tid0).lb ∧ pcf3(tid0) = invInsert ∧ (∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0) ∨ ¬ lsf(tid0).lb ∧ ¬ lsf3(tid0).lb ∧ pcf(tid0) = retInsert ∧ (∀ m. m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0) ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ (gstate = s.gstate ∧ lsf = s.lsf) ∧ pcf = s.pcf ↔ s = mkstate(gstate, lsf, pcf); (elim) Used terms: (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n], gstate4, lsf4, pcf3

Proof step 135 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 136:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), al1[n] = ADoInsert(tid0, false), pcf1(tid0) = idle, pcf3(tid0) = invInsert, n < # al1, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ', al1 + ARetInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

• Proof step 178:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf(tid0) = retInsert, pcf1(tid0) = idle, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ', al1 + ARetInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ lsf(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ m. m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Proof step 136 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 137:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), al1[n] = ADoInsert(tid0, false), pcf1(tid0) = idle, pcf3(tid0) = invInsert, al1 ≠ [], n < # al1, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ', al1 + ARetInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ # x = 0 ↔ x = []; (s) lf-01: ⊦ m < n ∧ n = n0 → m < n0; (forward) from specification nat-basic f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic

Proof step 137 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 138:

  ⊦ ¬ # al < n ∧ n < # sl → ( frag*(IOAut(start, step, ext))(sl, al) ↔ frag*(IOAut(start, step, ext))(sl.take(n + 1), al.take(n)) ∧ frag*(IOAut(start, step, ext))(sl.drop(n), al.drop(n)))

• Proof step 139:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al1[n] = ADoInsert(tid0, false), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), pcf1(tid0) = idle, pcf3(tid0) = invInsert, al1 ≠ [], n < # al1, n + 1 < #(mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) '), SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt)) ((mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ').take((n + 1) + 1), (al1 + ARetInsert(tid0, false) ').take(n + 1)), frag*(IOAut(setInit, setStep, setExt)) ((mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ').drop(n + 1), (al1 + ARetInsert(tid0, false) ').drop(n + 1)), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ #(al1 + ARetInsert(tid0, false) ') < n + 1, ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ m + n < m + n0 ↔ n < n0; (s) ⊦ m < n → ¬ n < m; (s) ⊦ #(a ' + x) = (# x)+1; (s) ⊦ #(x + y) = # x + # y; (s) ⊦ # a ' = 0 +1; (s) a: ⊦ (x + y) + z = x + y + z; from specification list n < n0 ⊦ m + (* n) < m0 + (* n0) ↔ m < m0 + (n0 - n); (s) ⊦ m < n + 1 ↔ ¬ n < m; (s) f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic lf-02: ⊦ m < n ∧ m = n0 → n0 < n; (forward) from specification nat-basic lf: ⊦ m < n ∧ n < n0 → m +1 < n0; (forward) from specification nat-basic trans-Nat: ⊦ n < n0 ∧ n0 < n1 → n < n1; (forward) from specification nat-basic ⊦ m < n → n ≠ 0; (s) ⊦ m +1 = m + 1; (s) ⊦ ¬ m + n < m; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic Used terms: al1 + ARetInsert(tid0, false) ', setExt, mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ', setInit, n + 1, setStep

Proof step 138 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 139 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 140:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al1[n] = ADoInsert(tid0, false), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), pcf1(tid0) = idle, pcf3(tid0) = invInsert, al1 ≠ [], n < # al1, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt)) ((mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ').take(2 + n), (al1 + ARetInsert(tid0, false) ').take(n + 1)), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ m < n → m ≤ n; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ n ≤ # x → (x + y).drop(n) = x.drop(n) + y; (s) ⊦ m < n ↔ ¬ n ≤ m; (ss) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m < n → ¬ n < m; (s) ⊦ m + n < m + n0 ↔ n < n0; (s) ⊦ # a ' = 0 +1; (s) ⊦ #(x + y) = # x + # y; (s) ⊦ m < n + 1 ↔ ¬ n < m; (s) n < n0 ⊦ m + (* n) < m0 + (* n0) ↔ m < m0 + (n0 - n); (s) ⊦ m +1 = m + 1; (s) ⊦ #(a ' + x) = (# x)+1; (s) ⊦ (a ' + x).drop(n + 1) = x.drop(n); (s)

Proof step 140 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 141:

  ⊦ n ≠ 0 ∧ n ≤ # x → x.take(n) = x.take(n -1) + x[n -1]

• Proof step 142:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), al1[n] = ADoInsert(tid0, false), pcf1(tid0) = idle, pcf3(tid0) = invInsert, n + 1 ≠ 0, al1 ≠ [], n < # al1, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) ((mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ').take(2 + n), (al1 + ARetInsert(tid0, false) ').take((n + 1)-1) + (al1 + ARetInsert(tid0, false) ')[(n + 1)-1]), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, n + 1 ≤ #(al1 + ARetInsert(tid0, false) '), ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ m + 1 ≠ 0; (s) ⊦ #(x + y) = # x + # y; (s) ⊦ # a ' = 0 +1; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ m + n ≤ m + n0 ↔ n ≤ n0; (s) ⊦ m < n → m ≤ n; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic Used terms: al1 + ARetInsert(tid0, false) ', n + 1

Proof step 141 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 142 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 143:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al1[n] = ADoInsert(tid0, false), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), pcf1(tid0) = idle, pcf3(tid0) = invInsert, al1 ≠ [], n < # al1, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt)) ((mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ').take(2 + n), (al1 + ARetInsert(tid0, false) ').take(n) + ADoInsert(tid0, false) '), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ x + a = x + a '; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ n < # x → (x + a ')[n] = x[n]; (s) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ (m + 1)-1 = m; (s) ⊦ m < n → m ≤ n; (s) ⊦ m + n ≤ m + n0 ↔ n ≤ n0; (s) ⊦ # a ' = 0 +1; (s) ⊦ #(x + y) = # x + # y; (s) ⊦ m + 1 ≠ 0; (s)

Proof step 143 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 144:

  ⊦ n ≤ # x → (x + y).take(n) = x.take(n)

• Proof step 145:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), al1[n] = ADoInsert(tid0, false), pcf1(tid0) = idle, pcf3(tid0) = invInsert, al1 ≠ [], n < # al1, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) ((mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ').take(2 + n), al1.take(n) + ADoInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, n ≤ # al1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ m < n → m ≤ n; (s) a: ⊦ (x + y) + z = x + y + z; from specification list Used terms: n, al1, ARetInsert(tid0, false) '

Proof step 144 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 145 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 146:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al1[n] = ADoInsert(tid0, false), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), pcf1(tid0) = idle, pcf3(tid0) = invInsert, al1 ≠ [], n < # al1, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt)) ((mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ').take(2 + n), al1.take(n) + ADoInsert(tid0, false) '), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ m < n → m ≤ n; (s)

Proof step 146 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 147:

  n ≠ 0 ⊦ (a ' + x).take((* n)) = a ' + x.take(n -1)

• Proof step 148:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), al1[n] = ADoInsert(tid0, false), pcf1(tid0) = idle, pcf3(tid0) = invInsert, 2 + n ≠ 0, al1 ≠ [], n < # al1, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take((2 + n)-1), al1.take(n) + ADoInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ m + n = 0 ↔ m = 0 ∧ n = 0; (ws) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (x + y) + z = x + y + z; from specification list Used terms: 2 + n, mkstate(gstate, lsf, pcf), sl0 + mkstate(gstate3, lsf3, pcf2) '

Proof step 147 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 148 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 149:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al1[n] = ADoInsert(tid0, false), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), pcf1(tid0) = idle, pcf3(tid0) = invInsert, al1 ≠ [], n < # al1, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ n ≤ m → m + n0 - n = (m - n) + n0; (s) ⊦ n -1 = n - 1; (s) n < n0 ⊦ (* n) ≠ m0 + (* n0); (s)

Proof step 149 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply lemma

And obtained the following new goals

• Proof step 150:

  # sl = # al + 2, SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf), frag*(IOAut(setInit, setStep, setExt))(sl, al + ADoInsert(tid, b) ') ⊦ (∃ n. n < # al ∧ al[n] = AInvInsert(tid, sl.last.lsf(tid).le) ∧ sl[n].pcf(tid) = idle ∧ (∀ m. n < m ∧ m < # al → al[m] ≠ τ ∧ al[m].tid ≠ tid)) ∨ sl.last.lsf(tid).le = sl.head.lsf(tid).le ∧ sl.head.pcf(tid) = invInsert ∧ (∀ m. m < # al → al[m] ≠ τ ∧ al[m].tid ≠ tid)

• Proof step 151:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), al1[n] = ADoInsert(tid0, false), pcf1(tid0) = idle, pcf3(tid0) = invInsert, al1 ≠ [], n < # al1, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, (∃ n0. n0 < # al1.take(n) ∧ al1.take(n)[n0] = AInvInsert(tid0, (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).last.lsf(tid0).le) ∧ (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n))[n0].pcf(tid0) = idle ∧ (∀ m. n0 < m ∧ m < # al1.take(n) → al1.take(n)[m] ≠ τ ∧ al1.take(n)[m].tid ≠ tid0)) ∨ (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).last.lsf(tid0).le = (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).head.lsf(tid0).le ∧ (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).head.pcf(tid0) = invInsert ∧ (∀ m. m < # al1.take(n) → al1.take(n)[m] ≠ τ ∧ al1.take(n)[m].tid ≠ tid0) ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ #(a ' + x) = (# x)+1; (s) ⊦ # x.take(n) = n; (s) ⊦ m +1 = m + 1; (s) ⊦ n < # x → # x.take(n) = n; (s) ⊦ m + n = m + n0 ↔ n = n0; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic ⊦ mkstate(gstate, lsf, pcf).gstate = gstate; (s) ⊦ mkstate(gstate, lsf, pcf).lsf = lsf; (s) ⊦ (a ' + x).head = a; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ mkstate(gstate, lsf, pcf).pcf = pcf; (s) Used terms: mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n), tid0, false

Proof step 150 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Lemma frag-DoIns

Proof step 151 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 152:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al1[n] = ADoInsert(tid0, false), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), pcf1(tid0) = idle, pcf3(tid0) = invInsert, al1 ≠ [], n < # al1, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid, n0 < n ∧ al1[n0] = AInvInsert(tid0, (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).last.lsf(tid0).le) ∧ (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n))[n0].pcf(tid0) = idle ∧ (∀ m. n0 < m ∧ m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0) ∨ (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).last.lsf(tid0).le = lsf(tid0).le ∧ pcf(tid0) = invInsert ∧ (∀ m. m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0) ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ¬ # x < n, m < n ⊦ x.take(n)[m] = x[m]; (s) ⊦ m < n → ¬ n < m; (s) ⊦ n < # x → # x.take(n) = n; (s) ⊦ mkstate(gstate, lsf, pcf).pcf = pcf; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ (a ' + x).head = a; (s) ⊦ mkstate(gstate, lsf, pcf).lsf = lsf; (s)

Proof step 152 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 153:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).last = mkstate(gstate5, lsf5, pcf4), gstate1.set = ∅, (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), al1[n] = ADoInsert(tid0, false), pcf1(tid0) = idle, pcf3(tid0) = invInsert, al1 ≠ [], n < # al1, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, n0 < n ∧ al1[n0] = AInvInsert(tid0, lsf5(tid0).le) ∧ (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n))[n0].pcf(tid0) = idle ∧ (∀ m. n0 < m ∧ m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0) ∨ lsf5(tid0).le = lsf(tid0).le ∧ pcf(tid0) = invInsert ∧ (∀ m. m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0) ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ (gstate = s.gstate ∧ lsf = s.lsf) ∧ pcf = s.pcf ↔ s = mkstate(gstate, lsf, pcf); (elim) Used terms: (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).last, gstate5, lsf5, pcf4

Proof step 153 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 154:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).last = mkstate(gstate5, lsf5, pcf4), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al1[n] = ADoInsert(tid0, false), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n))[n0] = mkstate(gstate6, lsf6, pcf5), pcf1(tid0) = idle, pcf3(tid0) = invInsert, al1 ≠ [], n < # al1, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid, n0 < n ∧ al1[n0] = AInvInsert(tid0, lsf5(tid0).le) ∧ pcf5(tid0) = idle ∧ (∀ m. n0 < m ∧ m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0) ∨ lsf5(tid0).le = lsf(tid0).le ∧ pcf(tid0) = invInsert ∧ (∀ m. m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0) ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ (gstate = s.gstate ∧ lsf = s.lsf) ∧ pcf = s.pcf ↔ s = mkstate(gstate, lsf, pcf); (elim) Used terms: (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n))[n0], gstate6, lsf6, pcf5

Proof step 154 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 155:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).last = mkstate(gstate5, lsf5, pcf4), gstate1.set = ∅, (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n))[n0] = mkstate(gstate6, lsf6, pcf5), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), al1[n] = ADoInsert(tid0, false), al1[n0] = AInvInsert(tid0, lsf5(tid0).le), pcf1(tid0) = idle, pcf3(tid0) = invInsert, pcf5(tid0) = idle, al1 ≠ [], n < # al1, n0 < n, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. n0 < m ∧ m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

• Proof step 167:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).last = mkstate(gstate5, lsf5, pcf4), lsf5(tid0).le = lsf(tid0).le, gstate1.set = ∅, (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n))[n0] = mkstate(gstate6, lsf6, pcf5), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), al1[n] = ADoInsert(tid0, false), pcf(tid0) = invInsert, pcf1(tid0) = idle, pcf3(tid0) = invInsert, al1 ≠ [], n < # al1, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Proof step 155 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 156:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).last = mkstate(gstate5, lsf5, pcf4), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al1[n0] = AInvInsert(tid0, lsf5(tid0).le), al1[n] = ADoInsert(tid0, false), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n))[n0] = mkstate(gstate6, lsf6, pcf5), pcf1(tid0) = idle, pcf3(tid0) = invInsert, pcf5(tid0) = idle, al1 ≠ [], n0 + 1 < # al1, n0 < n, n < # al1, n0 < # al1, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. n0 < m ∧ m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: lf-01: ⊦ m < n ∧ n = n0 → m < n0; (forward) from specification nat-basic ⊦ m +1 = m + 1; (s) ⊦ m < n → n ≠ 0; (s) trans-Nat: ⊦ n < n0 ∧ n0 < n1 → n < n1; (forward) from specification nat-basic lf: ⊦ m < n ∧ n < n0 → m +1 < n0; (forward) from specification nat-basic f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic

Proof step 156 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule all left

And obtained the following new goals

• Proof step 157:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).last = mkstate(gstate5, lsf5, pcf4), gstate1.set = ∅, (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n))[n0] = mkstate(gstate6, lsf6, pcf5), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), al1[n] = ADoInsert(tid0, false), al1[n0] = AInvInsert(tid0, lsf5(tid0).le), pcf1(tid0) = idle, pcf3(tid0) = invInsert, pcf5(tid0) = idle, al1 ≠ [], n0 < # al1, n < # al1, n0 < n, n0 + 1 < # al1, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, n < n0 ∧ n0 < # al1 → al1[n0] ≠ τ ∧ al1[n0].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. n0 < m ∧ m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used terms: n0

Proof step 157 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 158:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).last = mkstate(gstate5, lsf5, pcf4), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al1[n0] = AInvInsert(tid0, lsf5(tid0).le), al1[n] = ADoInsert(tid0, false), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n))[n0] = mkstate(gstate6, lsf6, pcf5), pcf1(tid0) = idle, pcf3(tid0) = invInsert, pcf5(tid0) = idle, al1 ≠ [], n0 + 1 < # al1, n0 < n, n < # al1, n0 < # al1, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. n0 < m ∧ m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ m < n → ¬ n < m; (s)

Proof step 158 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule cut formula

And obtained the following new goals

• Proof step 159:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).last = mkstate(gstate5, lsf5, pcf4), gstate1.set = ∅, (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n))[n0] = mkstate(gstate6, lsf6, pcf5), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), al1[n] = ADoInsert(tid0, false), al1[n0] = AInvInsert(tid0, lsf5(tid0).le), al1 = al1.take(n0) + (AInvInsert(tid0, lsf5(tid0).le) + (al1.drop(n0)).tail), pcf1(tid0) = idle, pcf3(tid0) = invInsert, pcf5(tid0) = idle, al1 ≠ [], n0 < # al1, n < # al1, n0 < n, n0 + 1 < # al1, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. n0 < m ∧ m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

• Proof step 163:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).last = mkstate(gstate5, lsf5, pcf4), gstate1.set = ∅, (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n))[n0] = mkstate(gstate6, lsf6, pcf5), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), al1[n] = ADoInsert(tid0, false), al1[n0] = AInvInsert(tid0, lsf5(tid0).le), pcf1(tid0) = idle, pcf3(tid0) = invInsert, pcf5(tid0) = idle, al1 ≠ al1.take(n0) + (AInvInsert(tid0, lsf5(tid0).le) + (al1.drop(n0)).tail), al1 ≠ [], n0 < # al1, n < # al1, n0 < n, n0 + 1 < # al1, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. n0 < m ∧ m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used formulas: al1 = al1.take(n0) + (AInvInsert(tid0, lsf5(tid0).le) + (al1.drop(n0)).tail)

Proof step 159 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 160:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).last = mkstate(gstate5, lsf5, pcf4), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al1[n0] = AInvInsert(tid0, lsf5(tid0).le), al1[n] = ADoInsert(tid0, false), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n))[n0] = mkstate(gstate6, lsf6, pcf5), al1 = al1.take(n0) + AInvInsert(tid0, lsf5(tid0).le) ' + (al1.drop(n0)).tail, pcf1(tid0) = idle, pcf3(tid0) = invInsert, pcf5(tid0) = idle, al1 ≠ [], n0 + 1 < # al1, n0 < n, n < # al1, n0 < # al1, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. n0 < m ∧ m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a + x = a ' + x; (s)

Proof step 160 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 161:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, al1.drop(n0) = a + al, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).last = mkstate(gstate5, lsf5, pcf4), gstate1.set = ∅, (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n))[n0] = mkstate(gstate6, lsf6, pcf5), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), al1[n] = ADoInsert(tid0, false), al1[n0] = AInvInsert(tid0, lsf5(tid0).le), al1 = al1.take(n0) + AInvInsert(tid0, lsf5(tid0).le) ' + al, pcf1(tid0) = idle, pcf3(tid0) = invInsert, pcf5(tid0) = idle, al1.drop(n0) ≠ [], al1 ≠ [], n0 < # al1, n < # al1, n0 < n, n0 + 1 < # al1, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. n0 < m ∧ m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ n < # x → (x.drop(n) = [] ↔ false); (s) x ≠ [] ⊦ a = x.head ∧ y = x.tail ↔ x = a + y; (elim) Used terms: al1.drop(n0), a, al

Proof step 161 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 162:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, al1.drop(n0) = a ' + al, (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).last = mkstate(gstate5, lsf5, pcf4), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al1[n0] = AInvInsert(tid0, lsf5(tid0).le), al1[n] = ADoInsert(tid0, false), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n))[n0] = mkstate(gstate6, lsf6, pcf5), al1 = al1.take(n0) + AInvInsert(tid0, lsf5(tid0).le) ' + al, pcf1(tid0) = idle, pcf3(tid0) = invInsert, pcf5(tid0) = idle, al1 ≠ [], n0 + 1 < # al1, n0 < n, n < # al1, n0 < # al1, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, a ∈ al1.drop(n0), ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. n0 < m ∧ m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ n < # x → (x.drop(n) = [] ↔ false); (s) ⊦ a + x = a ' + x; (s)

Proof step 162 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply elim lemma

And closed the goal!

Rule argument

Additional information

Used simplifier rules: ext-InvInsert: ⊦ setExt(AInvInsert(tid, e)) = ⌜InvInsert(tid, e)⌝ ; sel-InvInsert-dottid: ⊦ InvInsert(tid, e).tid = tid; ⊦ # x = # z → (x + y = z + y0 ↔ x = z ∧ y = y0); (ws) ⊦ a ' + x = a0 ' + x ↔ a = a0; (s) ⊦ (x + a ' + y)[# x] = a; (s) ⊦ x + y = [] ↔ x = [] ∧ y = []; (s) ⊦ a ' ≠ []; (s) ⊦ m ≤ m + n; (s) ⊦ a ∈ a0 ' + x ↔ a = a0 ∨ a ∈ x; (s) ⊦ # x < n → (x + y).take(n) = x + y.take(n - # x); (s) ⊦ m + n < m + n0 ↔ n < n0; (s) ⊦ 1 < m ↔ ¬(m = 0 ∨ m = 1); (s) ⊦ m + 1 ≠ 0; (s) ⊦ n ≠ 0 → (m + n = 1 ↔ n = 1 ∧ m = 0); (ws) ⊦ ¬ m + n < m; (s) ⊦ ext !(al + al0) = ext !(al) + ext !(al0); (s) ⊦ ext !(a ') = (ext(a) = τ ⊃ [];ext(a).e '); (s) ⊦ (x + y).map(f) = x.map(f) + y.map(f); (s) ⊦ a ∈ x + y ↔ a ∈ x ∨ a ∈ y; (s) ⊦ m < n ↔ ¬ n ≤ m; (ss) ⊦ #(x + y) = # x + # y; (s) ⊦ #(a ' + x) = (# x)+1; (s) ⊦ m +1 = m + 1; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ m < n + 1 ↔ ¬ n < m; (s) fle: ⊦ m < n ∧ n ≤ n0 → m < n0; (forward) from specification nat ⊦ m < m + n ↔ n ≠ 0; (s) ⊦ # x = 0 ↔ x = []; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic ⊦ ⌜e⌝ ≠ τ; (s) ⊦ ⌜e⌝ .e = e; (s) ⊦ a '.map(f) = f(a) '; (s) ⊦ a ∈ a0 ' ↔ a = a0; (s) ⊦ m < n → m ≤ n; (s) ⊦ n ≤ # x → (y = x.take(n) ∧ z = x.drop(n) ↔ x = y + z ∧ # y = n); (elim) Used terms: al1, n0, al3, al5

Proof step 163 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 164:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).last = mkstate(gstate5, lsf5, pcf4), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al1[n0] = AInvInsert(tid0, lsf5(tid0).le), al1[n] = ADoInsert(tid0, false), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n))[n0] = mkstate(gstate6, lsf6, pcf5), pcf1(tid0) = idle, pcf3(tid0) = invInsert, pcf5(tid0) = idle, al1 ≠ [], al1 ≠ al1.take(n0) + AInvInsert(tid0, lsf5(tid0).le) ' + (al1.drop(n0)).tail, n0 + 1 < # al1, n0 < n, n < # al1, n0 < # al1, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. n0 < m ∧ m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a + x = a ' + x; (s)

Proof step 164 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 165:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, al1.drop(n0) = a + al, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).last = mkstate(gstate5, lsf5, pcf4), gstate1.set = ∅, (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n))[n0] = mkstate(gstate6, lsf6, pcf5), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), al1[n] = ADoInsert(tid0, false), al1[n0] = AInvInsert(tid0, lsf5(tid0).le), pcf1(tid0) = idle, pcf3(tid0) = invInsert, pcf5(tid0) = idle, al1.drop(n0) ≠ [], al1 ≠ [], al1 ≠ al1.take(n0) + AInvInsert(tid0, lsf5(tid0).le) ' + al, n0 < # al1, n < # al1, n0 < n, n0 + 1 < # al1, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. n0 < m ∧ m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ n < # x → (x.drop(n) = [] ↔ false); (s) x ≠ [] ⊦ a = x.head ∧ y = x.tail ↔ x = a + y; (elim) Used terms: al1.drop(n0), a, al

Proof step 165 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 166:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, al1.drop(n0) = a ' + al, (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).last = mkstate(gstate5, lsf5, pcf4), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al1[n0] = AInvInsert(tid0, lsf5(tid0).le), al1[n] = ADoInsert(tid0, false), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n))[n0] = mkstate(gstate6, lsf6, pcf5), pcf1(tid0) = idle, pcf3(tid0) = invInsert, pcf5(tid0) = idle, al1 ≠ [], al1 ≠ al1.take(n0) + AInvInsert(tid0, lsf5(tid0).le) ' + al, n0 + 1 < # al1, n0 < n, n < # al1, n0 < # al1, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, a ∈ al1.drop(n0), ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. n0 < m ∧ m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ n < # x → (x.drop(n) = [] ↔ false); (s) ⊦ a + x = a ' + x; (s)

Proof step 166 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply elim lemma

And closed the goal!

Rule argument

Additional information

Used simplifier rules: ⊦ (x + a ' + y)[# x] = a; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ m < n → m ≤ n; (s) ⊦ n ≤ # x → (y = x.take(n) ∧ z = x.drop(n) ↔ x = y + z ∧ # y = n); (elim) Used terms: al1, n0, al3, al5

Proof step 167 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 168:

  ⊦ setStep(mkstate(gs, lsf, pcf), a, mkstate(gs0, lsf0, pcf0)) ↔ (∃ tid, ls, pc. lstep(gs, lsf(tid), pcf(tid), a, gs0, ls, pc) ∧ lsf0 = lsf(tid := ls) ∧ pcf0 = pcf(tid := pc))

• Proof step 169:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n)).last = mkstate(gstate5, lsf5, pcf4), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), lsf5(tid0).le = lsf(tid0).le, gstate1.set = ∅, al1[n] = ADoInsert(tid0, false), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n))[n0] = mkstate(gstate6, lsf6, pcf5), pcf(tid0) = invInsert, pcf1(tid0) = idle, pcf3(tid0) = invInsert, al1 ≠ [], n < # al1, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf, pcf) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid, ∃ tid, ls, pc. lstep(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true), gstate, ls, pc) ∧ lsf = lsf0(tid := ls) ∧ pcf = pcf0(tid := pc) ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used terms: lsf0, pcf0, pcf, lsf, gstate, gstate0, ADoInsert(tid0, true)

Proof step 168 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 169 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 170:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n) ).last = mkstate(gstate5, lsf5, pcf4), lsf5(tid0).le = (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le, gstate1.set = ∅, (tid1 = tid0 ⊃ pcstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));pcf0(tid0)) = invInsert, ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n) )[n0 ] = mkstate(gstate6, lsf6, pcf5), ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' )[n ] = mkstate(gstate4, lsf4, pcf3), ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' )[# al2 ] = mkstate(gstate2, lsf2, pcf1), al1[n] = ADoInsert(tid0, false), pcf1(tid0) = idle, pcf3(tid0) = invInsert, al1 ≠ [], n < # al1, SetInv(gstate0, lsf0, pcf0), SetInv (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf5(tid0).le) ' + al0), pre(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf5(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf5(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf5(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf5(tid0).le) ' + al0)[m].tid ≠ tid0 ⊦ ¬ lsf5(tid0).le ∈ gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)).set ∧ ( (tid1 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));pcf0(tid)) = retInsert ∧ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));lsf0(tid)).le = lsf5(tid0).le → ¬ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));lsf0(tid)).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ x → a ∈ x + y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ lstep(gs, ls, pc, a, gs0, ls0, pc0) ↔ pre(gs, ls, pc, a) ∧ ls0 = lstepf(gs, ls, pc, a) ∧ gs0 = gstepf(gs, ls, pc, a) ∧ pc0 = pcstepf(gs, ls, pc, a); (s)

Proof step 170 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 171:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n) ).last = mkstate(gstate5, lsf5, pcf4), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), lsf5(tid0).le = lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).le, gstate1.set = ∅, (tid1 = tid0 ⊃ pcstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));pcf0(tid0)) = invInsert, al1[n] = ADoInsert(tid0, false), ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' )[# al2 ] = mkstate(gstate2, lsf2, pcf1), ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' )[n ] = mkstate(gstate4, lsf4, pcf3), ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n) )[n0 ] = mkstate(gstate6, lsf6, pcf5), pcf1(tid0) = idle, pcf3(tid0) = invInsert, tid1 = tid0, al1 ≠ [], n < # al1, SetInv (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf5(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), pre(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf5(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf5(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf5(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf5(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ m. m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf5(tid0).le ∈ gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)).set ∧ ( (tid1 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));pcf0(tid)) = retInsert ∧ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));lsf0(tid)).le = lsf5(tid0).le → ¬ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));lsf0(tid)).lb)

• Proof step 176:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n) ).last = mkstate(gstate5, lsf5, pcf4), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), lsf5(tid0).le = lsf0(tid0).le, gstate1.set = ∅, (tid1 = tid0 ⊃ pcstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));pcf0(tid0)) = invInsert, al1[n] = ADoInsert(tid0, false), ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' )[# al2 ] = mkstate(gstate2, lsf2, pcf1), ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' )[n ] = mkstate(gstate4, lsf4, pcf3), ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n) )[n0 ] = mkstate(gstate6, lsf6, pcf5), pcf1(tid0) = idle, pcf3(tid0) = invInsert, al1 ≠ [], tid1 ≠ tid0, n < # al1, SetInv (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf5(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), pre(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf5(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf5(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf5(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf5(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ m. m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf5(tid0).le ∈ gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)).set ∧ ( (tid1 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));pcf0(tid)) = retInsert ∧ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));lsf0(tid)).le = lsf5(tid0).le → ¬ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));lsf0(tid)).lb)

Rule argument

Additional information

Proof step 171 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 172:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := invInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := invInsert)) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, ( mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := invInsert)) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n) ).last = mkstate(gstate5, lsf5, pcf4), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), lsf5(tid0).le = lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).le, gstate1.set = ∅, al1[n] = ADoInsert(tid0, false), ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := invInsert)) ' )[# al2 ] = mkstate(gstate2, lsf2, pcf1), ( mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := invInsert)) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' )[n ] = mkstate(gstate4, lsf4, pcf3), ( mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := invInsert)) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n) )[n0 ] = mkstate(gstate6, lsf6, pcf5), pcf1(tid0) = idle, pcf3(tid0) = invInsert, pcstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)) = invInsert, al1 ≠ [], n < # al1, SetInv (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := invInsert)), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf5(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := invInsert)) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), pre(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ lsf5(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf5(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf5(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf5(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ m. m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf5(tid0).le ∈ gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).set ∧ ( (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));pcf0(tid)) = retInsert ∧ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));lsf0(tid)).le = lsf5(tid0).le → ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));lsf0(tid)).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ x → a ∈ x + y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list

Proof step 172 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule constructor cut

And obtained the following new goals

• Proof step 173:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := invInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := invInsert)) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), ( mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := invInsert)) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n) ).last = mkstate(gstate5, lsf5, pcf4), lsf5(tid0).le = lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).le, gstate1.set = ∅, ( mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := invInsert)) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n) )[n0 ] = mkstate(gstate6, lsf6, pcf5), ( mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := invInsert)) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' )[n ] = mkstate(gstate4, lsf4, pcf3), ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := invInsert)) ' )[# al2 ] = mkstate(gstate2, lsf2, pcf1), al1[n] = ADoInsert(tid0, false), pcf0(tid0) = invInsert, pcf1(tid0) = idle, pcf3(tid0) = invInsert, pcstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)) = invInsert, al1 ≠ [], n < # al1, SetInv(gstate0, lsf0, pcf0), SetInv (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := invInsert)), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := invInsert)) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf5(tid0).le) ' + al0), pre(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ lsf5(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf5(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf5(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf5(tid0).le) ' + al0)[m].tid ≠ tid0 ⊦ ¬ lsf5(tid0).le ∈ gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).set ∧ ( (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));pcf0(tid)) = retInsert ∧ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));lsf0(tid)).le = lsf5(tid0).le → ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));lsf0(tid)).lb)

Rule argument

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; SetPC freely generated by idle, invInsert, invMember, retInsert, retMember;; in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ a ∈ x → a ∈ x + y; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ pre(gs, ls, retMember, a) ↔ (∃ b0. a = ARetMember(ls.tid, b0) ∧ (b0 ↔ ls.lb)); (s) ⊦ ADoInsert(tid, b) ≠ ARetMember(tid0, b0); (s) ⊦ pre(gs, ls, retInsert, a) ↔ (∃ b0. a = ARetInsert(ls.tid, b0) ∧ (b0 ↔ ls.lb)); (s) ⊦ ADoInsert(tid, b) ≠ ARetInsert(tid0, b0); (s) ⊦ pre(gs, ls, invMember, a) ↔ a = ADoMember(ls.tid); (s) ⊦ ADoInsert(tid, b) ≠ ADoMember(tid0); (s) ⊦ gstepf(gs, ls, idle, a) = gs; (s) ⊦ pre(gs, ls, idle, a) ↔ (∃ e. a = AInvInsert(ls.tid, e) ∧ e ≠ ⊥) ∨ (∃ e. a = AInvMember(ls.tid, e) ∧ e ≠ ⊥); (s) ⊦ ADoInsert(tid, b) ≠ AInvInsert(tid0, e); (s) ⊦ ADoInsert(tid, b) ≠ AInvMember(tid0, e); (s)

Proof step 173 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 174:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := invInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := invInsert)) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, ( mkstate (gstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := invInsert)) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n) ).last = mkstate(gstate5, lsf5, pcf4), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), lsf5(tid0).le = lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).le, gstate1.set = ∅, al1[n] = ADoInsert(tid0, false), ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := invInsert)) ' )[# al2 ] = mkstate(gstate2, lsf2, pcf1), ( mkstate (gstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := invInsert)) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' )[n ] = mkstate(gstate4, lsf4, pcf3), ( mkstate (gstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := invInsert)) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n) )[n0 ] = mkstate(gstate6, lsf6, pcf5), pcf0(tid0) = invInsert, pcf1(tid0) = idle, pcf3(tid0) = invInsert, pcstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)) = invInsert, al1 ≠ [], n < # al1, SetInv (gstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := invInsert)), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf5(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := invInsert)) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ lsf5(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf5(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf5(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf5(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ m. m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf5(tid0).le ∈ gstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).set ∧ ( (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));pcf0(tid)) = retInsert ∧ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));lsf0(tid)).le = lsf5(tid0).le → ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));lsf0(tid)).lb)

Rule argument

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; ⊦ ADoInsert(tid, b) = ADoInsert(tid0, b0) ↔ tid = tid0 ∧ (b ↔ b0); (ws) ⊦ pre(gs, ls, invInsert, a) ↔ (∃ b. a = ADoInsert(ls.tid, b)); (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ x → a ∈ x + y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list

Proof step 174 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 175:

  ⊦ ls.tid = tid → gstepf(gs, ls, invInsert, ADoInsert(tid, b)) = (b ⊃ gs.set:= (gs.set ++ ls.le);gs)

Rule argument

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; ⊦ ls.tid = tid → pcstepf(gs, ls, invInsert, ADoInsert(tid, b)) = retInsert; (s) ⊦ invInsert ≠ retInsert; (s) Used terms: gstate0, lsf0(tid0), tid0, true

Proof step 175 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 176 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 177:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n) ).last = mkstate(gstate5, lsf5, pcf4), lsf5(tid0).le = lsf0(tid0).le, gstate1.set = ∅, ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n) )[n0 ] = mkstate(gstate6, lsf6, pcf5), ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' )[n ] = mkstate(gstate4, lsf4, pcf3), ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' )[# al2 ] = mkstate(gstate2, lsf2, pcf1), al1[n] = ADoInsert(tid0, false), pcf0(tid0) = invInsert, pcf1(tid0) = idle, pcf3(tid0) = invInsert, al1 ≠ [], tid1 ≠ tid0, n < # al1, SetInv(gstate0, lsf0, pcf0), SetInv (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(sl0.drop(n) + mkstate(gstate3, lsf3, pcf2) ', (al1 + ARetInsert(tid0, false) ').drop(n + 1)), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + (sl0 + mkstate(gstate3, lsf3, pcf2) ').take(1 + n), al1.take(n) + ADoInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf0(tid0).le) ' + al0), pre(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf0(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf0(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. n < m ∧ m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. m < n → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf0(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf0(tid0).le) ' + al0)[m].tid ≠ tid0 ⊦ ¬ lsf0(tid0).le ∈ gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)).set ∧ ( (tid1 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));pcf0(tid)) = retInsert ∧ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));lsf0(tid)).le = lsf0(tid0).le → ¬ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));lsf0(tid)).lb)

Rule argument

Additional information

Proof step 177 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule constructor cut

And closed the goal!

Rule argument

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; SetPC freely generated by idle, invInsert, invMember, retInsert, retMember;; in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ a ∈ x → a ∈ x + y; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ pre(gs, ls, retMember, a) ↔ (∃ b0. a = ARetMember(ls.tid, b0) ∧ (b0 ↔ ls.lb)); (s) ⊦ ADoInsert(tid, b) ≠ ARetMember(tid0, b0); (s) ⊦ pre(gs, ls, retInsert, a) ↔ (∃ b0. a = ARetInsert(ls.tid, b0) ∧ (b0 ↔ ls.lb)); (s) ⊦ ADoInsert(tid, b) ≠ ARetInsert(tid0, b0); (s) ⊦ pre(gs, ls, invMember, a) ↔ a = ADoMember(ls.tid); (s) ⊦ ADoInsert(tid, b) ≠ ADoMember(tid0); (s) ⊦ pre(gs, ls, invInsert, a) ↔ (∃ b. a = ADoInsert(ls.tid, b)); (s) ⊦ ADoInsert(tid, b) = ADoInsert(tid0, b0) ↔ tid = tid0 ∧ (b ↔ b0); (ws) ⊦ gstepf(gs, ls, idle, a) = gs; (s) ⊦ pre(gs, ls, idle, a) ↔ (∃ e. a = AInvInsert(ls.tid, e) ∧ e ≠ ⊥) ∨ (∃ e. a = AInvMember(ls.tid, e) ∧ e ≠ ⊥); (s) ⊦ ADoInsert(tid, b) ≠ AInvInsert(tid0, e); (s) ⊦ ADoInsert(tid, b) ≠ AInvMember(tid0, e); (s)

Proof step 178 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 179:

  ⊦ setStep(mkstate(gs, lsf, pcf), a, mkstate(gs0, lsf0, pcf0)) ↔ (∃ tid, ls, pc. lstep(gs, lsf(tid), pcf(tid), a, gs0, ls, pc) ∧ lsf0 = lsf(tid := ls) ∧ pcf0 = pcf(tid := pc))

• Proof step 180:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), (mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ')[n] = mkstate(gstate4, lsf4, pcf3), pcf(tid0) = retInsert, pcf1(tid0) = idle, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ', al1 + ARetInsert(tid0, false) '), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ lsf(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid, ∃ tid, ls, pc. lstep(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true), gstate, ls, pc) ∧ lsf = lsf0(tid := ls) ∧ pcf = pcf0(tid := pc) ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used terms: lsf0, pcf0, pcf, lsf, gstate, gstate0, ADoInsert(tid0, true)

Proof step 179 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 180 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 181:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (tid1 = tid0 ⊃ pcstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));pcf0(tid0)) = retInsert, ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' )[n ] = mkstate(gstate4, lsf4, pcf3), ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' )[# al2 ] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, SetInv(gstate0, lsf0, pcf0), SetInv (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le) ' + al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ', al1 + ARetInsert(tid0, false) '), pre(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).lb, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le) ' + al0)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid, ∀ m. m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0 ⊦ ¬ (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le ∈ gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)).set ∧ ( (tid1 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));pcf0(tid)) = retInsert ∧ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));lsf0(tid)).le = (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le → ¬ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));lsf0(tid)).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ x → a ∈ x + y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ lstep(gs, ls, pc, a, gs0, ls0, pc0) ↔ pre(gs, ls, pc, a) ∧ ls0 = lstepf(gs, ls, pc, a) ∧ gs0 = gstepf(gs, ls, pc, a) ∧ pc0 = pcstepf(gs, ls, pc, a); (s)

Proof step 181 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 182:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' )[# al2 ] = mkstate(gstate2, lsf2, pcf1), ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' )[n ] = mkstate(gstate4, lsf4, pcf3), pcf1(tid0) = idle, pcstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)) = retInsert, tid1 = tid0, SetInv (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ', al1 + ARetInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le) ' + al0), pre(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).lb, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le → ¬ lsf0(tid).lb, ∀ m. m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le) ' + al0)[m].tid ≠ tid0 ⊦ ¬ (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le ∈ gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)).set ∧ ( (tid1 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));pcf0(tid)) = retInsert ∧ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));lsf0(tid)).le = (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le → ¬ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));lsf0(tid)).lb)

• Proof step 190:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' )[# al2 ] = mkstate(gstate2, lsf2, pcf1), ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' )[n ] = mkstate(gstate4, lsf4, pcf3), pcf0(tid0) = retInsert, pcf1(tid0) = idle, tid1 ≠ tid0, SetInv (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ', al1 + ARetInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le) ' + al0), pre(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).lb, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le → ¬ lsf0(tid).lb, ∀ m. m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le) ' + al0)[m].tid ≠ tid0 ⊦ ¬ (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le ∈ gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)).set ∧ ( (tid1 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));pcf0(tid)) = retInsert ∧ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));lsf0(tid)).le = (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le → ¬ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));lsf0(tid)).lb)

Rule argument

Additional information

Proof step 182 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 183:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' )[# al2 ] = mkstate(gstate2, lsf2, pcf1), ( mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' )[n ] = mkstate(gstate4, lsf4, pcf3), pcf1(tid0) = idle, pcstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)) = retInsert, SetInv (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := retInsert)), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).le) ' + al0), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ', al1 + ARetInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), pre(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).lb, ¬ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).le) ' + al0)[m].tid ≠ tid0, ∀ m. m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).le ∈ gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).set ∧ ( (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));pcf0(tid)) = retInsert ∧ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));lsf0(tid)).le = lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).le → ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));lsf0(tid)).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ x → a ∈ x + y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list

Proof step 183 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule constructor cut

And obtained the following new goals

• Proof step 184:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, ( mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' )[n ] = mkstate(gstate4, lsf4, pcf3), ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' )[# al2 ] = mkstate(gstate2, lsf2, pcf1), pcf0(tid0) = invInsert, pcf1(tid0) = idle, pcstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)) = retInsert, SetInv(gstate0, lsf0, pcf0), SetInv (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := retInsert)), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ', al1 + ARetInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).le) ' + al0), pre(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).lb, ¬ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).le) ' + al0)[m].tid ≠ tid0 ⊦ ¬ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).le ∈ gstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).set ∧ ( (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));pcf0(tid)) = retInsert ∧ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));lsf0(tid)).le = lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true)).le → ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));lsf0(tid)).lb)

Rule argument

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; SetPC freely generated by idle, invInsert, invMember, retInsert, retMember;; in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ a ∈ x → a ∈ x + y; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ pre(gs, ls, retMember, a) ↔ (∃ b0. a = ARetMember(ls.tid, b0) ∧ (b0 ↔ ls.lb)); (s) ⊦ ADoInsert(tid, b) ≠ ARetMember(tid0, b0); (s) ⊦ pre(gs, ls, retInsert, a) ↔ (∃ b0. a = ARetInsert(ls.tid, b0) ∧ (b0 ↔ ls.lb)); (s) ⊦ ADoInsert(tid, b) ≠ ARetInsert(tid0, b0); (s) ⊦ pre(gs, ls, invMember, a) ↔ a = ADoMember(ls.tid); (s) ⊦ ADoInsert(tid, b) ≠ ADoMember(tid0); (s) ⊦ gstepf(gs, ls, idle, a) = gs; (s) ⊦ pre(gs, ls, idle, a) ↔ (∃ e. a = AInvInsert(ls.tid, e) ∧ e ≠ ⊥) ∨ (∃ e. a = AInvMember(ls.tid, e) ∧ e ≠ ⊥); (s) ⊦ ADoInsert(tid, b) ≠ AInvInsert(tid0, e); (s) ⊦ ADoInsert(tid, b) ≠ AInvMember(tid0, e); (s)

Proof step 184 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 185:

  # sl0 = # al1, # sl1 = # al2 + # al0 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' )[# al2 ] = mkstate(gstate2, lsf2, pcf1), ( mkstate (gstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' )[n ] = mkstate(gstate4, lsf4, pcf3), pcf0(tid0) = invInsert, pcf1(tid0) = idle, pcstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)) = retInsert, SetInv (gstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := retInsert)), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).le) ' + al0), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ', al1 + ARetInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).lb, ¬ lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).le) ' + al0)[m].tid ≠ tid0, ∀ m. m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).le ∈ gstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).set ∧ ( (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));pcf0(tid)) = retInsert ∧ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));lsf0(tid)).le = lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).le → ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));lsf0(tid)).lb)

Rule argument

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; ⊦ ADoInsert(tid, b) = ADoInsert(tid0, b0) ↔ tid = tid0 ∧ (b ↔ b0); (ws) ⊦ pre(gs, ls, invInsert, a) ↔ (∃ b. a = ADoInsert(ls.tid, b)); (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ x → a ∈ x + y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list

Proof step 185 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 186:

  ⊦ ls.tid = tid → gstepf(gs, ls, invInsert, ADoInsert(tid, b)) = (b ⊃ gs.set:= (gs.set ++ ls.le);gs)

• Proof step 187:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate ((true ⊃ gstate0.set:= (gstate0.set ++ lsf0(tid0).le);gstate0), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate ((true ⊃ gstate0.set:= (gstate0.set ++ lsf0(tid0).le);gstate0), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, lsf0(tid0).tid = tid0, ( mkstate ((true ⊃ gstate0.set:= (gstate0.set ++ lsf0(tid0).le);gstate0), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' )[n ] = mkstate(gstate4, lsf4, pcf3), ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate ((true ⊃ gstate0.set:= (gstate0.set ++ lsf0(tid0).le);gstate0), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' )[# al2 ] = mkstate(gstate2, lsf2, pcf1), pcf0(tid0) = invInsert, pcf1(tid0) = idle, pcstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)) = retInsert, SetInv(gstate0, lsf0, pcf0), SetInv ((true ⊃ gstate0.set:= (gstate0.set ++ lsf0(tid0).le);gstate0), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := retInsert)), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt)) ( mkstate ((true ⊃ gstate0.set:= (gstate0.set ++ lsf0(tid0).le);gstate0), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ', al1 + ARetInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).le) ' + al0), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf3(tid0).lb, ¬ lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).lb, ¬ lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).le ∈ gstate0.set, ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ tid0 ∈ setExt !(al1).map(.tid), pcf0(tid) = retInsert ∧ lsf0(tid).le = lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).le) ' + al0)[m].tid ≠ tid0 ⊦ ¬ lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).le ∈ (true ⊃ gstate0.set:= (gstate0.set ++ lsf0(tid0).le);gstate0).set ∧ ( (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));pcf0(tid)) = retInsert ∧ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));lsf0(tid)).le = lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).le → ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));lsf0(tid)).lb)

Rule argument

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; Used terms: gstate0, lsf0(tid0), tid0, true

Proof step 186 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 187 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 188:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstate0.set:= (gstate0.set ++ lsf0(tid0).le), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstate0.set:= (gstate0.set ++ lsf0(tid0).le), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, ( mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid0).le), lsf0(tid0 := lsf0(tid0).lb:= true), pcf0(tid0 := retInsert)) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' )[n ] = mkstate(gstate4, lsf4, pcf3), ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid0).le), lsf0(tid0 := lsf0(tid0).lb:= true), pcf0(tid0 := retInsert)) ' )[# al2 ] = mkstate(gstate2, lsf2, pcf1), pcf0(tid0) = invInsert, pcf1(tid0) = idle, SetInv (gstate0.set:= (gstate0.set ++ lsf0(tid0).le), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := retInsert)), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstate0.set:= (gstate0.set ++ lsf0(tid0).le), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true))), pcf0(tid0 := retInsert)) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ', al1 + ARetInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).le) ' + al0), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).lb, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).le) ' + al0)[m].tid ≠ tid0 ⊦ lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).le ≠ lsf0(tid0).le ∧ ( (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));pcf0(tid)) = retInsert ∧ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));lsf0(tid)).le = lstepf(gstate0, lsf0(tid0), invInsert, ADoInsert(tid0, true)).le → ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid, true));lsf0(tid)).lb)

Rule argument

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ x → a ∈ x + y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ ¬ a ∈ s → (a ∈ s ++ b ↔ a = b); (s) ⊦ (gs.set:= set).set = set; (s) ⊦ ls.tid = tid → lstepf(gs, ls, invInsert, ADoInsert(tid, b)) = (b ⊃ ls.lb:= true;ls.lb:= false); (s) ⊦ ls.tid = tid → pcstepf(gs, ls, invInsert, ADoInsert(tid, b)) = retInsert; (s)

Proof step 188 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 189:

  ⊦ ls.tid = tid → lstepf(gs, ls, invInsert, ADoInsert(tid, b)) = (b ⊃ ls.lb:= true;ls.lb:= false)

Rule argument

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; ⊦ (ls.lb:= lb).le = ls.le; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ (ls.lb:= lb).lb ↔ lb; (s) Used terms: gstate0, lsf0(tid0), tid0, true

Proof step 189 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 190 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 191:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, # sl0 = # al1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ' )[n ] = mkstate(gstate4, lsf4, pcf3), ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' )[# al2 ] = mkstate(gstate2, lsf2, pcf1), pcf0(tid0) = retInsert, pcf1(tid0) = idle, tid1 ≠ tid0, SetInv(gstate0, lsf0, pcf0), SetInv (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate3, lsf3, pcf2) ' + sl2, al4), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl0 + mkstate(gstate3, lsf3, pcf2) ', al1 + ARetInsert(tid0, false) '), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf0(tid0).le) ' + al0), pre(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ lsf0(tid0).lb, ¬ lsf3(tid0).lb, ¬ tid0 ∈ setExt !(al1).map(.tid), ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf0(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf0(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. m < # al1 → al1[m] ≠ τ ∧ al1[m].tid ≠ tid0, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf0(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf0(tid0).le) ' + al0)[m].tid ≠ tid0 ⊦ ¬ lsf0(tid0).le ∈ gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)).set ∧ ( (tid1 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));pcf0(tid)) = retInsert ∧ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));lsf0(tid)).le = lsf0(tid0).le → ¬ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));lsf0(tid)).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list

Proof step 191 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule constructor cut

And closed the goal!

Rule argument

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; SetPC freely generated by idle, invInsert, invMember, retInsert, retMember;; in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ a ∈ x → a ∈ x + y; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ pre(gs, ls, retMember, a) ↔ (∃ b0. a = ARetMember(ls.tid, b0) ∧ (b0 ↔ ls.lb)); (s) ⊦ ADoInsert(tid, b) ≠ ARetMember(tid0, b0); (s) ⊦ pre(gs, ls, retInsert, a) ↔ (∃ b0. a = ARetInsert(ls.tid, b0) ∧ (b0 ↔ ls.lb)); (s) ⊦ ADoInsert(tid, b) ≠ ARetInsert(tid0, b0); (s) ⊦ pre(gs, ls, invMember, a) ↔ a = ADoMember(ls.tid); (s) ⊦ ADoInsert(tid, b) ≠ ADoMember(tid0); (s) ⊦ pre(gs, ls, invInsert, a) ↔ (∃ b. a = ADoInsert(ls.tid, b)); (s) ⊦ ADoInsert(tid, b) = ADoInsert(tid0, b0) ↔ tid = tid0 ∧ (b ↔ b0); (ws) ⊦ gstepf(gs, ls, idle, a) = gs; (s) ⊦ pre(gs, ls, idle, a) ↔ (∃ e. a = AInvInsert(ls.tid, e) ∧ e ≠ ⊥) ∨ (∃ e. a = AInvMember(ls.tid, e) ∧ e ≠ ⊥); (s) ⊦ ADoInsert(tid, b) ≠ AInvInsert(tid0, e); (s) ⊦ ADoInsert(tid, b) ≠ AInvMember(tid0, e); (s)

Proof step 192 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 193:

  # sl1 = # al2 + # al1 + 1, # sl = # sl1, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, al1 + ADoInsert(tid0, true) ' + al = al3 + ARetInsert(tid0, false) ' + al4, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, al3 ≠ al3.take(# al1) + ADoInsert(tid0, true) ' + (al3.drop(# al1)).tail, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, # al1 ≤ # al3, ¬ tid0 ∈ setExt !(al3).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ m. # al2 < m ∧ ¬ # al2 + # al1 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m].tid ≠ tid0, ∀ tid. lsf1(tid).tid = tid ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a + x = a ' + x; (s)

Proof step 193 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 194:

  # sl = # sl1, # sl1 = # al2 + # al1 + 1, # al0 = # al1, al1 + ADoInsert(tid0, true) ' + al = al3 + ARetInsert(tid0, false) ' + al4, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), al3 = al0 + al5, pcf1(tid0) = idle, al3 ≠ al0 + ADoInsert(tid0, true) ' + al5.tail, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, # al1 ≤ # al3, ¬ tid0 ∈ setExt !(al3).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al1 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al1)[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ n ≤ # x → (y = x.take(n) ∧ z = x.drop(n) ↔ x = y + z ∧ # y = n); (elim) Used terms: al3, # al1, al0, al5

Proof step 194 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 195:

  # sl = # sl1, # sl1 = # al2 + # al0 + 1, ADoInsert(tid0, true) ' + al = al5 + ARetInsert(tid0, false) ' + al4, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[# al2] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, al5 ≠ ADoInsert(tid0, true) ' + al5.tail, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true) ' + al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ADoInsert(tid0, true) ∈ al5, ¬ tid0 ∈ setExt !(al5).map(.tid), ¬ tid0 ∈ setExt !(al0).map(.tid), ¬ lsf(tid0).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = lsf(tid0).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ m. # al2 < m ∧ ¬ # al2 + # al0 < m → (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m] ≠ τ ∧ (al2 + AInvInsert(tid0, lsf(tid0).le) ' + al0)[m].tid ≠ tid0 ⊦ ¬ lsf(tid0).le ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = lsf(tid0).le → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m ≤ m + n; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ ADoInsert(tid, b) ≠ ARetInsert(tid0, b0); (s) ⊦ ¬ a ∈ y → (y + a0 ' + z = a ' + z0 ↔ y = [] ∧ a0 = a ∧ z = z0); (ws) ⊦ a ∈ a0 ' + x ↔ a = a0 ∨ a ∈ x; (s) ⊦ a ∈ x + y ↔ a ∈ x ∨ a ∈ y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ (x + y).map(f) = x.map(f) + y.map(f); (s) ⊦ ext !(al + al0) = ext !(al) + ext !(al0); (s) ⊦ #(x + y) = # x + # y; (s) ⊦ # x = # z → (x + y = z + y0 ↔ x = z ∧ y = y0); (ws)

Proof step 195 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And closed the goal!

Rule argument

Additional information

Used simplifier rules: ⊦ a ' + x = a0 ' + y ↔ a = a0 ∧ x = y; (ws) ⊦ x + y = [] ↔ x = [] ∧ y = []; (s) ⊦ a ' ≠ []; (s) ⊦ a + x = a ' + x; (s) ⊦ # y = # y0 → (x + y = z + y0 ↔ x = z ∧ y = y0); (ws) ⊦ a ' = a0 ' ↔ a = a0; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ [] + x = x; (s) ⊦ ADoInsert(tid, b) ≠ ARetInsert(tid0, b0); (s) x ≠ [] ⊦ a = x.head ∧ y = x.tail ↔ x = a + y; (elim) Used terms: al5, a, al1

Proof step 196 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 197:

  ⊦ frag*(IOAut(start, step, ext))(s ' + sl, a ' + al) ↔ step(s, a, sl.head) ∧ frag*(IOAut(start, step, ext))(sl, al)

• Proof step 198:

  # sl1 = # al0, # sl = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al0[n] = AInvInsert(tid0, lsf(tid0).le), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, al0 ≠ [], e ≠ lsf(tid0).le, n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl2, al), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), (mkstate(gstate, lsf, pcf) ' + sl2).head), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list Used terms: al, mkstate(gstate0, lsf0, pcf0), setExt, mkstate(gstate, lsf, pcf) ' + sl2, ADoInsert(tid0, true), setInit, setStep

Proof step 197 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 198 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 199:

  # sl = # al0, # sl1 = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n] = mkstate(gstate2, lsf2, pcf1), al0[n] = AInvInsert(tid0, lsf(tid0).le), pcf1(tid0) = idle, al0 ≠ [], e ≠ lsf(tid0).le, n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl2, al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), setStep(mkstate(gstate0, lsf0, pcf0), ADoInsert(tid0, true), mkstate(gstate, lsf, pcf)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ tid. lsf1(tid).tid = tid ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ (a ' + x).head = a; (s)

Proof step 199 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 200:

  ⊦ setStep(mkstate(gs, lsf, pcf), a, mkstate(gs0, lsf0, pcf0)) ↔ (∃ tid, ls, pc. lstep(gs, lsf(tid), pcf(tid), a, gs0, ls, pc) ∧ lsf0 = lsf(tid := ls) ∧ pcf0 = pcf(tid := pc))

• Proof step 201:

  # sl1 = # al0, # sl = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al0[n] = AInvInsert(tid0, lsf(tid0).le), (mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate, lsf, pcf) ')[n] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, al0 ≠ [], e ≠ lsf(tid0).le, n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl2, al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0, ∃ tid, ls, pc. lstep(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true), gstate, ls, pc) ∧ lsf = lsf0(tid := ls) ∧ pcf = pcf0(tid := pc) ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used terms: lsf0, pcf0, pcf, lsf, gstate, gstate0, ADoInsert(tid0, true)

Proof step 200 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 201 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 202:

  # sl = # al0, # sl1 = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al0[n] = AInvInsert(tid0, (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le), ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' )[n ] = mkstate(gstate2, lsf2, pcf1), pcf1(tid0) = idle, al0 ≠ [], e ≠ (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le, n < # al0, frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl2, al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), pre(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ tid. lsf1(tid).tid = tid ⊦ ¬ e ∈ gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)).set ∧ ( (tid1 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));pcf0(tid)) = retInsert ∧ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));lsf0(tid)).le = e → ¬ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));lsf0(tid)).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ x → a ∈ x + y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ lstep(gs, ls, pc, a, gs0, ls0, pc0) ↔ pre(gs, ls, pc, a) ∧ ls0 = lstepf(gs, ls, pc, a) ∧ gs0 = gstepf(gs, ls, pc, a) ∧ pc0 = pcstepf(gs, ls, pc, a); (s)

Proof step 202 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule constructor cut

And obtained the following new goals

• Proof step 203:

  # sl1 = # al0, # sl = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' )[n ] = mkstate(gstate2, lsf2, pcf1), al0[n] = AInvInsert(tid0, (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le), pcf0(tid1) = invInsert, pcf1(tid0) = idle, al0 ≠ [], e ≠ (tid1 = tid0 ⊃ lstepf(gstate0, lsf0(tid0), pcf0(tid0), ADoInsert(tid0, true));lsf0(tid0)).le, n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), lsf0(tid1 := lstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true))), pcf0(tid1 := pcstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)))) ' + sl2, al), pre(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ tid, al1, al2. al0 + ADoInsert(tid0, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0 ⊦ ¬ e ∈ gstepf(gstate0, lsf0(tid1), pcf0(tid1), ADoInsert(tid0, true)).set ∧ ( (tid1 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));pcf0(tid)) = retInsert ∧ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));lsf0(tid)).le = e → ¬ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(tid0, true));lsf0(tid)).lb)

Rule argument

Additional information

Used simplifier rules: SetPC freely generated by idle, invInsert, invMember, retInsert, retMember;; in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ a ∈ x → a ∈ x + y; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ pre(gs, ls, retMember, a) ↔ (∃ b0. a = ARetMember(ls.tid, b0) ∧ (b0 ↔ ls.lb)); (s) ⊦ ADoInsert(tid, b) ≠ ARetMember(tid0, b0); (s) ⊦ pre(gs, ls, retInsert, a) ↔ (∃ b0. a = ARetInsert(ls.tid, b0) ∧ (b0 ↔ ls.lb)); (s) ⊦ ADoInsert(tid, b) ≠ ARetInsert(tid0, b0); (s) ⊦ pre(gs, ls, invMember, a) ↔ a = ADoMember(ls.tid); (s) ⊦ ADoInsert(tid, b) ≠ ADoMember(tid0); (s) ⊦ gstepf(gs, ls, idle, a) = gs; (s) ⊦ pre(gs, ls, idle, a) ↔ (∃ e. a = AInvInsert(ls.tid, e) ∧ e ≠ ⊥) ∨ (∃ e. a = AInvMember(ls.tid, e) ∧ e ≠ ⊥); (s) ⊦ ADoInsert(tid, b) ≠ AInvInsert(tid0, e); (s) ⊦ ADoInsert(tid, b) ≠ AInvMember(tid0, e); (s)

Proof step 203 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 204:

  # sl = # al0, # sl1 = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' )[n ] = mkstate(gstate2, lsf2, pcf1), al0[n] = AInvInsert (lsf0(tid1).tid, (tid1 = lsf0(tid1).tid ⊃ lstepf(gstate0, lsf0(lsf0(tid1).tid), pcf0(lsf0(tid1).tid), ADoInsert(lsf0(tid1).tid, true));lsf0(lsf0(tid1).tid)).le), pcf0(tid1) = invInsert, pcf1(lsf0(tid1).tid) = idle, al0 ≠ [], e ≠ (tid1 = lsf0(tid1).tid ⊃ lstepf(gstate0, lsf0(lsf0(tid1).tid), pcf0(lsf0(tid1).tid), ADoInsert(lsf0(tid1).tid, true));lsf0(lsf0(tid1).tid)).le, n < # al0, frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl2, al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ lsf0(tid1).tid, ∀ tid, al1, al2. al0 + ADoInsert(lsf0(tid1).tid, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ tid. lsf1(tid).tid = tid ⊦ e ≠ lsf0(tid1).le ∧ ( (tid1 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));pcf0(tid)) = retInsert ∧ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).le = e → ¬ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ x → a ∈ x + y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ ¬ a ∈ s → (a ∈ s ++ b ↔ a = b); (s) ⊦ (gs.set:= set).set = set; (s) ⊦ ls.tid = tid → gstepf(gs, ls, invInsert, ADoInsert(tid, b)) = (b ⊃ gs.set:= (gs.set ++ ls.le);gs); (s) ⊦ ls.tid = tid → pcstepf(gs, ls, invInsert, ADoInsert(tid, b)) = retInsert; (s) ⊦ ls.tid = tid → lstepf(gs, ls, invInsert, ADoInsert(tid, b)) = (b ⊃ ls.lb:= true;ls.lb:= false); (s) ⊦ ADoInsert(tid, b) = ADoInsert(tid0, b0) ↔ tid = tid0 ∧ (b ↔ b0); (ws) ⊦ pre(gs, ls, invInsert, a) ↔ (∃ b. a = ADoInsert(ls.tid, b)); (s)

Proof step 204 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 205:

  # sl1 = # al0, # sl = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al0[n] = AInvInsert (lsf0(tid1).tid, (tid1 = lsf0(tid1).tid ⊃ lstepf(gstate0, lsf0(lsf0(tid1).tid), pcf0(lsf0(tid1).tid), ADoInsert(lsf0(tid1).tid, true));lsf0(lsf0(tid1).tid)).le), ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' )[n ] = mkstate(gstate2, lsf2, pcf1), pcf0(tid1) = invInsert, pcf1(lsf0(tid1).tid) = idle, tid1 = lsf0(tid1).tid, al0 ≠ [], e ≠ lstepf(gstate0, lsf0(lsf0(tid1).tid), pcf0(lsf0(tid1).tid), ADoInsert(lsf0(tid1).tid, true)).le, n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl2, al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ tid, al1, al2. al0 + ADoInsert(lsf0(tid1).tid, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ lsf0(tid1).tid ⊦ e ≠ lsf0(tid1).le ∧ ( (tid1 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));pcf0(tid)) = retInsert ∧ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).le = e → ¬ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).lb)

• Proof step 207:

  # sl1 = # al0, # sl = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al0[n] = AInvInsert (lsf0(tid1).tid, (tid1 = lsf0(tid1).tid ⊃ lstepf(gstate0, lsf0(lsf0(tid1).tid), pcf0(lsf0(tid1).tid), ADoInsert(lsf0(tid1).tid, true));lsf0(lsf0(tid1).tid)).le), ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' )[n ] = mkstate(gstate2, lsf2, pcf1), pcf0(tid1) = invInsert, pcf1(lsf0(tid1).tid) = idle, al0 ≠ [], e ≠ lsf0(lsf0(tid1).tid).le, tid1 ≠ lsf0(tid1).tid, n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl2, al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ tid, al1, al2. al0 + ADoInsert(lsf0(tid1).tid, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ lsf0(tid1).tid ⊦ e ≠ lsf0(tid1).le ∧ ( (tid1 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));pcf0(tid)) = retInsert ∧ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).le = e → ¬ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).lb)

Rule argument

Additional information

Proof step 205 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 206:

  # sl1 = # al0, # sl = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, (tid1 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));pcf0(tid)) = retInsert, al0[n] = AInvInsert(tid1, lsf0(tid1).le), ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' )[n ] = mkstate(gstate2, lsf2, pcf1), pcf0(tid1) = invInsert, pcf1(tid1) = idle, tid1 = lsf0(tid1).tid, (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).le ≠ lsf0(tid1).le, al0 ≠ [], (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).lb, n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl2, al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).le → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ tid0, al1, al2. al0 + ADoInsert(tid1, true) ' + al = al1 + AInvInsert(tid0, (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).le) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid1 ⊦

Rule argument

Additional information

Used simplifier rules: ⊦ (ls.lb:= lb).le = ls.le; (s) ⊦ ls.tid = tid → lstepf(gs, ls, invInsert, ADoInsert(tid, b)) = (b ⊃ ls.lb:= true;ls.lb:= false); (s)

Proof step 206 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule case distinction

And closed the goal!

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ ls.tid = tid → pcstepf(gs, ls, invInsert, ADoInsert(tid, b)) = retInsert; (s) ⊦ ls.tid = tid → lstepf(gs, ls, invInsert, ADoInsert(tid, b)) = (b ⊃ ls.lb:= true;ls.lb:= false); (s) ⊦ (ls.lb:= lb).le = ls.le; (s)

Proof step 207 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 208:

  # sl = # al0, # sl1 = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' )[n ] = mkstate(gstate2, lsf2, pcf1), al0[n] = AInvInsert(lsf0(tid1).tid, lsf0(lsf0(tid1).tid).le), pcf0(tid1) = invInsert, pcf1(lsf0(tid1).tid) = idle, al0 ≠ [], e ≠ lsf0(lsf0(tid1).tid).le, tid1 ≠ lsf0(tid1).tid, n < # al0, frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl2, al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ lsf0(tid1).tid, ∀ tid, al1, al2. al0 + ADoInsert(lsf0(tid1).tid, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ tid. lsf1(tid).tid = tid ⊦ e ≠ lsf0(tid1).le ∧ ( (tid1 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));pcf0(tid)) = retInsert ∧ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).le = e → ¬ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).lb)

Rule argument

Additional information

Proof step 208 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply lemma

And obtained the following new goals

• Proof step 209:

  SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf), frag*(IOAut(setInit, setStep, setExt))(sl, al) ⊦ sl.head.gstate.set ⊆ sl.last.gstate.set ∧ SetInv(sl.last.gstate, sl.last.lsf, sl.last.pcf)

• Proof step 210:

  # sl1 = # al0, # sl = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al0[n] = AInvInsert(lsf0(tid1).tid, lsf0(lsf0(tid1).tid).le), ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' )[n ] = mkstate(gstate2, lsf2, pcf1), pcf0(tid1) = invInsert, pcf1(lsf0(tid1).tid) = idle, al0 ≠ [], e ≠ lsf0(lsf0(tid1).tid).le, tid1 ≠ lsf0(tid1).tid, n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl2, al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ SetInv ((mkstate(gstate1, lsf1, λ tid. idle) ' + sl).head.gstate, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).head.lsf, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).head.pcf), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ tid, al1, al2. al0 + ADoInsert(lsf0(tid1).tid, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ lsf0(tid1).tid ⊦ e ≠ lsf0(tid1).le ∧ ( (tid1 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));pcf0(tid)) = retInsert ∧ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).le = e → ¬ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).lb)

Rule argument

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; ⊦ (a ' + x).head = a; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ ∅ ⊆ s; (s) ⊦ mkstate(gstate, lsf, pcf).gstate = gstate; (s) ⊦ mkstate(gstate, lsf, pcf).lsf = lsf; (s) ⊦ mkstate(gstate, lsf, pcf).pcf = pcf; (s) Used terms: mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0

Proof step 209 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Lemma frag-rely-inv

Proof step 210 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 211:

  # sl = # al0, # sl1 = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' )[n ] = mkstate(gstate2, lsf2, pcf1), al0[n] = AInvInsert(lsf0(tid1).tid, lsf0(lsf0(tid1).tid).le), pcf0(tid1) = invInsert, pcf1(lsf0(tid1).tid) = idle, al0 ≠ [], e ≠ lsf0(lsf0(tid1).tid).le, tid1 ≠ lsf0(tid1).tid, n < # al0, frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl2, al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ SetInv(gstate1, lsf1, λ tid. idle), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ lsf0(tid1).tid, ∀ tid, al1, al2. al0 + ADoInsert(lsf0(tid1).tid, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ tid. lsf1(tid).tid = tid ⊦ e ≠ lsf0(tid1).le ∧ ( (tid1 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));pcf0(tid)) = retInsert ∧ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).le = e → ¬ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ mkstate(gstate, lsf, pcf).pcf = pcf; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ (a ' + x).head = a; (s) ⊦ mkstate(gstate, lsf, pcf).lsf = lsf; (s) ⊦ mkstate(gstate, lsf, pcf).gstate = gstate; (s)

Proof step 211 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply lemma

And obtained the following new goals

• Proof step 212:

  (gs.set = ∅ ∧ pcf = (λ tid. idle)) ∧ (∀ tid. tid = lsf(tid).tid) ⊦ SetInv(gs, lsf, pcf)

• Proof step 213:

  # sl1 = # al0, # sl = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, al0[n] = AInvInsert(lsf0(tid1).tid, lsf0(lsf0(tid1).tid).le), ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' )[n ] = mkstate(gstate2, lsf2, pcf1), pcf0(tid1) = invInsert, pcf1(lsf0(tid1).tid) = idle, al0 ≠ [], e ≠ lsf0(lsf0(tid1).tid).le, tid1 ≠ lsf0(tid1).tid, n < # al0, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl2, al), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ SetInv(gstate1, lsf1, λ tid. idle), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid. lsf1(tid).tid = tid, ∀ tid, al1, al2. al0 + ADoInsert(lsf0(tid1).tid, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ lsf0(tid1).tid ⊦ e ≠ lsf0(tid1).le ∧ ( (tid1 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));pcf0(tid)) = retInsert ∧ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).le = e → ¬ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).lb), (λ tid. idle) = (λ tid. idle) ∧ (∀ tid. tid = lsf1(tid).tid)

Rule argument

Additional information

Used terms: lsf1, gstate1, λ tid. idle

Proof step 212 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 213 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 214:

  # sl = # al0, # sl1 = # al0, mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl2, (mkstate(gstate1, lsf1, λ tid. idle) ' + sl).last = mkstate(gstate0, lsf0, pcf0), gstate1.set = ∅, ( mkstate(gstate1, lsf1, λ tid. idle) ' + sl + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' )[n ] = mkstate(gstate2, lsf2, pcf1), al0[n] = AInvInsert(lsf0(tid1).tid, lsf0(lsf0(tid1).tid).le), pcf0(tid1) = invInsert, pcf1(lsf0(tid1).tid) = idle, al0 ≠ [], e ≠ lsf0(lsf0(tid1).tid).le, tid0 ≠ lsf1(tid0).tid, tid1 ≠ lsf0(tid1).tid, n < # al0, frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid1).le), lsf0(tid1 := lsf0(tid1).lb:= true), pcf0(tid1 := retInsert)) ' + sl2, al), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate1, lsf1, λ tid. idle) ' + sl, al0), mkstate(gstate1, lsf1, λ tid. idle) ∈ sl1, ¬ SetInv(gstate1, lsf1, λ tid. idle), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ lsf0(tid1).tid, ∀ tid, al1, al2. al0 + ADoInsert(lsf0(tid1).tid, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), ∀ tid. lsf1(tid).tid = tid ⊦ e ≠ lsf0(tid1).le ∧ ( (tid1 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));pcf0(tid)) = retInsert ∧ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).le = e → ¬ (tid1 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).lb)

Rule argument

Additional information

Proof step 214 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic quantifier closing applied rule all left

And closed the goal!

Rule argument

Additional information

Used terms: tid0

Proof step 215 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 216:

  ⊦ frag*(IOAut(start, step, ext))(s ' + sl, a ' + al) ↔ step(s, a, sl.head) ∧ frag*(IOAut(start, step, ext))(sl, al)

• Proof step 217:

  # sl1 = # al0, # sl = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), mkstate(gstate, lsf, pcf) = sl0.head, frag*(IOAut(setInit, setStep, setExt))(sl0, al), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), setStep(mkstate(gstate0, lsf0, pcf0), a, sl0.head), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl0 ⊦ ∃ tid. a = ADoInsert(tid, true), ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used terms: al, mkstate(gstate0, lsf0, pcf0), setExt, sl0, a, setInit, setStep

Proof step 216 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 217 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 218:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), mkstate(gstate, lsf, pcf) = sl0.head, frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(sl0, al), setInit(s), setStep(mkstate(gstate0, lsf0, pcf0), a, mkstate(gstate, lsf, pcf)), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl0 ⊦ ∃ tid. a = ADoInsert(tid, true), ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Proof step 218 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 219:

  # sl1 = # al0, # sl = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), mkstate(gstate, lsf, pcf) = s0, sl0 = s0 + sl2, sl0 ≠ [], frag*(IOAut(setInit, setStep, setExt))(sl0, al), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), setStep(mkstate(gstate0, lsf0, pcf0), a, mkstate(gstate, lsf, pcf)), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl0 ⊦ ∃ tid. a = ADoInsert(tid, true), ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ x + [] = x; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ ¬ frag*(IOAut(start, step, ext))([], al); (s) x ≠ [] ⊦ a = x.head ∧ y = x.tail ↔ x = a + y; (elim) Used terms: sl0, s0, sl2

Proof step 219 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 220:

  # sl1 = # al0, # sl = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl2, al), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), setStep(mkstate(gstate0, lsf0, pcf0), a, mkstate(gstate, lsf, pcf)), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s = mkstate(gstate, lsf, pcf) ∨ s ∈ sl2 ⊦ ∃ tid. a = ADoInsert(tid, true), ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ a0 ' + x ↔ a = a0 ∨ a ∈ x; (s) ⊦ a ∈ x + y ↔ a ∈ x ∨ a ∈ y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ a + x = a ' + x; (s) ⊦ a ' ≠ []; (s) ⊦ x + y = [] ↔ x = [] ∧ y = []; (s)

Proof step 220 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 221:

  ⊦ setStep(mkstate(gs, lsf, pcf), a, mkstate(gs0, lsf0, pcf0)) ↔ (∃ tid, ls, pc. lstep(gs, lsf(tid), pcf(tid), a, gs0, ls, pc) ∧ lsf0 = lsf(tid := ls) ∧ pcf0 = pcf(tid := pc))

• Proof step 222:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate, lsf, pcf) ' + sl2, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl2, al), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), ∃ tid, ls, pc. lstep(gstate0, lsf0(tid), pcf0(tid), a, gstate, ls, pc) ∧ lsf = lsf0(tid := ls) ∧ pcf = pcf0(tid := pc), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s = mkstate(gstate, lsf, pcf) ∨ s ∈ sl2 ⊦ ∃ tid. a = ADoInsert(tid, true), ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used terms: lsf0, pcf0, pcf, lsf, gstate, gstate0, a

Proof step 221 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 222 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 223:

  # sl1 = # al0, # sl = # al0, s ' + sl + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ' + sl2, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ' + sl2, al), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), pre(gstate0, lsf0(tid0), pcf0(tid0), a), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s = mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ∨ s ∈ sl2 ⊦ ∃ tid. a = ADoInsert(tid, true), ¬ e ∈ gstepf(gstate0, lsf0(tid0), pcf0(tid0), a).set ∧ ( (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), a);pcf0(tid)) = retInsert ∧ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), a);lsf0(tid)).le = e → ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), a);lsf0(tid)).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ a0 ' + x ↔ a = a0 ∨ a ∈ x; (s) ⊦ a ∈ x + y ↔ a ∈ x ∨ a ∈ y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ lstep(gs, ls, pc, a, gs0, ls0, pc0) ↔ pre(gs, ls, pc, a) ∧ ls0 = lstepf(gs, ls, pc, a) ∧ gs0 = gstepf(gs, ls, pc, a) ∧ pc0 = pcstepf(gs, ls, pc, a); (s)

Proof step 223 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule constructor cut

And obtained the following new goals

• Proof step 224:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ' + sl2, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), pcf0(tid0) = idle, frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ' + sl2, al), pre(gstate0, lsf0(tid0), pcf0(tid0), a), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s = mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ∨ s ∈ sl2 ⊦ ∃ tid. a = ADoInsert(tid, true), ¬ e ∈ gstepf(gstate0, lsf0(tid0), pcf0(tid0), a).set ∧ ( (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), a);pcf0(tid)) = retInsert ∧ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), a);lsf0(tid)).le = e → ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), a);lsf0(tid)).lb)

• Proof step 228:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ' + sl2, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), pcf0(tid0) = invInsert, frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ' + sl2, al), pre(gstate0, lsf0(tid0), pcf0(tid0), a), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s = mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ∨ s ∈ sl2 ⊦ ∃ tid. a = ADoInsert(tid, true), ¬ e ∈ gstepf(gstate0, lsf0(tid0), pcf0(tid0), a).set ∧ ( (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), a);pcf0(tid)) = retInsert ∧ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), a);lsf0(tid)).le = e → ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), a);lsf0(tid)).lb)

• Proof step 234:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ' + sl2, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), pcf0(tid0) = invMember, frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ' + sl2, al), pre(gstate0, lsf0(tid0), pcf0(tid0), a), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s = mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ∨ s ∈ sl2 ⊦ ∃ tid. a = ADoInsert(tid, true), ¬ e ∈ gstepf(gstate0, lsf0(tid0), pcf0(tid0), a).set ∧ ( (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), a);pcf0(tid)) = retInsert ∧ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), a);lsf0(tid)).le = e → ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), a);lsf0(tid)).lb)

• Proof step 236:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ' + sl2, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), pcf0(tid0) = retInsert, frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ' + sl2, al), pre(gstate0, lsf0(tid0), pcf0(tid0), a), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s = mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ∨ s ∈ sl2 ⊦ ∃ tid. a = ADoInsert(tid, true), ¬ e ∈ gstepf(gstate0, lsf0(tid0), pcf0(tid0), a).set ∧ ( (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), a);pcf0(tid)) = retInsert ∧ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), a);lsf0(tid)).le = e → ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), a);lsf0(tid)).lb)

• Proof step 238:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ' + sl2, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), pcf0(tid0) = retMember, frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ' + sl2, al), pre(gstate0, lsf0(tid0), pcf0(tid0), a), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s = mkstate (gstepf(gstate0, lsf0(tid0), pcf0(tid0), a), lsf0(tid0 := lstepf(gstate0, lsf0(tid0), pcf0(tid0), a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), pcf0(tid0), a))) ∨ s ∈ sl2 ⊦ ∃ tid. a = ADoInsert(tid, true), ¬ e ∈ gstepf(gstate0, lsf0(tid0), pcf0(tid0), a).set ∧ ( (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), a);pcf0(tid)) = retInsert ∧ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), a);lsf0(tid)).le = e → ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), a);lsf0(tid)).lb)

Rule argument

Additional information

Used simplifier rules: SetPC freely generated by idle, invInsert, invMember, retInsert, retMember;;

Proof step 224 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 225:

  # sl1 = # al0, # sl = # al0, s ' + sl + mkstate(gstate0, lsf0(tid0 := lstepf(gstate0, lsf0(tid0), idle, a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), idle, a))) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate0, lsf0(tid0 := lstepf(gstate0, lsf0(tid0), idle, a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), idle, a))) ' + sl2, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), a);pcf0(tid)) = retInsert, pcf0(tid0) = idle, (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), a);lsf0(tid)).lb, frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate0, lsf0(tid0 := lstepf(gstate0, lsf0(tid0), idle, a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), idle, a))) ' + sl2, al), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), a);lsf0(tid)).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), a);lsf0(tid)).le → ¬ lsf0(tid).lb, ∀ tid1, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid1, (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), a);lsf0(tid)).le) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid1, false) ' + al4 ∧ ¬ tid1 ∈ setExt !(al3).map(.tid)), a = AInvInsert(lsf0(tid0).tid, e0) ∧ e0 ≠ ⊥ ∨ a = AInvMember(lsf0(tid0).tid, e1) ∧ e1 ≠ ⊥, s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s = mkstate(gstate0, lsf0(tid0 := lstepf(gstate0, lsf0(tid0), idle, a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), idle, a))) ∨ s ∈ sl2 ⊦ ∃ tid. a = ADoInsert(tid, true)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ a0 ' + x ↔ a = a0 ∨ a ∈ x; (s) ⊦ a ∈ x + y ↔ a ∈ x ∨ a ∈ y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ gstepf(gs, ls, idle, a) = gs; (s) ⊦ pre(gs, ls, idle, a) ↔ (∃ e. a = AInvInsert(ls.tid, e) ∧ e ≠ ⊥) ∨ (∃ e. a = AInvMember(ls.tid, e) ∧ e ≠ ⊥); (s)

Proof step 225 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 226:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate(gstate0, lsf0(tid0 := lstepf(gstate0, lsf0(tid0), idle, a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), idle, a))) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate0, lsf0(tid0 := lstepf(gstate0, lsf0(tid0), idle, a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), idle, a))) ' + sl2, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), pcf0(tid0) = idle, pcstepf(gstate0, lsf0(tid), pcf0(tid), a) = retInsert, tid0 = tid, (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), a);lsf0(tid)).lb, frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate0, lsf0(tid0 := lstepf(gstate0, lsf0(tid0), idle, a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), idle, a))) ' + sl2, al), setInit(s), ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), a);lsf0(tid)).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), a);lsf0(tid)).le → ¬ lsf0(tid).lb, ∀ tid1, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid1, (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), a);lsf0(tid)).le) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid1, false) ' + al4 ∧ ¬ tid1 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s = mkstate(gstate0, lsf0(tid0 := lstepf(gstate0, lsf0(tid0), idle, a)), pcf0(tid0 := pcstepf(gstate0, lsf0(tid0), idle, a))) ∨ s ∈ sl2, a = AInvInsert(lsf0(tid0).tid, e0) ∧ e0 ≠ ⊥ ∨ a = AInvMember(lsf0(tid0).tid, e1) ∧ e1 ≠ ⊥ ⊦ ∃ tid. a = ADoInsert(tid, true)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list

Proof step 226 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 227:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate(gstate0, lsf0(tid := lstepf(gstate0, lsf0(tid), idle, a)), pcf0(tid := retInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate0, lsf0(tid := lstepf(gstate0, lsf0(tid), idle, a)), pcf0(tid := retInsert)) ' + sl2, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), pcf0(tid) = idle, pcstepf(gstate0, lsf0(tid), idle, a) = retInsert, lstepf(gstate0, lsf0(tid), idle, a).lb, frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0(tid := lstepf(gstate0, lsf0(tid), idle, a)), pcf0(tid := retInsert)) ' + sl2, al), setInit(s), ¬ lstepf(gstate0, lsf0(tid), idle, a).le ∈ gstate0.set, ∀ tid1, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid1, lstepf(gstate0, lsf0(tid), idle, a).le) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid1, false) ' + al4 ∧ ¬ tid1 ∈ setExt !(al3).map(.tid)), a = AInvInsert(lsf0(tid).tid, e0) ∧ e0 ≠ ⊥ ∨ a = AInvMember(lsf0(tid).tid, e1) ∧ e1 ≠ ⊥, s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s = mkstate(gstate0, lsf0(tid := lstepf(gstate0, lsf0(tid), idle, a)), pcf0(tid := retInsert)) ∨ s ∈ sl2 ⊦ ∃ tid. a = ADoInsert(tid, true)

Rule argument

Additional information

Used simplifier rules: ⊦ idle ≠ retInsert; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ a0 ' + x ↔ a = a0 ∨ a ∈ x; (s) ⊦ a ∈ x + y ↔ a ∈ x ∨ a ∈ y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list

Proof step 227 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule case distinction

And closed the goal!

Rule argument

Additional information

Used simplifier rules: ⊦ ls.tid = tid → pcstepf(gs, ls, idle, AInvMember(tid, e)) = invMember; (s) ⊦ invMember ≠ retInsert; (s) ⊦ ls.tid = tid → pcstepf(gs, ls, idle, AInvInsert(tid, e)) = invInsert; (s) ⊦ invInsert ≠ retInsert; (s)

Proof step 228 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 229:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate ((b ⊃ gstate0.set:= (gstate0.set ++ lsf0(tid0).le);gstate0), lsf0(tid0 := (b ⊃ lsf0(tid0).lb:= true;lsf0(tid0).lb:= false)), pcf0(tid0 := retInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate ((b ⊃ gstate0.set:= (gstate0.set ++ lsf0(tid0).le);gstate0), lsf0(tid0 := (b ⊃ lsf0(tid0).lb:= true;lsf0(tid0).lb:= false)), pcf0(tid0 := retInsert)) ' + sl2, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), pcf0(tid0) = invInsert, frag*(IOAut(setInit, setStep, setExt)) ( mkstate ((b ⊃ gstate0.set:= (gstate0.set ++ lsf0(tid0).le);gstate0), lsf0(tid0 := (b ⊃ lsf0(tid0).lb:= true;lsf0(tid0).lb:= false)), pcf0(tid0 := retInsert)) ' + sl2, al), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid, al1, al2. al0 + ADoInsert(lsf0(tid0).tid, b) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s = mkstate ((b ⊃ gstate0.set:= (gstate0.set ++ lsf0(tid0).le);gstate0), lsf0(tid0 := (b ⊃ lsf0(tid0).lb:= true;lsf0(tid0).lb:= false)), pcf0(tid0 := retInsert)) ∨ s ∈ sl2 ⊦ ∃ tid. ADoInsert(lsf0(tid0).tid, b) = ADoInsert(tid, true), ¬ e ∈ (b ⊃ gstate0.set:= (gstate0.set ++ lsf0(tid0).le);gstate0).set ∧ ( (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, b));pcf0(tid)) = retInsert ∧ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, b));lsf0(tid)).le = e → ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, b));lsf0(tid)).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ a0 ' + x ↔ a = a0 ∨ a ∈ x; (s) ⊦ a ∈ x + y ↔ a ∈ x ∨ a ∈ y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ ls.tid = tid → gstepf(gs, ls, invInsert, ADoInsert(tid, b)) = (b ⊃ gs.set:= (gs.set ++ ls.le);gs); (s) ⊦ ls.tid = tid → pcstepf(gs, ls, invInsert, ADoInsert(tid, b)) = retInsert; (s) ⊦ ls.tid = tid → lstepf(gs, ls, invInsert, ADoInsert(tid, b)) = (b ⊃ ls.lb:= true;ls.lb:= false); (s) ⊦ pre(gs, ls, invInsert, a) ↔ (∃ b. a = ADoInsert(ls.tid, b)); (s)

Proof step 229 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule case distinction

And obtained the following new goals

• Proof step 230:

  # sl1 = # al0, # sl = # al0, s ' + sl + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid0).le), lsf0(tid0 := (b ⊃ lsf0(tid0).lb:= true;lsf0(tid0).lb:= false)), pcf0(tid0 := retInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate ((b ⊃ gstate0.set:= (gstate0.set ++ lsf0(tid0).le);gstate0), lsf0(tid0 := (b ⊃ lsf0(tid0).lb:= true;lsf0(tid0).lb:= false)), pcf0(tid0 := retInsert)) ' + sl2, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), b, pcf0(tid0) = invInsert, frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt)) ( mkstate ((b ⊃ gstate0.set:= (gstate0.set ++ lsf0(tid0).le);gstate0), lsf0(tid0 := (b ⊃ lsf0(tid0).lb:= true;lsf0(tid0).lb:= false)), pcf0(tid0 := retInsert)) ' + sl2, al), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid, al1, al2. al0 + ADoInsert(lsf0(tid0).tid, b) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s = mkstate ((b ⊃ gstate0.set:= (gstate0.set ++ lsf0(tid0).le);gstate0), lsf0(tid0 := (b ⊃ lsf0(tid0).lb:= true;lsf0(tid0).lb:= false)), pcf0(tid0 := retInsert)) ∨ s ∈ sl2 ⊦ ∃ tid. ADoInsert(lsf0(tid0).tid, b) = ADoInsert(tid, true), ¬ e ∈ (b ⊃ gstate0.set:= (gstate0.set ++ lsf0(tid0).le);gstate0).set ∧ ( (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, b));pcf0(tid)) = retInsert ∧ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, b));lsf0(tid)).le = e → ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, b));lsf0(tid)).lb)

• Proof step 232:

  # sl1 = # al0, # sl = # al0, s ' + sl + mkstate(gstate0, lsf0(tid0 := (b ⊃ lsf0(tid0).lb:= true;lsf0(tid0).lb:= false)), pcf0(tid0 := retInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate ((b ⊃ gstate0.set:= (gstate0.set ++ lsf0(tid0).le);gstate0), lsf0(tid0 := (b ⊃ lsf0(tid0).lb:= true;lsf0(tid0).lb:= false)), pcf0(tid0 := retInsert)) ' + sl2, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), ¬ b, pcf0(tid0) = invInsert, frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), frag*(IOAut(setInit, setStep, setExt)) ( mkstate ((b ⊃ gstate0.set:= (gstate0.set ++ lsf0(tid0).le);gstate0), lsf0(tid0 := (b ⊃ lsf0(tid0).lb:= true;lsf0(tid0).lb:= false)), pcf0(tid0 := retInsert)) ' + sl2, al), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid, al1, al2. al0 + ADoInsert(lsf0(tid0).tid, b) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s = mkstate ((b ⊃ gstate0.set:= (gstate0.set ++ lsf0(tid0).le);gstate0), lsf0(tid0 := (b ⊃ lsf0(tid0).lb:= true;lsf0(tid0).lb:= false)), pcf0(tid0 := retInsert)) ∨ s ∈ sl2 ⊦ ∃ tid. ADoInsert(lsf0(tid0).tid, b) = ADoInsert(tid, true), ¬ e ∈ (b ⊃ gstate0.set:= (gstate0.set ++ lsf0(tid0).le);gstate0).set ∧ ( (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, b));pcf0(tid)) = retInsert ∧ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, b));lsf0(tid)).le = e → ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, b));lsf0(tid)).lb)

Rule argument

Additional information

Proof step 230 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 231:

  # sl1 = # al0, # sl = # al0, s ' + sl + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid0).le), lsf0(tid0 := lsf0(tid0).lb:= true), pcf0(tid0 := retInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid0).le), lsf0(tid0 := lsf0(tid0).lb:= true), pcf0(tid0 := retInsert)) ' + sl2, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), pcf0(tid0) = invInsert, s ≠ mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid0).le), lsf0(tid0 := lsf0(tid0).lb:= true), pcf0(tid0 := retInsert)), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate0.set:= (gstate0.set ++ lsf0(tid0).le), lsf0(tid0 := lsf0(tid0).lb:= true), pcf0(tid0 := retInsert)) ' + sl2, al), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid, al1, al2. al0 + ADoInsert(lsf0(tid0).tid, true) ' + al = al1 + AInvInsert(tid, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid, false) ' + al4 ∧ ¬ tid ∈ setExt !(al3).map(.tid)), s ∈ sl2 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl1, s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl2 ⊦ ∃ tid. ADoInsert(lsf0(tid0).tid, true) = ADoInsert(tid, true), e ≠ lsf0(tid0).le ∧ ( (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));pcf0(tid)) = retInsert ∧ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).le = e → ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, true));lsf0(tid)).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ ∅ ≠ s ++ a; (s) ⊦ (gs.set:= set).set = set; (s) ⊦ setInit(mkstate(gs, lsf, pcf)) ↔ (gs.set = ∅ ∧ pcf = (λ tid. idle)) ∧ (∀ tid. lsf(tid).tid = tid); (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ a0 ' + x ↔ a = a0 ∨ a ∈ x; (s) ⊦ a ∈ x + y ↔ a ∈ x ∨ a ∈ y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ ¬ a ∈ s → (a ∈ s ++ b ↔ a = b); (s)

Proof step 231 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic quantifier closing applied rule exists right

And closed the goal!

Rule argument

Additional information

Used terms: lsf0(tid0).tid

Proof step 232 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 233:

  # sl1 = # al0, # sl = # al0, s ' + sl + mkstate(gstate0, lsf0(tid0 := lsf0(tid0).lb:= false), pcf0(tid0 := retInsert)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate0, lsf0(tid0 := lsf0(tid0).lb:= false), pcf0(tid0 := retInsert)) ' + sl2, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, false));pcf0(tid)) = retInsert, pcf0(tid0) = invInsert, (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, false));lsf0(tid)).lb, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0(tid0 := lsf0(tid0).lb:= false), pcf0(tid0 := retInsert)) ' + sl2, al), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, false));lsf0(tid)).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, false));lsf0(tid)).le → ¬ lsf0(tid).lb, ∀ tid1, al1, al2. al0 + ADoInsert(lsf0(tid0).tid, false) ' + al = al1 + AInvInsert(tid1, (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoInsert(lsf0(tid).tid, false));lsf0(tid)).le) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid1, false) ' + al4 ∧ ¬ tid1 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s = mkstate(gstate0, lsf0(tid0 := lsf0(tid0).lb:= false), pcf0(tid0 := retInsert)) ∨ s ∈ sl2 ⊦ ∃ tid. ADoInsert(lsf0(tid0).tid, false) = ADoInsert(tid, true)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ a0 ' + x ↔ a = a0 ∨ a ∈ x; (s) ⊦ a ∈ x + y ↔ a ∈ x ∨ a ∈ y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list

Proof step 233 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule case distinction

And closed the goal!

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ ls.tid = tid → pcstepf(gs, ls, invInsert, ADoInsert(tid, b)) = retInsert; (s) ⊦ a ∈ x + y ↔ a ∈ x ∨ a ∈ y; (s) ⊦ a ∈ a0 ' + x ↔ a = a0 ∨ a ∈ x; (s) ⊦ ls.tid = tid → lstepf(gs, ls, invInsert, ADoInsert(tid, b)) = (b ⊃ ls.lb:= true;ls.lb:= false); (s) ⊦ (ls.lb:= lb).lb ↔ lb; (s)

Proof step 234 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 235:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate(gstate0, lsf0(tid0 := lsf0(tid0).lb:= (lsf0(tid0).le ∈ gstate0.set)), pcf0(tid0 := retMember)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate0, lsf0(tid0 := lsf0(tid0).lb:= (lsf0(tid0).le ∈ gstate0.set)), pcf0(tid0 := retMember)) ' + sl2, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ADoMember(lsf0(tid).tid));pcf0(tid)) = retInsert, pcf0(tid0) = invMember, (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoMember(lsf0(tid).tid));lsf0(tid)).lb, frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate0, lsf0(tid0 := lsf0(tid0).lb:= (lsf0(tid0).le ∈ gstate0.set)), pcf0(tid0 := retMember)) ' + sl2, al), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoMember(lsf0(tid).tid));lsf0(tid)).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoMember(lsf0(tid).tid));lsf0(tid)).le → ¬ lsf0(tid).lb, ∀ tid1, al1, al2. al0 + ADoMember(lsf0(tid0).tid) ' + al = al1 + AInvInsert(tid1, (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ADoMember(lsf0(tid).tid));lsf0(tid)).le) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid1, false) ' + al4 ∧ ¬ tid1 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s = mkstate(gstate0, lsf0(tid0 := lsf0(tid0).lb:= (lsf0(tid0).le ∈ gstate0.set)), pcf0(tid0 := retMember)) ∨ s ∈ sl2 ⊦

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ a0 ' + x ↔ a = a0 ∨ a ∈ x; (s) ⊦ a ∈ x + y ↔ a ∈ x ∨ a ∈ y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ ADoInsert(tid, b) ≠ ADoMember(tid0); (s) ⊦ ls.tid = tid → gstepf(gs, ls, invMember, ADoMember(tid)) = gs; (s) ⊦ ls.tid = tid → pcstepf(gs, ls, invMember, ADoMember(tid)) = retMember; (s) ⊦ ls.tid = tid → lstepf(gs, ls, invMember, ADoMember(tid)) = ls.lb:= (ls.le ∈ gs.set); (s) ⊦ pre(gs, ls, invMember, a) ↔ a = ADoMember(ls.tid); (s)

Proof step 235 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule case distinction

And closed the goal!

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ ls.tid = tid → pcstepf(gs, ls, invMember, ADoMember(tid)) = retMember; (s) ⊦ retInsert ≠ retMember; (s)

Proof step 236 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 237:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate(gstate0, lsf0(tid0 := lsf0(tid0)), pcf0(tid0 := idle)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate0, lsf0(tid0 := lsf0(tid0)), pcf0(tid0 := idle)) ' + sl2, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ARetInsert(lsf0(tid).tid, lsf0(tid).lb));pcf0(tid)) = retInsert, pcf0(tid0) = retInsert, (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ARetInsert(lsf0(tid).tid, lsf0(tid).lb));lsf0(tid)).lb, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0(tid0 := lsf0(tid0)), pcf0(tid0 := idle)) ' + sl2, al), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ARetInsert(lsf0(tid).tid, lsf0(tid).lb));lsf0(tid)).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ARetInsert(lsf0(tid).tid, true));lsf0(tid)).le → ¬ lsf0(tid).lb, ∀ tid1, al1, al2. al0 + ARetInsert(lsf0(tid0).tid, lsf0(tid0).lb) ' + al = al1 + AInvInsert(tid1, (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ARetInsert(lsf0(tid).tid, lsf0(tid).lb));lsf0(tid)).le) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid1, false) ' + al4 ∧ ¬ tid1 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s = mkstate(gstate0, lsf0(tid0 := lsf0(tid0)), pcf0(tid0 := idle)) ∨ s ∈ sl2 ⊦

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ a0 ' + x ↔ a = a0 ∨ a ∈ x; (s) ⊦ a ∈ x + y ↔ a ∈ x ∨ a ∈ y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ ADoInsert(tid, b) ≠ ARetInsert(tid0, b0); (s) ⊦ ls.tid = tid → gstepf(gs, ls, retInsert, ARetInsert(tid, b0)) = gs; (s) ⊦ ls.tid = tid → pcstepf(gs, ls, retInsert, ARetInsert(tid, b0)) = idle; (s) ⊦ ls.tid = tid → lstepf(gs, ls, retInsert, ARetInsert(tid, b0)) = ls; (s) ⊦ pre(gs, ls, retInsert, a) ↔ (∃ b0. a = ARetInsert(ls.tid, b0) ∧ (b0 ↔ ls.lb)); (s)

Proof step 237 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule case distinction

And closed the goal!

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ ls.tid = tid → pcstepf(gs, ls, retInsert, ARetInsert(tid, b0)) = idle; (s) ⊦ idle ≠ retInsert; (s)

Proof step 238 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 239:

  # sl = # al0, # sl1 = # al0, s ' + sl + mkstate(gstate0, lsf0(tid0 := lsf0(tid0)), pcf0(tid0 := idle)) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + mkstate(gstate0, lsf0(tid0 := lsf0(tid0)), pcf0(tid0 := idle)) ' + sl2, (s ' + sl).last = mkstate(gstate0, lsf0, pcf0), (tid0 = tid ⊃ pcstepf(gstate0, lsf0(tid), pcf0(tid), ARetMember(lsf0(tid).tid, lsf0(tid).lb));pcf0(tid)) = retInsert, pcf0(tid0) = retMember, (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ARetMember(lsf0(tid).tid, lsf0(tid).lb));lsf0(tid)).lb, frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0(tid0 := lsf0(tid0)), pcf0(tid0 := idle)) ' + sl2, al), frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ARetMember(lsf0(tid).tid, lsf0(tid).lb));lsf0(tid)).le ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ARetMember(lsf0(tid).tid, true));lsf0(tid)).le → ¬ lsf0(tid).lb, ∀ tid1, al1, al2. al0 + ARetMember(lsf0(tid0).tid, lsf0(tid0).lb) ' + al = al1 + AInvInsert(tid1, (tid0 = tid ⊃ lstepf(gstate0, lsf0(tid), pcf0(tid), ARetMember(lsf0(tid).tid, lsf0(tid).lb));lsf0(tid)).le) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid1, false) ' + al4 ∧ ¬ tid1 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s = mkstate(gstate0, lsf0(tid0 := lsf0(tid0)), pcf0(tid0 := idle)) ∨ s ∈ sl2 ⊦

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ a0 ' + x ↔ a = a0 ∨ a ∈ x; (s) ⊦ a ∈ x + y ↔ a ∈ x ∨ a ∈ y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ ADoInsert(tid, b) ≠ ARetMember(tid0, b0); (s) ⊦ ls.tid = tid → gstepf(gs, ls, retMember, ARetMember(tid, b0)) = gs; (s) ⊦ ls.tid = tid → pcstepf(gs, ls, retMember, ARetMember(tid, b0)) = idle; (s) ⊦ ls.tid = tid → lstepf(gs, ls, retMember, ARetMember(tid, b0)) = ls; (s) ⊦ pre(gs, ls, retMember, a) ↔ (∃ b0. a = ARetMember(ls.tid, b0) ∧ (b0 ↔ ls.lb)); (s)

Proof step 239 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule case distinction

And closed the goal!

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ ls.tid = tid → pcstepf(gs, ls, retMember, ARetMember(tid, b0)) = idle; (s) ⊦ idle ≠ retInsert; (s)

Proof step 240 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 241:

  ⊦ frag*(ioa)(sl, al) ↔ # sl = # al + 1 ∧ (∀ n. n < # al → ioa.step(sl[n], al[n], sl[n +1]))

• Proof step 242:

  #(mkstate(gstate0, lsf0, pcf0) ' + sl0) = #(a ' + al) + 1, # sl = # al0, # sl1 = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), ∀ n. n < #(a ' + al) → IOAut(setInit, setStep, setExt).step((mkstate(gstate0, lsf0, pcf0) ' + sl0)[n], (a ' + al)[n], (mkstate(gstate0, lsf0, pcf0) ' + sl0)[n +1]), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl0 ⊦ (s ' + sl).last = mkstate(gstate0, lsf0, pcf0) ∧ mkstate(gstate, lsf, pcf) = sl0.head, ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used terms: IOAut(setInit, setStep, setExt), mkstate(gstate0, lsf0, pcf0) ' + sl0, a ' + al

Proof step 241 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 242 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 243:

  # sl1 = # al0, # sl = # al0, # sl0 = # al + 1, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), ∀ n. ¬ # al < n → setStep((mkstate(gstate0, lsf0, pcf0) ' + sl0)[n], (a ' + al)[n], sl0[n]), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl0 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb), (s ' + sl).last = mkstate(gstate0, lsf0, pcf0) ∧ mkstate(gstate, lsf, pcf) = sl0.head

Rule argument

Additional information

Used simplifier rules: ⊦ IOAut(start, step, ext).step = step; (s) a: ⊦ (x + y) + z = x + y + z; from specification list c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ (a ' + x)[n + 1] = x[n]; (s) ⊦ m +1 = m + 1; (s) ⊦ m < n + 1 ↔ ¬ n < m; (s) ⊦ #(a ' + x) = (# x)+1; (s) n < n0 ⊦ m + (* n) = m0 + (* n0) ↔ m = m0 + (n0 - n); (s)

Proof step 243 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

• Proof step 244:

  # sl0 = # al + 1, # sl = # al0, # sl1 = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + sl0, sl0 = s0 + sl2, sl0 ≠ [], frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ n. ¬ # al < n → setStep((mkstate(gstate0, lsf0, pcf0) ' + sl0)[n], (a ' + al)[n], sl0[n]), ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s ∈ sl0 ⊦ (s ' + sl).last = mkstate(gstate0, lsf0, pcf0) ∧ mkstate(gstate, lsf, pcf) = s0, ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: ⊦ x + [] = x; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ # [] = 0; (s) ⊦ m + n = 0 ↔ m = 0 ∧ n = 0; (ws) ⊦ # x = 0 ↔ x = []; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic x ≠ [] ⊦ a = x.head ∧ y = x.tail ↔ x = a + y; (elim) Used terms: sl0, s0, sl2

Proof step 244 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 245:

  # sl2 = # al, # sl = # al0, # sl1 = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + s0 ' + sl2, frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ n. ¬ # al < n → setStep((mkstate(gstate0, lsf0, pcf0) ' + s0 ' + sl2)[n], (a ' + al)[n], (s0 ' + sl2)[n]), ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s = s0 ∨ s ∈ sl2 ⊦ (s ' + sl).last = mkstate(gstate0, lsf0, pcf0) ∧ mkstate(gstate, lsf, pcf) = s0, ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ∈ a0 ' + x ↔ a = a0 ∨ a ∈ x; (s) ⊦ a ∈ x + y ↔ a ∈ x ∨ a ∈ y; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ a + x = a ' + x; (s) ⊦ a ' ≠ []; (s) ⊦ x + y = [] ↔ x = [] ∧ y = []; (s) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m + n = m + n0 ↔ n = n0; (s) ⊦ m +1 = m + 1; (s) ⊦ #(a ' + x) = (# x)+1; (s)

Proof step 245 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply rewrite lemma

And obtained the following new goals

• Proof step 246:

  ⊦ y ≠ [] → (x + y).last = y.last

• Proof step 247:

  # sl1 = # al0, # sl = # al0, # sl2 = # al, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + s0 ' + sl2, sl ≠ [], frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), ∀ n. ¬ # al < n → setStep((mkstate(gstate0, lsf0, pcf0) ' + s0 ' + sl2)[n], (a ' + al)[n], (s0 ' + sl2)[n]), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s = s0 ∨ s ∈ sl2 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb), sl.last = mkstate(gstate0, lsf0, pcf0) ∧ mkstate(gstate, lsf, pcf) = s0

Rule argument

Additional information

Used simplifier rules: ⊦ x + [] = x; (s) ⊦ a '.last = a; (s) ⊦ # [] = 0; (s) ⊦ # x = 0 ↔ x = []; (s) ⊦ frag*(IOAut(start, step, ext))(s ', []); (s) ⊦ [] + x = x; (s) ⊦ a ' + x = a0 ' + y ↔ a = a0 ∧ x = y; (ws) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ ¬ a ∈ []; (s) Used terms: s ', sl

Proof step 246 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

A spec-lemma

Proof step 247 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule apply elim lemma

And obtained the following new goals

• Proof step 248:

  # sl2 = # al, # sl = # al0, # sl1 = # al0, s ' + sl + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + s0 ' + sl2, sl = sl0 + s1 ', sl ≠ [], frag*(IOAut(setInit, setStep, setExt))(s ' + sl, al0), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ n. ¬ # al < n → setStep((mkstate(gstate0, lsf0, pcf0) ' + s0 ' + sl2)[n], (a ' + al)[n], (s0 ' + sl2)[n]), ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s = s0 ∨ s ∈ sl2 ⊦ s1 = mkstate(gstate0, lsf0, pcf0) ∧ mkstate(gstate, lsf, pcf) = s0, ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb)

Rule argument

Additional information

Used simplifier rules: x ≠ [] ⊦ a = x.last ∧ y = x.butlast ↔ x = y + a '; (elim) Used terms: sl, s1, sl0

Proof step 248 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

• Proof step 249:

  # sl2 = # al, # sl1 = # al0, s ' + (sl0 + s1 ') + mkstate(gstate, lsf, pcf) ' + sl3 = sl1 + mkstate(gstate0, lsf0, pcf0) ' + s0 ' + sl2, # sl0 + 1 = # al0, frag*(IOAut(setInit, setStep, setExt))(s ' + sl0 + s1 ', al0), setInit(s), ¬ e ∈ gstate0.set, pcf0(tid) = retInsert ∧ lsf0(tid).le = e → ¬ lsf0(tid).lb, ∀ tid0, al1, al2. al0 + a ' + al = al1 + AInvInsert(tid0, e) ' + al2 → (∃ al3, al4. al2 = al3 + ARetInsert(tid0, false) ' + al4 ∧ ¬ tid0 ∈ setExt !(al3).map(.tid)), ∀ n. ¬ # al < n → setStep((mkstate(gstate0, lsf0, pcf0) ' + s0 ' + sl2)[n], (a ' + al)[n], (s0 ' + sl2)[n]), s ∈ sl1 ∨ s = mkstate(gstate0, lsf0, pcf0) ∨ s = s0 ∨ s ∈ sl2 ⊦ ¬ e ∈ gstate.set ∧ (pcf(tid) = retInsert ∧ lsf(tid).le = e → ¬ lsf(tid).lb), s1 = mkstate(gstate0, lsf0, pcf0) ∧ mkstate(gstate, lsf, pcf) = s0

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ' ≠ []; (s) ⊦ x + y = [] ↔ x = [] ∧ y = []; (s) ⊦ # a ' = 0 +1; (s) ⊦ #(x + y) = # x + # y; (s)

Proof step 249 from proof allinserts-finished-false-implies-notin-ind (previous step) (back to tree)

User applied rule constructor cut

And closed the goal!

Rule argument

Additional information

Used simplifier rules: List('a) freely generated by [], +;; ⊦ #(a ' + x) = (# x)+1; (s) ⊦ m +1 = m + 1; (s) ⊦ a + x = a ' + x; (s) ⊦ a ∈ a0 ' + x ↔ a = a0 ∨ a ∈ x; (s) eqs: ⊦ m = n + n0 ∧ m = n + n1 → n0 = n1; (forward) from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic ⊦ # x = # z → (x + y = z + y0 ↔ x = z ∧ y = y0); (ws) ⊦ a ' + x = a0 ' + y ↔ a = a0 ∧ x = y; (ws) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ [] + x = x; (s) ⊦ ¬ a ∈ []; (s) in-14: ⊦ a ' + x = y → a ∈ y; (forward) from specification list ⊦ # [] = 0; (s) ⊦ m + n = 0 ↔ m = 0 ∧ n = 0; (ws) ⊦ # x = 0 ↔ x = []; (s)