Proof step 1 from proof frag-retMem (conclusion) (back to tree)

# sl = # al + 2, SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf), frag*(IOAut(setInit, setStep, setExt))(sl, al + ARetMember(tid, b) ') ⊦ (∃ n. n < # al ∧ al[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al → al[m] ≠ τ ∧ al[m].tid ≠ tid)) ∨ (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < # al → al[m] ≠ τ ∧ al[m].tid ≠ tid)

System applied rule normalize

And obtained the following new goals

Proof step 2:
# sl = # al + 2, SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf), frag*(IOAut(setInit, setStep, setExt))(sl, al + ARetMember(tid, b) ') ⊦ ∃ n. n < # al ∧ al[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al → al[m] ≠ τ ∧ al[m].tid ≠ tid), (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < # al → al[m] ≠ τ ∧ al[m].tid ≠ tid)

Rule argument

Additional information

Proof step 2 from proof frag-retMem (previous step) (back to tree)

# sl = # al + 2, SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf), frag*(IOAut(setInit, setStep, setExt))(sl, al + ARetMember(tid, b) ') ⊦ ∃ n. n < # al ∧ al[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al → al[m] ≠ τ ∧ al[m].tid ≠ tid), (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < # al → al[m] ≠ τ ∧ al[m].tid ≠ tid)

User applied rule structural induction

And obtained the following new goals

Proof step 3:
# sl = # [] + 2, SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf), frag*(IOAut(setInit, setStep, setExt))(sl, [] + ARetMember(tid, b) ') ⊦ ∃ n. n < # [] ∧ [][n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # [] → [][m] ≠ τ ∧ [][m].tid ≠ tid), (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < # [] → [][m] ≠ τ ∧ [][m].tid ≠ tid)
Proof step 16:
# sl = #(a + al0) + 2, SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf), frag*(IOAut(setInit, setStep, setExt))(sl, (a + al0) + ARetMember(tid, b) '), ∀ sl, tid, b. # sl = # al0 + 2 ∧ SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf) ∧ frag*(IOAut(setInit, setStep, setExt))(sl, al0 + ARetMember(tid, b) ') → (∃ n. n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid)) ∨ (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. n < #(a + al0) ∧ (a + al0)[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < #(a + al0) → (a + al0)[m] ≠ τ ∧ (a + al0)[m].tid ≠ tid), (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < #(a + al0) → (a + al0)[m] ≠ τ ∧ (a + al0)[m].tid ≠ tid)

Rule argument

term: al

Additional information

Used simplifier rules: List('a) freely generated by [], +;;

Proof step 3 from proof frag-retMem (previous step) (back to tree)

# sl = # [] + 2, SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf), frag*(IOAut(setInit, setStep, setExt))(sl, [] + ARetMember(tid, b) ') ⊦ ∃ n. n < # [] ∧ [][n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # [] → [][m] ≠ τ ∧ [][m].tid ≠ tid), (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < # [] → [][m] ≠ τ ∧ [][m].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 4:
# sl = 2, SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf), frag*(IOAut(setInit, setStep, setExt))(sl, ARetMember(tid, b) ') ⊦ (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember

Rule argument

Additional information

Used simplifier rules: ⊦ ¬ n < 0; (s) ⊦ # [] = 0; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ [] + x = x; (s) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic

Proof step 4 from proof frag-retMem (previous step) (back to tree)

# sl = 2, SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf), frag*(IOAut(setInit, setStep, setExt))(sl, ARetMember(tid, b) ') ⊦ (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 5:
# sl = 2, sl = s + sl0, sl ≠ [], SetInv(s.gstate, s.lsf, s.pcf), frag*(IOAut(setInit, setStep, setExt))(sl, ARetMember(tid, b) ') ⊦ (b ↔ s.lsf(tid).lb) ∧ s.pcf(tid) = retMember

Rule argument

spec: list-data, name:elim-list-c, seq:x ≠ [] ⊦ a = x.head ∧ y = x.tail ↔ x = a + y, subst:[x, a, y] → [sl, s, sl0]; ['a] → [SetState]

Additional information

Used simplifier rules: ⊦ # [] = 0; (s) x ≠ [] ⊦ a = x.head ∧ y = x.tail ↔ x = a + y; (elim) Used terms: sl, s, sl0

Proof step 5 from proof frag-retMem (previous step) (back to tree)

# sl = 2, sl = s + sl0, sl ≠ [], SetInv(s.gstate, s.lsf, s.pcf), frag*(IOAut(setInit, setStep, setExt))(sl, ARetMember(tid, b) ') ⊦ (b ↔ s.lsf(tid).lb) ∧ s.pcf(tid) = retMember

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 6:
sl0.tail = [], sl0 = sl0.head ', sl0 ≠ [], SetInv(s.gstate, s.lsf, s.pcf), setStep(s, ARetMember(tid, b), sl0.head) ⊦ (b ↔ s.lsf(tid).lb) ∧ s.pcf(tid) = retMember

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ frag*(IOAut(start, step, ext))(s ' + sl, a ') ↔ step(s, a, sl.head) ∧ sl ≠ [] ∧ sl.tail = []; (s) ⊦ a + x = a ' + x; (s) ⊦ a ' ≠ []; (s) ⊦ x + y = [] ↔ x = [] ∧ y = []; (s) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ x + [] = x; (s) ⊦ # x = 1 ↔ x = x.head + []; (as) n0 < n ⊦ (* n) = m0 + (* n0) ↔ n - n0 = m0; (s) ⊦ m +1 = m + 1; (s) ⊦ #(a ' + x) = (# x)+1; (s)

Proof step 6 from proof frag-retMem (previous step) (back to tree)

sl0.tail = [], sl0 = sl0.head ', sl0 ≠ [], SetInv(s.gstate, s.lsf, s.pcf), setStep(s, ARetMember(tid, b), sl0.head) ⊦ (b ↔ s.lsf(tid).lb) ∧ s.pcf(tid) = retMember

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 7:
sl = [], sl0 = s0 ', sl0 = s0 + sl, sl0 ≠ [], SetInv(s.gstate, s.lsf, s.pcf), setStep(s, ARetMember(tid, b), s0) ⊦ (b ↔ s.lsf(tid).lb) ∧ s.pcf(tid) = retMember

Rule argument

spec: list-data, name:elim-list-c, seq:x ≠ [] ⊦ a = x.head ∧ y = x.tail ↔ x = a + y, subst:[x, a, y] → [sl0, s0, sl]; ['a] → [SetState]

Additional information

Used simplifier rules: x ≠ [] ⊦ a = x.head ∧ y = x.tail ↔ x = a + y; (elim) Used terms: sl0, s0, sl

Proof step 7 from proof frag-retMem (previous step) (back to tree)

sl = [], sl0 = s0 ', sl0 = s0 + sl, sl0 ≠ [], SetInv(s.gstate, s.lsf, s.pcf), setStep(s, ARetMember(tid, b), s0) ⊦ (b ↔ s.lsf(tid).lb) ∧ s.pcf(tid) = retMember

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 8:
SetInv(s.gstate, s.lsf, s.pcf), setStep(s, ARetMember(tid, b), s0) ⊦ (b ↔ s.lsf(tid).lb) ∧ s.pcf(tid) = retMember

Rule argument

Additional information

Used simplifier rules: ⊦ a ' ≠ []; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ x + [] = x; (s) ⊦ a + x = a ' + x; (s) ⊦ a ' = a0 ' ↔ a = a0; (s)

Proof step 8 from proof frag-retMem (previous step) (back to tree)

SetInv(s.gstate, s.lsf, s.pcf), setStep(s, ARetMember(tid, b), s0) ⊦ (b ↔ s.lsf(tid).lb) ∧ s.pcf(tid) = retMember

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 9:
s = mkstate(gstate, lsf, pcf), SetInv(gstate, lsf, pcf), setStep(s, ARetMember(tid, b), s0) ⊦ (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember

Rule argument

spec: Set, name:elim-mkstate, seq: ⊦ (gstate = s.gstate ∧ lsf = s.lsf) ∧ pcf = s.pcf ↔ s = mkstate(gstate, lsf, pcf), subst:[s, gstate, lsf, pcf] → [s, gstate, lsf, pcf]

Additional information

Used simplifier rules: ⊦ (gstate = s.gstate ∧ lsf = s.lsf) ∧ pcf = s.pcf ↔ s = mkstate(gstate, lsf, pcf); (elim) Used terms: s, gstate, lsf, pcf

Proof step 9 from proof frag-retMem (previous step) (back to tree)

s = mkstate(gstate, lsf, pcf), SetInv(gstate, lsf, pcf), setStep(s, ARetMember(tid, b), s0) ⊦ (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 10:
SetInv(gstate, lsf, pcf), setStep(mkstate(gstate, lsf, pcf), ARetMember(tid, b), s0) ⊦ (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember

Rule argument

Additional information

Proof step 10 from proof frag-retMem (previous step) (back to tree)

SetInv(gstate, lsf, pcf), setStep(mkstate(gstate, lsf, pcf), ARetMember(tid, b), s0) ⊦ (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember

User applied rule constructor cut

And obtained the following new goals

Proof step 11:
s0 = mkstate(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), setStep(mkstate(gstate, lsf, pcf), ARetMember(tid, b), s0) ⊦ (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember

Rule argument

var: s0

Additional information

Used simplifier rules: SetState freely generated by mkstate;;

Proof step 11 from proof frag-retMem (previous step) (back to tree)

s0 = mkstate(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), setStep(mkstate(gstate, lsf, pcf), ARetMember(tid, b), s0) ⊦ (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 12:
SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), setStep(mkstate(gstate, lsf, pcf), ARetMember(tid, b), mkstate(gstate0, lsf0, pcf0)) ⊦ (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember

Rule argument

Additional information

Used simplifier rules: SetInv-thm: ⊦ SetInv(gs, lsf, pcf) ∧ setStep(mkstate(gs, lsf, pcf), a, mkstate(gs0, lsf0, pcf0)) → SetInv(gs0, lsf0, pcf0); (forward) from specification Set-proofs

Proof step 12 from proof frag-retMem (previous step) (back to tree)

SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), setStep(mkstate(gstate, lsf, pcf), ARetMember(tid, b), mkstate(gstate0, lsf0, pcf0)) ⊦ (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 13:
⊦ setStep(mkstate(gs, lsf, pcf), a, mkstate(gs0, lsf0, pcf0)) ↔ (∃ tid, ls, pc. lstep(gs, lsf(tid), pcf(tid), a, gs0, ls, pc) ∧ lsf0 = lsf(tid := ls) ∧ pcf0 = pcf(tid := pc))
Proof step 14:
SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), ∃ tid0, ls, pc. lstep(gstate, lsf(tid0), pcf(tid0), ARetMember(tid, b), gstate0, ls, pc) ∧ lsf0 = lsf(tid0 := ls) ∧ pcf0 = pcf(tid0 := pc) ⊦ (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember

Rule argument

spec: Set, name:setStep, seq:⊦ setStep(mkstate(gs, lsf, pcf), a, mkstate(gs0, lsf0, pcf0)) ↔ (∃ tid, ls, pc. lstep(gs, lsf(tid), pcf(tid), a, gs0, ls, pc) ∧ lsf0 = lsf(tid := ls) ∧ pcf0 = pcf(tid := pc)), subst:[lsf, pcf, pcf0, lsf0, gs0, gs, a] → [lsf, pcf, pcf0, lsf0, gstate0, gstate, ARetMember(tid, b)], <all paths>

Additional information

Used terms: lsf, pcf, pcf0, lsf0, gstate0, gstate, ARetMember(tid, b)

Proof step 13 from proof frag-retMem (previous step) (back to tree)

⊦ setStep(mkstate(gs, lsf, pcf), a, mkstate(gs0, lsf0, pcf0)) ↔ (∃ tid, ls, pc. lstep(gs, lsf(tid), pcf(tid), a, gs0, ls, pc) ∧ lsf0 = lsf(tid := ls) ∧ pcf0 = pcf(tid := pc))

A spec-lemma

Proof step 14 from proof frag-retMem (previous step) (back to tree)

SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), ∃ tid0, ls, pc. lstep(gstate, lsf(tid0), pcf(tid0), ARetMember(tid, b), gstate0, ls, pc) ∧ lsf0 = lsf(tid0 := ls) ∧ pcf0 = pcf(tid0 := pc) ⊦ (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 15:
SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), ARetMember(tid, b)), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), ARetMember(tid, b))), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), ARetMember(tid, b)))), SetInv(gstate, lsf, pcf), pre(gstate, lsf(tid0), pcf(tid0), ARetMember(tid, b)) ⊦ (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember

Rule argument

Additional information

Used simplifier rules: ⊦ lstep(gs, ls, pc, a, gs0, ls0, pc0) ↔ pre(gs, ls, pc, a) ∧ ls0 = lstepf(gs, ls, pc, a) ∧ gs0 = gstepf(gs, ls, pc, a) ∧ pc0 = pcstepf(gs, ls, pc, a); (s)

Proof step 15 from proof frag-retMem (previous step) (back to tree)

SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), ARetMember(tid, b)), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), ARetMember(tid, b))), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), ARetMember(tid, b)))), SetInv(gstate, lsf, pcf), pre(gstate, lsf(tid0), pcf(tid0), ARetMember(tid, b)) ⊦ (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember

User applied rule constructor cut

And closed the goal!

Rule argument

term: pcf(tid0)

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; SetPC freely generated by idle, invInsert, invMember, retInsert, retMember;; ⊦ pre(gs, ls, retMember, a) ↔ (∃ b0. a = ARetMember(ls.tid, b0) ∧ (b0 ↔ ls.lb)); (s) ⊦ ARetMember(tid, b) = ARetMember(tid0, b0) ↔ tid = tid0 ∧ (b ↔ b0); (ws) ⊦ pre(gs, ls, retInsert, a) ↔ (∃ b0. a = ARetInsert(ls.tid, b0) ∧ (b0 ↔ ls.lb)); (s) ⊦ ARetInsert(tid, b) ≠ ARetMember(tid0, b0); (s) ⊦ pre(gs, ls, invMember, a) ↔ a = ADoMember(ls.tid); (s) ⊦ ADoMember(tid) ≠ ARetMember(tid0, b); (s) ⊦ pre(gs, ls, invInsert, a) ↔ (∃ b. a = ADoInsert(ls.tid, b)); (s) ⊦ ADoInsert(tid, b) ≠ ARetMember(tid0, b0); (s) ⊦ gstepf(gs, ls, idle, a) = gs; (s) ⊦ pre(gs, ls, idle, a) ↔ (∃ e. a = AInvInsert(ls.tid, e) ∧ e ≠ ⊥) ∨ (∃ e. a = AInvMember(ls.tid, e) ∧ e ≠ ⊥); (s) ⊦ AInvInsert(tid, e) ≠ ARetMember(tid0, b); (s) ⊦ AInvMember(tid, e) ≠ ARetMember(tid0, b); (s)

Proof step 16 from proof frag-retMem (previous step) (back to tree)

# sl = #(a + al0) + 2, SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf), frag*(IOAut(setInit, setStep, setExt))(sl, (a + al0) + ARetMember(tid, b) '), ∀ sl, tid, b. # sl = # al0 + 2 ∧ SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf) ∧ frag*(IOAut(setInit, setStep, setExt))(sl, al0 + ARetMember(tid, b) ') → (∃ n. n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid)) ∨ (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. n < #(a + al0) ∧ (a + al0)[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < #(a + al0) → (a + al0)[m] ≠ τ ∧ (a + al0)[m].tid ≠ tid), (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < #(a + al0) → (a + al0)[m] ≠ τ ∧ (a + al0)[m].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 17:
# sl = 3 + # al0, SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf), frag*(IOAut(setInit, setStep, setExt))(sl, (a ' + al0) + ARetMember(tid, b) '), ∀ sl, tid, b. # sl = # al0 + 2 ∧ SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf) ∧ frag*(IOAut(setInit, setStep, setExt))(sl, al0 + ARetMember(tid, b) ') → (∃ n. n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid)) ∨ (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

Additional information

Used simplifier rules: ⊦ a + x = a ' + x; (s) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m < n + 1 ↔ ¬ n < m; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ m +1 = m + 1; (s) ⊦ #(a ' + x) = (# x)+1; (s)

Proof step 17 from proof frag-retMem (previous step) (back to tree)

# sl = 3 + # al0, SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf), frag*(IOAut(setInit, setStep, setExt))(sl, (a ' + al0) + ARetMember(tid, b) '), ∀ sl, tid, b. # sl = # al0 + 2 ∧ SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf) ∧ frag*(IOAut(setInit, setStep, setExt))(sl, al0 + ARetMember(tid, b) ') → (∃ n. n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid)) ∨ (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 18:
# sl = 3 + # al0, sl = s + sl0, sl ≠ [], SetInv(s.gstate, s.lsf, s.pcf), frag*(IOAut(setInit, setStep, setExt))(sl, (a ' + al0) + ARetMember(tid, b) '), ∀ sl, tid, b. # sl = # al0 + 2 ∧ SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf) ∧ frag*(IOAut(setInit, setStep, setExt))(sl, al0 + ARetMember(tid, b) ') → (∃ n. n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid)) ∨ (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ s.lsf(tid).lb) ∧ s.pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

spec: list-data, name:elim-list-c, seq:x ≠ [] ⊦ a = x.head ∧ y = x.tail ↔ x = a + y, subst:[x, a, y] → [sl, s, sl0]; ['a] → [SetState]

Additional information

Used simplifier rules: ⊦ # [] = 0; (s) ⊦ m + n = 0 ↔ m = 0 ∧ n = 0; (ws) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic x ≠ [] ⊦ a = x.head ∧ y = x.tail ↔ x = a + y; (elim) Used terms: sl, s, sl0

Proof step 18 from proof frag-retMem (previous step) (back to tree)

# sl = 3 + # al0, sl = s + sl0, sl ≠ [], SetInv(s.gstate, s.lsf, s.pcf), frag*(IOAut(setInit, setStep, setExt))(sl, (a ' + al0) + ARetMember(tid, b) '), ∀ sl, tid, b. # sl = # al0 + 2 ∧ SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf) ∧ frag*(IOAut(setInit, setStep, setExt))(sl, al0 + ARetMember(tid, b) ') → (∃ n. n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid)) ∨ (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ s.lsf(tid).lb) ∧ s.pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 19:
# sl0 = # al0 + 2, SetInv(s.gstate, s.lsf, s.pcf), frag*(IOAut(setInit, setStep, setExt))(s ' + sl0, (a ' + al0) + ARetMember(tid, b) '), ∀ sl, tid, b. # sl = # sl0 ∧ SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf) ∧ frag*(IOAut(setInit, setStep, setExt))(sl, al0 + ARetMember(tid, b) ') → (∃ n. n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid)) ∨ (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ (b ↔ (s ' + sl0)[n].lsf(tid).le ∈ (s ' + sl0)[n].gstate.set) ∧ (s ' + sl0)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ s.lsf(tid).lb) ∧ s.pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

Additional information

Used simplifier rules: ⊦ a + x = a ' + x; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a ' ≠ []; (s) ⊦ x + y = [] ↔ x = [] ∧ y = []; (s) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic n < n0 ⊦ m + (* n) = m0 + (* n0) ↔ m = m0 + (n0 - n); (s) ⊦ m +1 = m + 1; (s) ⊦ #(a ' + x) = (# x)+1; (s)

Proof step 19 from proof frag-retMem (previous step) (back to tree)

# sl0 = # al0 + 2, SetInv(s.gstate, s.lsf, s.pcf), frag*(IOAut(setInit, setStep, setExt))(s ' + sl0, (a ' + al0) + ARetMember(tid, b) '), ∀ sl, tid, b. # sl = # sl0 ∧ SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf) ∧ frag*(IOAut(setInit, setStep, setExt))(sl, al0 + ARetMember(tid, b) ') → (∃ n. n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid)) ∨ (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ (b ↔ (s ' + sl0)[n].lsf(tid).le ∈ (s ' + sl0)[n].gstate.set) ∧ (s ' + sl0)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ s.lsf(tid).lb) ∧ s.pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 20:
# sl0 = # al0 + 2, s = mkstate(gstate, lsf, pcf), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(s ' + sl0, (a ' + al0) + ARetMember(tid, b) '), ∀ sl, tid, b. # sl = # sl0 ∧ SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf) ∧ frag*(IOAut(setInit, setStep, setExt))(sl, al0 + ARetMember(tid, b) ') → (∃ n. n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid)) ∨ (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ (b ↔ (s ' + sl0)[n].lsf(tid).le ∈ (s ' + sl0)[n].gstate.set) ∧ (s ' + sl0)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

spec: Set, name:elim-mkstate, seq: ⊦ (gstate = s.gstate ∧ lsf = s.lsf) ∧ pcf = s.pcf ↔ s = mkstate(gstate, lsf, pcf), subst:[s, gstate, lsf, pcf] → [s, gstate, lsf, pcf]

Additional information

Used simplifier rules: ⊦ (gstate = s.gstate ∧ lsf = s.lsf) ∧ pcf = s.pcf ↔ s = mkstate(gstate, lsf, pcf); (elim) Used terms: s, gstate, lsf, pcf

Proof step 20 from proof frag-retMem (previous step) (back to tree)

# sl0 = # al0 + 2, s = mkstate(gstate, lsf, pcf), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(s ' + sl0, (a ' + al0) + ARetMember(tid, b) '), ∀ sl, tid, b. # sl = # sl0 ∧ SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf) ∧ frag*(IOAut(setInit, setStep, setExt))(sl, al0 + ARetMember(tid, b) ') → (∃ n. n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid)) ∨ (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ (b ↔ (s ' + sl0)[n].lsf(tid).le ∈ (s ' + sl0)[n].gstate.set) ∧ (s ' + sl0)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 21:
# sl0 = # al0 + 2, SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl0, (a ' + al0) + ARetMember(tid, b) '), ∀ sl, tid, b. # sl = # sl0 ∧ SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf) ∧ frag*(IOAut(setInit, setStep, setExt))(sl, al0 + ARetMember(tid, b) ') → (∃ n. n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid)) ∨ (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ (b ↔ (mkstate(gstate, lsf, pcf) ' + sl0)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + sl0)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + sl0)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

Additional information

Proof step 21 from proof frag-retMem (previous step) (back to tree)

# sl0 = # al0 + 2, SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate, lsf, pcf) ' + sl0, (a ' + al0) + ARetMember(tid, b) '), ∀ sl, tid, b. # sl = # sl0 ∧ SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf) ∧ frag*(IOAut(setInit, setStep, setExt))(sl, al0 + ARetMember(tid, b) ') → (∃ n. n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid)) ∨ (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ (b ↔ (mkstate(gstate, lsf, pcf) ' + sl0)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + sl0)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + sl0)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 22:
⊦ frag*(IOAut(start, step, ext))(s ' + sl, a ' + al) ↔ step(s, a, sl.head) ∧ frag*(IOAut(start, step, ext))(sl, al)
Proof step 23:
# sl0 = # al0 + 2, SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(sl0, al0 + ARetMember(tid, b) '), setStep(mkstate(gstate, lsf, pcf), a, sl0.head), ∀ sl, tid, b. # sl = # sl0 ∧ SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf) ∧ frag*(IOAut(setInit, setStep, setExt))(sl, al0 + ARetMember(tid, b) ') → (∃ n. n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid)) ∨ (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ (b ↔ (mkstate(gstate, lsf, pcf) ' + sl0)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + sl0)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + sl0)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

spec: IOtrace, name:finfrag-rec, seq:⊦ frag*(IOAut(start, step, ext))(s ' + sl, a ' + al) ↔ step(s, a, sl.head) ∧ frag*(IOAut(start, step, ext))(sl, al), subst:[al, s, ext, sl, a, start, step] → [al0 + ARetMember(tid, b) ', mkstate(gstate, lsf, pcf), setExt, sl0, a, setInit, setStep]; ['s, 'a, 'e] → [SetState, SetAction, EAction], <all paths>

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list Used terms: al0 + ARetMember(tid, b) ', mkstate(gstate, lsf, pcf), setExt, sl0, a, setInit, setStep

Proof step 22 from proof frag-retMem (previous step) (back to tree)

⊦ frag*(IOAut(start, step, ext))(s ' + sl, a ' + al) ↔ step(s, a, sl.head) ∧ frag*(IOAut(start, step, ext))(sl, al)

A spec-lemma

Proof step 23 from proof frag-retMem (previous step) (back to tree)

# sl0 = # al0 + 2, SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(sl0, al0 + ARetMember(tid, b) '), setStep(mkstate(gstate, lsf, pcf), a, sl0.head), ∀ sl, tid, b. # sl = # sl0 ∧ SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf) ∧ frag*(IOAut(setInit, setStep, setExt))(sl, al0 + ARetMember(tid, b) ') → (∃ n. n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid)) ∨ (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ (b ↔ (mkstate(gstate, lsf, pcf) ' + sl0)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + sl0)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + sl0)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 24:
# sl0 = # al0 + 2, sl0 = s + sl1, sl0 ≠ [], SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(sl0, al0 + ARetMember(tid, b) '), setStep(mkstate(gstate, lsf, pcf), a, s), ∀ sl, tid, b. # sl = # sl0 ∧ SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf) ∧ frag*(IOAut(setInit, setStep, setExt))(sl, al0 + ARetMember(tid, b) ') → (∃ n. n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid)) ∨ (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ (b ↔ (mkstate(gstate, lsf, pcf) ' + sl0)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + sl0)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + sl0)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

spec: list-data, name:elim-list-c, seq:x ≠ [] ⊦ a = x.head ∧ y = x.tail ↔ x = a + y, subst:[x, a, y] → [sl0, s, sl1]; ['a] → [SetState]

Additional information

Used simplifier rules: ⊦ # [] = 0; (s) ⊦ m + n = 0 ↔ m = 0 ∧ n = 0; (ws) ⊦ # x = 0 ↔ x = []; (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic x ≠ [] ⊦ a = x.head ∧ y = x.tail ↔ x = a + y; (elim) Used terms: sl0, s, sl1

Proof step 24 from proof frag-retMem (previous step) (back to tree)

# sl0 = # al0 + 2, sl0 = s + sl1, sl0 ≠ [], SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(sl0, al0 + ARetMember(tid, b) '), setStep(mkstate(gstate, lsf, pcf), a, s), ∀ sl, tid, b. # sl = # sl0 ∧ SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf) ∧ frag*(IOAut(setInit, setStep, setExt))(sl, al0 + ARetMember(tid, b) ') → (∃ n. n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ sl[n].lsf(tid).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid)) ∨ (b ↔ sl.head.lsf(tid).lb) ∧ sl.head.pcf(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ (b ↔ (mkstate(gstate, lsf, pcf) ' + sl0)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + sl0)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + sl0)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 25:
# sl1 = # al0 + 1, SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al0 + ARetMember(tid, b) '), setStep(mkstate(gstate, lsf, pcf), a, s), ∀ sl, tid0, b0. # sl = # sl1 + 1 ∧ SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf) ∧ frag*(IOAut(setInit, setStep, setExt))(sl, al0 + ARetMember(tid0, b0) ') → (∃ n. n < # al0 ∧ al0[n] = ADoMember(tid0) ∧ (b0 ↔ sl[n].lsf(tid0).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid0) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0)) ∨ (b0 ↔ sl.head.lsf(tid0).lb) ∧ sl.head.pcf(tid0) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ (b ↔ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ a + x = a ' + x; (s) ⊦ m +1 = m + 1; (s) ⊦ #(a ' + x) = (# x)+1; (s) ⊦ a ' ≠ []; (s) ⊦ x + y = [] ↔ x = [] ∧ y = []; (s) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic n < n0 ⊦ m + (* n) = m0 + (* n0) ↔ m = m0 + (n0 - n); (s)

Proof step 25 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al0 + ARetMember(tid, b) '), setStep(mkstate(gstate, lsf, pcf), a, s), ∀ sl, tid0, b0. # sl = # sl1 + 1 ∧ SetInv(sl.head.gstate, sl.head.lsf, sl.head.pcf) ∧ frag*(IOAut(setInit, setStep, setExt))(sl, al0 + ARetMember(tid0, b0) ') → (∃ n. n < # al0 ∧ al0[n] = ADoMember(tid0) ∧ (b0 ↔ sl[n].lsf(tid0).le ∈ sl[n].gstate.set) ∧ sl[n].pcf(tid0) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0)) ∨ (b0 ↔ sl.head.lsf(tid0).lb) ∧ sl.head.pcf(tid0) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid0) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ (b ↔ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

User applied rule all left

And obtained the following new goals

Proof step 26:
# sl1 = # al0 + 1, SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al0 + ARetMember(tid, b) '), setStep(mkstate(gstate, lsf, pcf), a, s), #(s ' + sl1) = # sl1 + 1 ∧ SetInv((s ' + sl1).head.gstate, (s ' + sl1).head.lsf, (s ' + sl1).head.pcf) ∧ frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al0 + ARetMember(tid, b) ') → (∃ n. n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ (s ' + sl1)[n].lsf(tid).le ∈ (s ' + sl1)[n].gstate.set) ∧ (s ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid)) ∨ (b ↔ (s ' + sl1).head.lsf(tid).lb) ∧ (s ' + sl1).head.pcf(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ (b ↔ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

pos: left 5 terms: s ' + sl1, tid, b abort: F discard: T computed: T

Additional information

Used terms: s ' + sl1, tid, b

Proof step 26 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al0 + ARetMember(tid, b) '), setStep(mkstate(gstate, lsf, pcf), a, s), #(s ' + sl1) = # sl1 + 1 ∧ SetInv((s ' + sl1).head.gstate, (s ' + sl1).head.lsf, (s ' + sl1).head.pcf) ∧ frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al0 + ARetMember(tid, b) ') → (∃ n. n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ (s ' + sl1)[n].lsf(tid).le ∈ (s ' + sl1)[n].gstate.set) ∧ (s ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid)) ∨ (b ↔ (s ' + sl1).head.lsf(tid).lb) ∧ (s ' + sl1).head.pcf(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ (b ↔ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 27:
# sl1 = # al0 + 1, SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al0 + ARetMember(tid, b) '), setStep(mkstate(gstate, lsf, pcf), a, s), SetInv(s.gstate, s.lsf, s.pcf) → n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ (s ' + sl1)[n].lsf(tid).le ∈ (s ' + sl1)[n].gstate.set) ∧ (s ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ∨ (b ↔ s.lsf(tid).lb) ∧ s.pcf(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ (b ↔ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ (a ' + x).head = a; (s) c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m + n = m + n0 ↔ n = n0; (s) ⊦ m +1 = m + 1; (s) ⊦ #(a ' + x) = (# x)+1; (s)

Proof step 27 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al0 + ARetMember(tid, b) '), setStep(mkstate(gstate, lsf, pcf), a, s), SetInv(s.gstate, s.lsf, s.pcf) → n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ (s ' + sl1)[n].lsf(tid).le ∈ (s ' + sl1)[n].gstate.set) ∧ (s ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ∨ (b ↔ s.lsf(tid).lb) ∧ s.pcf(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ (b ↔ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 28:
# sl1 = # al0 + 1, s = mkstate(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al0 + ARetMember(tid, b) '), setStep(mkstate(gstate, lsf, pcf), a, s), SetInv(gstate0, lsf0, pcf0) → n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ (s ' + sl1)[n].lsf(tid).le ∈ (s ' + sl1)[n].gstate.set) ∧ (s ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ∨ (b ↔ lsf0(tid).lb) ∧ pcf0(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ (b ↔ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

spec: Set, name:elim-mkstate, seq: ⊦ (gstate = s.gstate ∧ lsf = s.lsf) ∧ pcf = s.pcf ↔ s = mkstate(gstate, lsf, pcf), subst:[s, gstate, lsf, pcf] → [s, gstate0, lsf0, pcf0]

Additional information

Used simplifier rules: ⊦ (gstate = s.gstate ∧ lsf = s.lsf) ∧ pcf = s.pcf ↔ s = mkstate(gstate, lsf, pcf); (elim) Used terms: s, gstate0, lsf0, pcf0

Proof step 28 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, s = mkstate(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(s ' + sl1, al0 + ARetMember(tid, b) '), setStep(mkstate(gstate, lsf, pcf), a, s), SetInv(gstate0, lsf0, pcf0) → n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ (s ' + sl1)[n].lsf(tid).le ∈ (s ' + sl1)[n].gstate.set) ∧ (s ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ∨ (b ↔ lsf0(tid).lb) ∧ pcf0(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ (b ↔ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + s ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 29:
# sl1 = # al0 + 1, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, b) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ∨ (b ↔ lsf0(tid).lb) ∧ pcf0(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( b ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

Additional information

Used simplifier rules: SetInv-thm: ⊦ SetInv(gs, lsf, pcf) ∧ setStep(mkstate(gs, lsf, pcf), a, mkstate(gs0, lsf0, pcf0)) → SetInv(gs0, lsf0, pcf0); (forward) from specification Set-proofs

Proof step 29 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, b) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ∨ (b ↔ lsf0(tid).lb) ∧ pcf0(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( b ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 30:
# sl1 = # al0 + 1, (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, b) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ∨ (b ↔ lsf0(tid).lb) ∧ pcf0(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( b ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

spec: Set, name:elim-mkstate, seq: ⊦ (gstate = s.gstate ∧ lsf = s.lsf) ∧ pcf = s.pcf ↔ s = mkstate(gstate, lsf, pcf), subst:[s, gstate, lsf, pcf] → [(mkstate(gstate0, lsf0, pcf0) ' + sl1)[n], gstate1, lsf1, pcf1]

Additional information

Used simplifier rules: ⊦ (gstate = s.gstate ∧ lsf = s.lsf) ∧ pcf = s.pcf ↔ s = mkstate(gstate, lsf, pcf); (elim) Used terms: (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n], gstate1, lsf1, pcf1

Proof step 30 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, b) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (b ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ∨ (b ↔ lsf0(tid).lb) ∧ pcf0(tid) = retMember ∧ (∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( b ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

User applied rule case distinction

And obtained the following new goals

Proof step 31:
# sl1 = # al0 + 1, b ↔ lsf1(tid).le ∈ gstate1.set, (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), al0[n] = ADoMember(tid), pcf1(tid) = invMember, n < # al0, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, b) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( b ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)
Proof step 40:
# sl1 = # al0 + 1, b ↔ lsf0(tid).lb, (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf0(tid) = retMember, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, b) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( b ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

pos: left 7

Additional information

Proof step 31 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, b ↔ lsf1(tid).le ∈ gstate1.set, (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), al0[n] = ADoMember(tid), pcf1(tid) = invMember, n < # al0, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, b) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( b ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 32:
# sl1 = # al0 + 1, (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), al0[n] = ADoMember(tid), pcf1(tid) = invMember, al0 ≠ [], n < # al0, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, lsf1(tid).le ∈ gstate1.set) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( lsf1(tid).le ∈ gstate1.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lsf1(tid).le ∈ gstate1.set ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

Additional information

Used simplifier rules: ⊦ # x = 0 ↔ x = []; (s) f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic

Proof step 32 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), al0[n] = ADoMember(tid), pcf1(tid) = invMember, al0 ≠ [], n < # al0, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, lsf1(tid).le ∈ gstate1.set) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( lsf1(tid).le ∈ gstate1.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lsf1(tid).le ∈ gstate1.set ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

User applied rule exists right

And obtained the following new goals

Proof step 33:
# sl1 = # al0 + 1, al0[n] = ADoMember(tid), (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf1(tid) = invMember, al0 ≠ [], n < # al0, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, lsf1(tid).le ∈ gstate1.set) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( lsf1(tid).le ∈ gstate1.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lsf1(tid).le ∈ gstate1.set ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid), ¬ # al0 < n + 1 ∧ (a ' + al0)[n + 1] = ADoMember(tid) ∧ ( lsf1(tid).le ∈ gstate1.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n + 1].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n + 1].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n + 1].pcf(tid) = invMember ∧ (∀ m0. n + 1 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid)

Rule argument

pos: right 1 terms: n + 1 abort: F discard: F computed: F

Additional information

Used terms: n + 1

Proof step 33 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, al0[n] = ADoMember(tid), (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf1(tid) = invMember, al0 ≠ [], n < # al0, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, lsf1(tid).le ∈ gstate1.set) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( lsf1(tid).le ∈ gstate1.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lsf1(tid).le ∈ gstate1.set ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid), ¬ # al0 < n + 1 ∧ (a ' + al0)[n + 1] = ADoMember(tid) ∧ ( lsf1(tid).le ∈ gstate1.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n + 1].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n + 1].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n + 1].pcf(tid) = invMember ∧ (∀ m0. n + 1 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 34:
# sl1 = # al0 + 1, (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), al0[n] = ADoMember(tid), pcf1(tid) = invMember, al0 ≠ [], n + 1 < # al0, n + 1 < m0, n < # al0, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, lsf1(tid).le ∈ gstate1.set) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), m0 ≤ # al0, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( lsf1(tid).le ∈ gstate1.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid, (lsf1(tid).le ∈ gstate1.set ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

Additional information

Used simplifier rules: ⊦ m < n → n ≠ 0; (s) fle: ⊦ m < n ∧ n ≤ n0 → m < n0; (forward) from specification nat f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic ⊦ m < n ↔ ¬ n ≤ m; (ss) ⊦ mkstate(gstate, lsf, pcf).pcf = pcf; (s) ⊦ mkstate(gstate, lsf, pcf).gstate = gstate; (s) ⊦ mkstate(gstate, lsf, pcf).lsf = lsf; (s) a: ⊦ (x + y) + z = x + y + z; from specification list c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ (a ' + x)[n + 1] = x[n]; (s) ⊦ m < n + 1 ↔ ¬ n < m; (s)

Proof step 34 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), al0[n] = ADoMember(tid), pcf1(tid) = invMember, al0 ≠ [], n + 1 < # al0, n + 1 < m0, n < # al0, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, lsf1(tid).le ∈ gstate1.set) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), m0 ≤ # al0, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( lsf1(tid).le ∈ gstate1.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid, (lsf1(tid).le ∈ gstate1.set ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 35:
⊦ ¬ n < # x → (x + y)[n] = y[n - # x]
Proof step 36:
# sl1 = # al0 + 1, al0[n] = ADoMember(tid), (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf1(tid) = invMember, al0 ≠ [], n < # al0, n + 1 < m0, n + 1 < # al0, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, lsf1(tid).le ∈ gstate1.set) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), m0 ≤ # al0, ¬ m0 < # a ', ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( lsf1(tid).le ∈ gstate1.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lsf1(tid).le ∈ gstate1.set ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid), al0[m0 - # a '] ≠ τ ∧ al0[m0 - # a '].tid ≠ tid

Rule argument

spec: list-del, name:get-append-grt, seq: ⊦ ¬ n < # x → (x + y)[n] = y[n - # x], subst:[n, x, y] → [m0, a ', al0]; ['a] → [SetAction], <all paths>

Additional information

Used simplifier rules: ⊦ # a ' = 0 +1; (s) ⊦ m < 1 ↔ m = 0; (s) ⊦ m < n → n ≠ 0; (s) a: ⊦ (x + y) + z = x + y + z; from specification list Used terms: m0, a ', al0

Proof step 35 from proof frag-retMem (previous step) (back to tree)

⊦ ¬ n < # x → (x + y)[n] = y[n - # x]

A spec-lemma

Proof step 36 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, al0[n] = ADoMember(tid), (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf1(tid) = invMember, al0 ≠ [], n < # al0, n + 1 < m0, n + 1 < # al0, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, lsf1(tid).le ∈ gstate1.set) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), m0 ≤ # al0, ¬ m0 < # a ', ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( lsf1(tid).le ∈ gstate1.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lsf1(tid).le ∈ gstate1.set ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid), al0[m0 - # a '] ≠ τ ∧ al0[m0 - # a '].tid ≠ tid

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 37:
# sl1 = # al0 + 1, (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), al0[n] = ADoMember(tid), pcf1(tid) = invMember, al0 ≠ [], n + 1 < # al0, n + 1 < m0, n < # al0, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, lsf1(tid).le ∈ gstate1.set) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), m0 ≤ # al0, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( lsf1(tid).le ∈ gstate1.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lsf1(tid).le ∈ gstate1.set ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid), al0[m0 - 1] ≠ τ ∧ al0[m0 - 1].tid ≠ tid

Rule argument

Additional information

Used simplifier rules: ⊦ # a ' = 0 +1; (s) ⊦ m < n → n ≠ 0; (s) ⊦ m < 1 ↔ m = 0; (s)

Proof step 37 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), al0[n] = ADoMember(tid), pcf1(tid) = invMember, al0 ≠ [], n + 1 < # al0, n + 1 < m0, n < # al0, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, lsf1(tid).le ∈ gstate1.set) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), m0 ≤ # al0, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( lsf1(tid).le ∈ gstate1.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lsf1(tid).le ∈ gstate1.set ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid), al0[m0 - 1] ≠ τ ∧ al0[m0 - 1].tid ≠ tid

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 38:
# sl1 = # al0 + 1, al0[n] = ADoMember(tid), (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), m0 = m1 + 1, pcf1(tid) = invMember, al0 ≠ [], m0 ≠ 0, n < # al0, n + 1 < m0, n + 1 < # al0, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, lsf1(tid).le ∈ gstate1.set) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), m0 ≤ # al0, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( lsf1(tid).le ∈ gstate1.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), al0[m1] ≠ τ ∧ al0[m1].tid ≠ tid, (lsf1(tid).le ∈ gstate1.set ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

spec: nat, name:elim-pred-c, seq:n ≠ 0 ⊦ m = n - 1 ↔ n = m + 1, subst:[n, m] → [m0, m1]

Additional information

Used simplifier rules: ⊦ 0 ≤ m; (s) n0 < n ⊦ ¬ m + (* n) < (* n0); (s) a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic n ≠ 0 ⊦ m = n - 1 ↔ n = m + 1; (elim) Used terms: m0, m1

Proof step 38 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, al0[n] = ADoMember(tid), (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), m0 = m1 + 1, pcf1(tid) = invMember, al0 ≠ [], m0 ≠ 0, n < # al0, n + 1 < m0, n + 1 < # al0, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, lsf1(tid).le ∈ gstate1.set) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), m0 ≤ # al0, ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( lsf1(tid).le ∈ gstate1.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), al0[m1] ≠ τ ∧ al0[m1].tid ≠ tid, (lsf1(tid).le ∈ gstate1.set ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 39:
# sl1 = # al0 + 1, al0[n] = ADoMember(tid), (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf1(tid) = invMember, al0 ≠ [], n < m1, m1 < # al0, n < # al0, n + 1 < # al0, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, lsf1(tid).le ∈ gstate1.set) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( lsf1(tid).le ∈ gstate1.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), al0[m1] ≠ τ ∧ al0[m1].tid ≠ tid, (lsf1(tid).le ∈ gstate1.set ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

Additional information

Used simplifier rules: ⊦ m +1 = m + 1; (s) ⊦ m < n → n ≠ 0; (s) trans-Nat: ⊦ n < n0 ∧ n0 < n1 → n < n1; (forward) from specification nat-basic lf: ⊦ m < n ∧ n < n0 → m +1 < n0; (forward) from specification nat-basic f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m + n < m + n0 ↔ n < n0; (s) ⊦ m + 1 ≤ n ↔ m < n; (s) ⊦ m + 1 ≠ 0; (s)

Proof step 39 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, al0[n] = ADoMember(tid), (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf1(tid) = invMember, al0 ≠ [], n < m1, m1 < # al0, n < # al0, n + 1 < # al0, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, lsf1(tid).le ∈ gstate1.set) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), ∀ m. n < m ∧ m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( lsf1(tid).le ∈ gstate1.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), al0[m1] ≠ τ ∧ al0[m1].tid ≠ tid, (lsf1(tid).le ∈ gstate1.set ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

User applied rule all left

And closed the goal!

Rule argument

pos: left 14 terms: m1 abort: F discard: F computed: T

Additional information

Used terms: m1

Proof step 40 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, b ↔ lsf0(tid).lb, (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf0(tid) = retMember, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, b) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( b ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (b ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 41:
# sl1 = # al0 + 1, (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf0(tid) = retMember, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, lsf0(tid).lb) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( lsf0(tid).lb ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lsf0(tid).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

Additional information

Proof step 41 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf0(tid) = retMember, SetInv(gstate, lsf, pcf), SetInv(gstate0, lsf0, pcf0), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, lsf0(tid).lb) '), setStep(mkstate(gstate, lsf, pcf), a, mkstate(gstate0, lsf0, pcf0)), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( lsf0(tid).lb ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lsf0(tid).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 42:
⊦ setStep(mkstate(gs, lsf, pcf), a, mkstate(gs0, lsf0, pcf0)) ↔ (∃ tid, ls, pc. lstep(gs, lsf(tid), pcf(tid), a, gs0, ls, pc) ∧ lsf0 = lsf(tid := ls) ∧ pcf0 = pcf(tid := pc))
Proof step 43:
# sl1 = # al0 + 1, (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf0(tid) = retMember, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, lsf0(tid).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid, ∃ tid, ls, pc. lstep(gstate, lsf(tid), pcf(tid), a, gstate0, ls, pc) ∧ lsf0 = lsf(tid := ls) ∧ pcf0 = pcf(tid := pc) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( lsf0(tid).lb ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lsf0(tid).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

spec: Set, name:setStep, seq:⊦ setStep(mkstate(gs, lsf, pcf), a, mkstate(gs0, lsf0, pcf0)) ↔ (∃ tid, ls, pc. lstep(gs, lsf(tid), pcf(tid), a, gs0, ls, pc) ∧ lsf0 = lsf(tid := ls) ∧ pcf0 = pcf(tid := pc)), subst:[lsf, pcf, pcf0, lsf0, gs0, gs, a] → [lsf, pcf, pcf0, lsf0, gstate0, gstate, a], <all paths>

Additional information

Used terms: lsf, pcf, pcf0, lsf0, gstate0, gstate, a

Proof step 42 from proof frag-retMem (previous step) (back to tree)

⊦ setStep(mkstate(gs, lsf, pcf), a, mkstate(gs0, lsf0, pcf0)) ↔ (∃ tid, ls, pc. lstep(gs, lsf(tid), pcf(tid), a, gs0, ls, pc) ∧ lsf0 = lsf(tid := ls) ∧ pcf0 = pcf(tid := pc))

A spec-lemma

Proof step 43 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstate0, lsf0, pcf0) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf0(tid) = retMember, SetInv(gstate0, lsf0, pcf0), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt))(mkstate(gstate0, lsf0, pcf0) ' + sl1, al0 + ARetMember(tid, lsf0(tid).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid, ∃ tid, ls, pc. lstep(gstate, lsf(tid), pcf(tid), a, gstate0, ls, pc) ∧ lsf0 = lsf(tid := ls) ∧ pcf0 = pcf(tid := pc) ⊦ ∃ n. ¬ # al0 < n ∧ (a ' + al0)[n] = ADoMember(tid) ∧ ( lsf0(tid).lb ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].lsf(tid).le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].gstate.set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate0, lsf0, pcf0) ' + sl1)[n].pcf(tid) = invMember ∧ (∀ m0. n < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lsf0(tid).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 44:
# sl1 = # al0 + 1, (tid0 = tid ⊃ pcstepf(gstate, lsf(tid), pcf(tid), a);pcf(tid)) = retMember, ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1, al0 + ARetMember(tid, (tid0 = tid ⊃ lstepf(gstate, lsf(tid), pcf(tid), a);lsf(tid)).lb) '), pre(gstate, lsf(tid0), pcf(tid0), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( (tid0 = tid ⊃ lstepf(gstate, lsf(tid), pcf(tid), a);lsf(tid)).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), ((tid0 = tid ⊃ lstepf(gstate, lsf(tid), pcf(tid), a);lsf(tid)).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

Additional information

Used simplifier rules: ⊦ lstep(gs, ls, pc, a, gs0, ls0, pc0) ↔ pre(gs, ls, pc, a) ∧ ls0 = lstepf(gs, ls, pc, a) ∧ gs0 = gstepf(gs, ls, pc, a) ∧ pc0 = pcstepf(gs, ls, pc, a); (s)

Proof step 44 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (tid0 = tid ⊃ pcstepf(gstate, lsf(tid), pcf(tid), a);pcf(tid)) = retMember, ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1, al0 + ARetMember(tid, (tid0 = tid ⊃ lstepf(gstate, lsf(tid), pcf(tid), a);lsf(tid)).lb) '), pre(gstate, lsf(tid0), pcf(tid0), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( (tid0 = tid ⊃ lstepf(gstate, lsf(tid), pcf(tid), a);lsf(tid)).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), ((tid0 = tid ⊃ lstepf(gstate, lsf(tid), pcf(tid), a);lsf(tid)).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

User applied rule case distinction

And obtained the following new goals

Proof step 45:
# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcstepf(gstate, lsf(tid), pcf(tid), a) = retMember, tid0 = tid, SetInv(gstate, lsf, pcf), SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1, al0 + ARetMember(tid, (tid0 = tid ⊃ lstepf(gstate, lsf(tid), pcf(tid), a);lsf(tid)).lb) '), pre(gstate, lsf(tid0), pcf(tid0), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( (tid0 = tid ⊃ lstepf(gstate, lsf(tid), pcf(tid), a);lsf(tid)).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), ((tid0 = tid ⊃ lstepf(gstate, lsf(tid), pcf(tid), a);lsf(tid)).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)
Proof step 81:
# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retMember, tid0 ≠ tid, SetInv(gstate, lsf, pcf), SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1, al0 + ARetMember(tid, (tid0 = tid ⊃ lstepf(gstate, lsf(tid), pcf(tid), a);lsf(tid)).lb) '), pre(gstate, lsf(tid0), pcf(tid0), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( (tid0 = tid ⊃ lstepf(gstate, lsf(tid), pcf(tid), a);lsf(tid)).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), ((tid0 = tid ⊃ lstepf(gstate, lsf(tid), pcf(tid), a);lsf(tid)).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

pos: left 2

Additional information

Proof step 45 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcstepf(gstate, lsf(tid), pcf(tid), a) = retMember, tid0 = tid, SetInv(gstate, lsf, pcf), SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1, al0 + ARetMember(tid, (tid0 = tid ⊃ lstepf(gstate, lsf(tid), pcf(tid), a);lsf(tid)).lb) '), pre(gstate, lsf(tid0), pcf(tid0), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( (tid0 = tid ⊃ lstepf(gstate, lsf(tid), pcf(tid), a);lsf(tid)).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), ((tid0 = tid ⊃ lstepf(gstate, lsf(tid), pcf(tid), a);lsf(tid)).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 46:
# sl1 = # al0 + 1, (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcstepf(gstate, lsf(tid), pcf(tid), a) = retMember, SetInv(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), pcf(tid), a).lb) '), pre(gstate, lsf(tid), pcf(tid), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

Additional information

Proof step 46 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcstepf(gstate, lsf(tid), pcf(tid), a) = retMember, SetInv(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), pcf(tid), a).lb) '), pre(gstate, lsf(tid), pcf(tid), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

User applied rule exists right

And obtained the following new goals

Proof step 47:
# sl1 = # al0 + 1, (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcstepf(gstate, lsf(tid), pcf(tid), a) = retMember, SetInv(gstate, lsf, pcf), SetInv(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), pcf(tid), a).lb) '), pre(gstate, lsf(tid), pcf(tid), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid), ¬ # al0 < n + 1 ∧ (a ' + al0)[n + 1] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n + 1 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n + 1 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n + 1 ] .pcf (tid) = invMember ∧ (∀ m0. n + 1 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid)

Rule argument

pos: right 1 terms: n + 1 abort: F discard: F computed: F

Additional information

Used terms: n + 1

Proof step 47 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcstepf(gstate, lsf(tid), pcf(tid), a) = retMember, SetInv(gstate, lsf, pcf), SetInv(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), pcf(tid), a).lb) '), pre(gstate, lsf(tid), pcf(tid), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid), ¬ # al0 < n + 1 ∧ (a ' + al0)[n + 1] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n + 1 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n + 1 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n + 1 ] .pcf (tid) = invMember ∧ (∀ m0. n + 1 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 48:
# sl1 = # al0 + 1, (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcstepf(gstate, lsf(tid), pcf(tid), a) = retMember, SetInv(gstate, lsf, pcf), SetInv(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), pcf(tid), a).lb) '), pre(gstate, lsf(tid), pcf(tid), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid)

Rule argument

Additional information

Used simplifier rules: ⊦ mkstate(gstate, lsf, pcf).pcf = pcf; (s) ⊦ mkstate(gstate, lsf, pcf).gstate = gstate; (s) ⊦ mkstate(gstate, lsf, pcf).lsf = lsf; (s) a: ⊦ (x + y) + z = x + y + z; from specification list c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ (a ' + x)[n + 1] = x[n]; (s) ⊦ m < n + 1 ↔ ¬ n < m; (s)

Proof step 48 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcstepf(gstate, lsf(tid), pcf(tid), a) = retMember, SetInv(gstate, lsf, pcf), SetInv(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), pcf(tid), a).lb) '), pre(gstate, lsf(tid), pcf(tid), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid)

User applied rule constructor cut

And obtained the following new goals

Proof step 49:
# sl1 = # al0 + 1, (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = idle, pcstepf(gstate, lsf(tid), pcf(tid), a) = retMember, SetInv(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), pcf(tid), a).lb) '), pre(gstate, lsf(tid), pcf(tid), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)
Proof step 57:
# sl1 = # al0 + 1, (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invInsert, pcstepf(gstate, lsf(tid), pcf(tid), a) = retMember, SetInv(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), pcf(tid), a).lb) '), pre(gstate, lsf(tid), pcf(tid), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)
Proof step 60:
# sl1 = # al0 + 1, (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invMember, pcstepf(gstate, lsf(tid), pcf(tid), a) = retMember, SetInv(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), pcf(tid), a).lb) '), pre(gstate, lsf(tid), pcf(tid), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)
Proof step 75:
# sl1 = # al0 + 1, (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retInsert, pcstepf(gstate, lsf(tid), pcf(tid), a) = retMember, SetInv(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), pcf(tid), a).lb) '), pre(gstate, lsf(tid), pcf(tid), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)
Proof step 78:
# sl1 = # al0 + 1, (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retMember, pcstepf(gstate, lsf(tid), pcf(tid), a) = retMember, SetInv(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), pcf(tid), a).lb) '), pre(gstate, lsf(tid), pcf(tid), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Rule argument

term: pcf(tid)

Additional information

Used simplifier rules: SetPC freely generated by idle, invInsert, invMember, retInsert, retMember;;

Proof step 49 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = idle, pcstepf(gstate, lsf(tid), pcf(tid), a) = retMember, SetInv(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), pcf(tid), a).lb) '), pre(gstate, lsf(tid), pcf(tid), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 50:
# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = idle, pcstepf(gstate, lsf(tid), idle, a) = retMember, SetInv(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), idle, a).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid, a = AInvInsert(tid, e) ∧ e ≠ ⊥ ∨ a = AInvMember(tid, e0) ∧ e0 ≠ ⊥ ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), idle, a).lb ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n0].lsf(tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n0].gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n0].pcf(tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), idle, a).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid)

Rule argument

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; ⊦ idle ≠ retMember; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ gstepf(gs, ls, idle, a) = gs; (s) ⊦ pre(gs, ls, idle, a) ↔ (∃ e. a = AInvInsert(ls.tid, e) ∧ e ≠ ⊥) ∨ (∃ e. a = AInvMember(ls.tid, e) ∧ e ≠ ⊥); (s)

Proof step 50 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = idle, pcstepf(gstate, lsf(tid), idle, a) = retMember, SetInv(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), idle, a).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid, a = AInvInsert(tid, e) ∧ e ≠ ⊥ ∨ a = AInvMember(tid, e0) ∧ e0 ≠ ⊥ ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), idle, a).lb ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n0].lsf(tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n0].gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n0].pcf(tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), idle, a).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid)

User applied rule case distinction

And obtained the following new goals

Proof step 51:
# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), a = AInvInsert(tid, e), pcf(tid) = idle, pcstepf(gstate, lsf(tid), idle, a) = retMember, e ≠ ⊥, SetInv(gstate, lsf, pcf), SetInv(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), idle, a).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), idle, a).lb ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n0].lsf(tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n0].gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n0].pcf(tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), idle, a).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid)
Proof step 54:
# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), a = AInvMember(tid, e0), pcf(tid) = idle, pcstepf(gstate, lsf(tid), idle, a) = retMember, e0 ≠ ⊥, SetInv(gstate, lsf, pcf), SetInv(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), idle, a).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), idle, a).lb ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n0].lsf(tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n0].gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n0].pcf(tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), idle, a).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid)

Rule argument

pos: left 9

Additional information

Proof step 51 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), a = AInvInsert(tid, e), pcf(tid) = idle, pcstepf(gstate, lsf(tid), idle, a) = retMember, e ≠ ⊥, SetInv(gstate, lsf, pcf), SetInv(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), idle, a).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), idle, a).lb ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n0].lsf(tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n0].gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n0].pcf(tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), idle, a).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 52:
# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvInsert(tid, e))), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = idle, pcstepf(gstate, lsf(tid), idle, AInvInsert(tid, e)) = retMember, e ≠ ⊥, SetInv(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvInsert(tid, e))), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvInsert(tid, e))), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), idle, AInvInsert(tid, e)).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (AInvInsert(tid, e) ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), idle, AInvInsert(tid, e)).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvInsert(tid, e))), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvInsert(tid, e))), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvInsert(tid, e))), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (AInvInsert(tid, e) ' + al0)[m0] ≠ τ ∧ (AInvInsert(tid, e) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), idle, AInvInsert(tid, e)).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (AInvInsert(tid, e) ' + al0)[m0] ≠ τ ∧ (AInvInsert(tid, e) ' + al0)[m0].tid ≠ tid)

Rule argument

Additional information

Proof step 52 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvInsert(tid, e))), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = idle, pcstepf(gstate, lsf(tid), idle, AInvInsert(tid, e)) = retMember, e ≠ ⊥, SetInv(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvInsert(tid, e))), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvInsert(tid, e))), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), idle, AInvInsert(tid, e)).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (AInvInsert(tid, e) ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), idle, AInvInsert(tid, e)).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvInsert(tid, e))), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvInsert(tid, e))), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvInsert(tid, e))), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (AInvInsert(tid, e) ' + al0)[m0] ≠ τ ∧ (AInvInsert(tid, e) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), idle, AInvInsert(tid, e)).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (AInvInsert(tid, e) ' + al0)[m0] ≠ τ ∧ (AInvInsert(tid, e) ' + al0)[m0].tid ≠ tid)

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 53:
⊦ ls.tid = tid → lstepf(gs, ls, idle, AInvInsert(tid, e)) = ls.le:= e

Rule argument

spec: Set, name:lstepf-idle-INVINSERT, seq: ⊦ ls.tid = tid → lstepf(gs, ls, idle, AInvInsert(tid, e)) = ls.le:= e, subst:[gs, ls, tid, e] → [gstate, lsf(tid), tid, e], <all paths>

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; ⊦ ls.tid = tid → pcstepf(gs, ls, idle, AInvInsert(tid, e)) = invInsert; (s) ⊦ invInsert ≠ retMember; (s) Used terms: gstate, lsf(tid), tid, e

Proof step 53 from proof frag-retMem (previous step) (back to tree)

⊦ ls.tid = tid → lstepf(gs, ls, idle, AInvInsert(tid, e)) = ls.le:= e

A spec-lemma

Proof step 54 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), a = AInvMember(tid, e0), pcf(tid) = idle, pcstepf(gstate, lsf(tid), idle, a) = retMember, e0 ≠ ⊥, SetInv(gstate, lsf, pcf), SetInv(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), idle, a).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), idle, a).lb ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n0].lsf(tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n0].gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, a)), pcf(tid := retMember)) ' + sl1)[n0].pcf(tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), idle, a).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 55:
# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvMember(tid, e0))), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = idle, pcstepf(gstate, lsf(tid), idle, AInvMember(tid, e0)) = retMember, e0 ≠ ⊥, SetInv(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvMember(tid, e0))), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvMember(tid, e0))), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), idle, AInvMember(tid, e0)).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (AInvMember(tid, e0) ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), idle, AInvMember(tid, e0)).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvMember(tid, e0))), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvMember(tid, e0))), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvMember(tid, e0))), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (AInvMember(tid, e0) ' + al0)[m0] ≠ τ ∧ (AInvMember(tid, e0) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), idle, AInvMember(tid, e0)).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (AInvMember(tid, e0) ' + al0)[m0] ≠ τ ∧ (AInvMember(tid, e0) ' + al0)[m0].tid ≠ tid)

Rule argument

Additional information

Proof step 55 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvMember(tid, e0))), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = idle, pcstepf(gstate, lsf(tid), idle, AInvMember(tid, e0)) = retMember, e0 ≠ ⊥, SetInv(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvMember(tid, e0))), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvMember(tid, e0))), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), idle, AInvMember(tid, e0)).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (AInvMember(tid, e0) ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), idle, AInvMember(tid, e0)).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvMember(tid, e0))), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvMember(tid, e0))), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lstepf(gstate, lsf(tid), idle, AInvMember(tid, e0))), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (AInvMember(tid, e0) ' + al0)[m0] ≠ τ ∧ (AInvMember(tid, e0) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), idle, AInvMember(tid, e0)).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (AInvMember(tid, e0) ' + al0)[m0] ≠ τ ∧ (AInvMember(tid, e0) ' + al0)[m0].tid ≠ tid)

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 56:
⊦ ls.tid = tid → lstepf(gs, ls, idle, AInvMember(tid, e)) = ls.le:= e

Rule argument

spec: Set, name:lstepf-idle-INVMEMBER, seq: ⊦ ls.tid = tid → lstepf(gs, ls, idle, AInvMember(tid, e)) = ls.le:= e, subst:[gs, ls, tid, e] → [gstate, lsf(tid), tid, e0], <all paths>

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; ⊦ ls.tid = tid → pcstepf(gs, ls, idle, AInvMember(tid, e)) = invMember; (s) ⊦ invMember ≠ retMember; (s) Used terms: gstate, lsf(tid), tid, e0

Proof step 56 from proof frag-retMem (previous step) (back to tree)

⊦ ls.tid = tid → lstepf(gs, ls, idle, AInvMember(tid, e)) = ls.le:= e

A spec-lemma

Proof step 57 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invInsert, pcstepf(gstate, lsf(tid), pcf(tid), a) = retMember, SetInv(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), pcf(tid), a).lb) '), pre(gstate, lsf(tid), pcf(tid), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 58:
# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b)), lsf(tid := lstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b))), pcf(tid := retMember)) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invInsert, pcstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b)) = retMember, SetInv(gstate, lsf, pcf), SetInv (gstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b)), lsf(tid := lstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b))), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b)), lsf(tid := lstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b))), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b)).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoInsert(tid, b) ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b)).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b)), lsf(tid := lstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b))), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b)), lsf(tid := lstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b))), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b)), lsf(tid := lstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b))), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoInsert(tid, b) ' + al0)[m0] ≠ τ ∧ (ADoInsert(tid, b) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b)).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoInsert(tid, b) ' + al0)[m0] ≠ τ ∧ (ADoInsert(tid, b) ' + al0)[m0].tid ≠ tid)

Rule argument

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; ⊦ invInsert ≠ retMember; (s) ⊦ pre(gs, ls, invInsert, a) ↔ (∃ b. a = ADoInsert(ls.tid, b)); (s)

Proof step 58 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b)), lsf(tid := lstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b))), pcf(tid := retMember)) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invInsert, pcstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b)) = retMember, SetInv(gstate, lsf, pcf), SetInv (gstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b)), lsf(tid := lstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b))), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b)), lsf(tid := lstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b))), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b)).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoInsert(tid, b) ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b)).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b)), lsf(tid := lstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b))), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b)), lsf(tid := lstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b))), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b)), lsf(tid := lstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b))), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoInsert(tid, b) ' + al0)[m0] ≠ τ ∧ (ADoInsert(tid, b) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), invInsert, ADoInsert(tid, b)).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoInsert(tid, b) ' + al0)[m0] ≠ τ ∧ (ADoInsert(tid, b) ' + al0)[m0].tid ≠ tid)

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 59:
⊦ ls.tid = tid → lstepf(gs, ls, invInsert, ADoInsert(tid, b)) = (b ⊃ ls.lb:= true;ls.lb:= false)

Rule argument

spec: Set, name:lstepf-invInsert-DOINSERT, seq:⊦ ls.tid = tid → lstepf(gs, ls, invInsert, ADoInsert(tid, b)) = (b ⊃ ls.lb:= true;ls.lb:= false), subst:[gs, ls, tid, b] → [gstate, lsf(tid), tid, b], <all paths>

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; ⊦ ls.tid = tid → pcstepf(gs, ls, invInsert, ADoInsert(tid, b)) = retInsert; (s) ⊦ retInsert ≠ retMember; (s) Used terms: gstate, lsf(tid), tid, b

Proof step 59 from proof frag-retMem (previous step) (back to tree)

⊦ ls.tid = tid → lstepf(gs, ls, invInsert, ADoInsert(tid, b)) = (b ⊃ ls.lb:= true;ls.lb:= false)

A spec-lemma

Proof step 60 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invMember, pcstepf(gstate, lsf(tid), pcf(tid), a) = retMember, SetInv(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), pcf(tid), a).lb) '), pre(gstate, lsf(tid), pcf(tid), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 61:
# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lstepf(gstate, lsf(tid), invMember, ADoMember(tid))), pcf(tid := retMember)) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invMember, pcstepf(gstate, lsf(tid), invMember, ADoMember(tid)) = retMember, SetInv(gstate, lsf, pcf), SetInv(gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lstepf(gstate, lsf(tid), invMember, ADoMember(tid))), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lstepf(gstate, lsf(tid), invMember, ADoMember(tid))), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), invMember, ADoMember(tid)).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoMember(tid) ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), invMember, ADoMember(tid)).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lstepf(gstate, lsf(tid), invMember, ADoMember(tid))), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lstepf(gstate, lsf(tid), invMember, ADoMember(tid))), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lstepf(gstate, lsf(tid), invMember, ADoMember(tid))), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), invMember, ADoMember(tid)).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid)

Rule argument

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; ⊦ invMember ≠ retMember; (s) ⊦ pre(gs, ls, invMember, a) ↔ a = ADoMember(ls.tid); (s)

Proof step 61 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lstepf(gstate, lsf(tid), invMember, ADoMember(tid))), pcf(tid := retMember)) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invMember, pcstepf(gstate, lsf(tid), invMember, ADoMember(tid)) = retMember, SetInv(gstate, lsf, pcf), SetInv(gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lstepf(gstate, lsf(tid), invMember, ADoMember(tid))), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lstepf(gstate, lsf(tid), invMember, ADoMember(tid))), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), invMember, ADoMember(tid)).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoMember(tid) ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), invMember, ADoMember(tid)).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lstepf(gstate, lsf(tid), invMember, ADoMember(tid))), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lstepf(gstate, lsf(tid), invMember, ADoMember(tid))), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lstepf(gstate, lsf(tid), invMember, ADoMember(tid))), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), invMember, ADoMember(tid)).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid)

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 62:
⊦ ls.tid = tid → lstepf(gs, ls, invMember, ADoMember(tid)) = ls.lb:= (ls.le ∈ gs.set)
Proof step 63:
# sl1 = # al0 + 1, lsf(tid).tid = tid, (mkstate(gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invMember, pcstepf(gstate, lsf(tid), invMember, ADoMember(tid)) = retMember, SetInv(gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, (lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoMember(tid) ' + al0)[n0] = ADoMember(tid) ∧ ( (lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ ((lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid)

Rule argument

spec: Set, name:lstepf-invMember-DOMEMBER, seq: ⊦ ls.tid = tid → lstepf(gs, ls, invMember, ADoMember(tid)) = ls.lb:= (ls.le ∈ gs.set), subst:[gs, ls, tid] → [gstate, lsf(tid), tid], <all paths>

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; Used terms: gstate, lsf(tid), tid

Proof step 62 from proof frag-retMem (previous step) (back to tree)

⊦ ls.tid = tid → lstepf(gs, ls, invMember, ADoMember(tid)) = ls.lb:= (ls.le ∈ gs.set)

A spec-lemma

Proof step 63 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, lsf(tid).tid = tid, (mkstate(gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invMember, pcstepf(gstate, lsf(tid), invMember, ADoMember(tid)) = retMember, SetInv(gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, (lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoMember(tid) ' + al0)[n0] = ADoMember(tid) ∧ ( (lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ ((lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 64:
# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invMember, SetInv(gstate, lsf, pcf), SetInv(gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lsf(tid).le ∈ gstate.set) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoMember(tid) ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).le ∈ gstate.set ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lsf(tid).le ∈ gstate.set ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid)

Rule argument

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; ⊦ (ls.lb:= lb).lb ↔ lb; (s) ⊦ ls.tid = tid → gstepf(gs, ls, invMember, ADoMember(tid)) = gs; (s) ⊦ ls.tid = tid → pcstepf(gs, ls, invMember, ADoMember(tid)) = retMember; (s)

Proof step 64 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invMember, SetInv(gstate, lsf, pcf), SetInv(gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lsf(tid).le ∈ gstate.set) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoMember(tid) ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).le ∈ gstate.set ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), invMember, ADoMember(tid)), lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lsf(tid).le ∈ gstate.set ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid)

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 65:
⊦ ls.tid = tid → gstepf(gs, ls, invMember, ADoMember(tid)) = gs
Proof step 66:
# sl1 = # al0 + 1, lsf(tid).tid = tid, (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invMember, SetInv(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lsf(tid).le ∈ gstate.set) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoMember(tid) ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).le ∈ gstate.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .lsf (tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0].pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lsf(tid).le ∈ gstate.set ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid)

Rule argument

spec: Set, name:gstepf-invMember-DOMEMBER, seq: ⊦ ls.tid = tid → gstepf(gs, ls, invMember, ADoMember(tid)) = gs, subst:[gs, ls, tid] → [gstate, lsf(tid), tid], <all paths>

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; Used terms: gstate, lsf(tid), tid

Proof step 65 from proof frag-retMem (previous step) (back to tree)

⊦ ls.tid = tid → gstepf(gs, ls, invMember, ADoMember(tid)) = gs

A spec-lemma

Proof step 66 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, lsf(tid).tid = tid, (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invMember, SetInv(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lsf(tid).le ∈ gstate.set) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoMember(tid) ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).le ∈ gstate.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .lsf (tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0].pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lsf(tid).le ∈ gstate.set ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 67:
# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invMember, SetInv(gstate, lsf, pcf), SetInv(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lsf(tid).le ∈ gstate.set) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoMember(tid) ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).le ∈ gstate.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .lsf (tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0].pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lsf(tid).le ∈ gstate.set ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid)

Rule argument

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid;

Proof step 67 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invMember, SetInv(gstate, lsf, pcf), SetInv(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lsf(tid).le ∈ gstate.set) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoMember(tid) ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).le ∈ gstate.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .lsf (tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0].pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lsf(tid).le ∈ gstate.set ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid)

User applied rule exists right

And obtained the following new goals

Proof step 68:
# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invMember, SetInv(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lsf(tid).le ∈ gstate.set) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoMember(tid) ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).le ∈ gstate.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .lsf (tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0].pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lsf(tid).le ∈ gstate.set ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), ¬ # al0 < 0 ∧ (ADoMember(tid) ' + al0)[0] = ADoMember(tid) ∧ ( lsf(tid).le ∈ gstate.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[0].lsf (tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[0] .gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[0].pcf(tid) = invMember ∧ (∀ m0. 0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid)

Rule argument

pos: right 1 terms: 0 abort: F discard: F computed: T

Additional information

Used terms: 0

Proof step 68 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invMember, SetInv(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lsf(tid).le ∈ gstate.set) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoMember(tid) ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).le ∈ gstate.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .lsf (tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0].pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lsf(tid).le ∈ gstate.set ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), ¬ # al0 < 0 ∧ (ADoMember(tid) ' + al0)[0] = ADoMember(tid) ∧ ( lsf(tid).le ∈ gstate.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[0].lsf (tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[0] .gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[0].pcf(tid) = invMember ∧ (∀ m0. 0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 69:
# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invMember, m ≠ 0, SetInv(gstate, lsf, pcf), SetInv(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lsf(tid).le ∈ gstate.set) '), m ≤ # al0, ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoMember(tid) ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).le ∈ gstate.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .lsf (tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0].pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lsf(tid).le ∈ gstate.set ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), (ADoMember(tid) ' + al0)[m] ≠ τ ∧ (ADoMember(tid) ' + al0)[m].tid ≠ tid

Rule argument

Additional information

Used simplifier rules: ⊦ m < n ↔ ¬ n ≤ m; (ss) ⊦ 0 < m ↔ m ≠ 0; (s) ⊦ mkstate(gstate, lsf, pcf).pcf = pcf; (s) a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ (a ' + x)[0] = a; (s) ⊦ mkstate(gstate, lsf, pcf).gstate = gstate; (s) ⊦ mkstate(gstate, lsf, pcf).lsf = lsf; (s) ⊦ ADoMember(tid) = ADoMember(tid0) ↔ tid = tid0; (s) ⊦ ¬ n < 0; (s)

Proof step 69 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invMember, m ≠ 0, SetInv(gstate, lsf, pcf), SetInv(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lsf(tid).le ∈ gstate.set) '), m ≤ # al0, ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoMember(tid) ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).le ∈ gstate.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .lsf (tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0].pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lsf(tid).le ∈ gstate.set ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), (ADoMember(tid) ' + al0)[m] ≠ τ ∧ (ADoMember(tid) ' + al0)[m].tid ≠ tid

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 70:
⊦ ¬ n < # x → (x + y)[n] = y[n - # x]
Proof step 71:
# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invMember, m ≠ 0, SetInv(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lsf(tid).le ∈ gstate.set) '), m ≤ # al0, ¬ m < # ADoMember(tid) ', ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoMember(tid) ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).le ∈ gstate.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .lsf (tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0].pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), al0[m - # ADoMember(tid) '] ≠ τ ∧ al0[m - # ADoMember(tid) '].tid ≠ tid, n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lsf(tid).le ∈ gstate.set ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid)

Rule argument

spec: list-del, name:get-append-grt, seq: ⊦ ¬ n < # x → (x + y)[n] = y[n - # x], subst:[n, x, y] → [m, ADoMember(tid) ', al0]; ['a] → [SetAction], <all paths>

Additional information

Used simplifier rules: ⊦ # a ' = 0 +1; (s) ⊦ m < 1 ↔ m = 0; (s) a: ⊦ (x + y) + z = x + y + z; from specification list Used terms: m, ADoMember(tid) ', al0

Proof step 70 from proof frag-retMem (previous step) (back to tree)

⊦ ¬ n < # x → (x + y)[n] = y[n - # x]

A spec-lemma

Proof step 71 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invMember, m ≠ 0, SetInv(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lsf(tid).le ∈ gstate.set) '), m ≤ # al0, ¬ m < # ADoMember(tid) ', ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoMember(tid) ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).le ∈ gstate.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .lsf (tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0].pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), al0[m - # ADoMember(tid) '] ≠ τ ∧ al0[m - # ADoMember(tid) '].tid ≠ tid, n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lsf(tid).le ∈ gstate.set ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 72:
# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invMember, m ≠ 0, SetInv(gstate, lsf, pcf), SetInv(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lsf(tid).le ∈ gstate.set) '), m ≤ # al0, ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoMember(tid) ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).le ∈ gstate.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .lsf (tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0].pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lsf(tid).le ∈ gstate.set ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), al0[m - 1] ≠ τ ∧ al0[m - 1].tid ≠ tid

Rule argument

Additional information

Used simplifier rules: ⊦ # a ' = 0 +1; (s) ⊦ m < 1 ↔ m = 0; (s)

Proof step 72 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invMember, m ≠ 0, SetInv(gstate, lsf, pcf), SetInv(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lsf(tid).le ∈ gstate.set) '), m ≤ # al0, ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoMember(tid) ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).le ∈ gstate.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .lsf (tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0].pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lsf(tid).le ∈ gstate.set ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), al0[m - 1] ≠ τ ∧ al0[m - 1].tid ≠ tid

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 73:
# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), m = m1 + 1, pcf(tid) = invMember, m ≠ 0, SetInv(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lsf(tid).le ∈ gstate.set) '), m ≤ # al0, ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoMember(tid) ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).le ∈ gstate.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .lsf (tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0].pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), al0[m1] ≠ τ ∧ al0[m1].tid ≠ tid, n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lsf(tid).le ∈ gstate.set ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid)

Rule argument

spec: nat, name:elim-pred-c, seq:n ≠ 0 ⊦ m = n - 1 ↔ n = m + 1, subst:[n, m] → [m, m1]

Additional information

Used simplifier rules: n ≠ 0 ⊦ m = n - 1 ↔ n = m + 1; (elim) Used terms: m, m1

Proof step 73 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), m = m1 + 1, pcf(tid) = invMember, m ≠ 0, SetInv(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lsf(tid).le ∈ gstate.set) '), m ≤ # al0, ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoMember(tid) ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).le ∈ gstate.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .lsf (tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0].pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), al0[m1] ≠ τ ∧ al0[m1].tid ≠ tid, n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lsf(tid).le ∈ gstate.set ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 74:
# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invMember, al0 ≠ [], m1 < # al0, SetInv(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lsf(tid).le ∈ gstate.set) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoMember(tid) ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).le ∈ gstate.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .lsf (tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0].pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), al0[m1] ≠ τ ∧ al0[m1].tid ≠ tid, n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lsf(tid).le ∈ gstate.set ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid)

Rule argument

Additional information

Used simplifier rules: ⊦ # x = 0 ↔ x = []; (s) f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m + 1 ≤ n ↔ m < n; (s) ⊦ m + 1 ≠ 0; (s)

Proof step 74 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = invMember, al0 ≠ [], m1 < # al0, SetInv(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lsf(tid).le ∈ gstate.set) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ADoMember(tid) ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).le ∈ gstate.set ↔ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .lsf (tid) .le ∈ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0] .gstate .set) ∧ (mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid := lsf(tid).lb:= (lsf(tid).le ∈ gstate.set)), pcf(tid := retMember)) ' + sl1)[n0].pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid), al0[m1] ≠ τ ∧ al0[m1].tid ≠ tid, n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lsf(tid).le ∈ gstate.set ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ADoMember(tid) ' + al0)[m0] ≠ τ ∧ (ADoMember(tid) ' + al0)[m0].tid ≠ tid)

User applied rule all left

And closed the goal!

Rule argument

pos: left 9 terms: m1 abort: F discard: F computed: T

Additional information

Used terms: m1

Proof step 75 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retInsert, pcstepf(gstate, lsf(tid), pcf(tid), a) = retMember, SetInv(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), pcf(tid), a).lb) '), pre(gstate, lsf(tid), pcf(tid), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 76:
# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb))), pcf(tid := retMember)) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retInsert, pcstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb)) = retMember, SetInv(gstate, lsf, pcf), SetInv (gstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb))), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb))), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb)).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ARetInsert(tid, lsf(tid).lb) ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb)).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb))), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb))), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb))), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ARetInsert(tid, lsf(tid).lb) ' + al0)[m0] ≠ τ ∧ (ARetInsert(tid, lsf(tid).lb) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb)).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ARetInsert(tid, lsf(tid).lb) ' + al0)[m0] ≠ τ ∧ (ARetInsert(tid, lsf(tid).lb) ' + al0)[m0].tid ≠ tid)

Rule argument

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; ⊦ retInsert ≠ retMember; (s) ⊦ pre(gs, ls, retInsert, a) ↔ (∃ b0. a = ARetInsert(ls.tid, b0) ∧ (b0 ↔ ls.lb)); (s)

Proof step 76 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb))), pcf(tid := retMember)) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retInsert, pcstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb)) = retMember, SetInv(gstate, lsf, pcf), SetInv (gstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb))), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb))), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb)).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ARetInsert(tid, lsf(tid).lb) ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb)).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb))), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb))), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb))), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ARetInsert(tid, lsf(tid).lb) ' + al0)[m0] ≠ τ ∧ (ARetInsert(tid, lsf(tid).lb) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), retInsert, ARetInsert(tid, lsf(tid).lb)).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ARetInsert(tid, lsf(tid).lb) ' + al0)[m0] ≠ τ ∧ (ARetInsert(tid, lsf(tid).lb) ' + al0)[m0].tid ≠ tid)

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 77:
⊦ ls.tid = tid → lstepf(gs, ls, retInsert, ARetInsert(tid, b0)) = ls

Rule argument

spec: Set, name:lstepf-retInsert-RETINSERT, seq: ⊦ ls.tid = tid → lstepf(gs, ls, retInsert, ARetInsert(tid, b0)) = ls, subst:[gs, ls, tid, b0] → [gstate, lsf(tid), tid, lsf(tid).lb], <all paths>

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; ⊦ ls.tid = tid → pcstepf(gs, ls, retInsert, ARetInsert(tid, b0)) = idle; (s) ⊦ idle ≠ retMember; (s) Used terms: gstate, lsf(tid), tid, lsf(tid).lb

Proof step 77 from proof frag-retMem (previous step) (back to tree)

⊦ ls.tid = tid → lstepf(gs, ls, retInsert, ARetInsert(tid, b0)) = ls

A spec-lemma

Proof step 78 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retMember, pcstepf(gstate, lsf(tid), pcf(tid), a) = retMember, SetInv(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), pcf(tid), a).lb) '), pre(gstate, lsf(tid), pcf(tid), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstepf(gstate, lsf(tid), pcf(tid), a), lsf(tid := lstepf(gstate, lsf(tid), pcf(tid), a)), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (lstepf(gstate, lsf(tid), pcf(tid), a).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 79:
# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb))), pcf(tid := retMember)) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retMember, pcstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb)) = retMember, SetInv(gstate, lsf, pcf), SetInv (gstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb))), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb))), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb)).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ARetMember(tid, lsf(tid).lb) ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb)).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb))), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb))), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb))), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ARetMember(tid, lsf(tid).lb) ' + al0)[m0] ≠ τ ∧ (ARetMember(tid, lsf(tid).lb) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb)).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ARetMember(tid, lsf(tid).lb) ' + al0)[m0] ≠ τ ∧ (ARetMember(tid, lsf(tid).lb) ' + al0)[m0].tid ≠ tid), (lstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb)).lb ↔ lsf(tid).lb) ∧ (¬ # al0 < m → (ARetMember(tid, lsf(tid).lb) ' + al0)[m] ≠ τ ∧ (ARetMember(tid, lsf(tid).lb) ' + al0)[m].tid ≠ tid)

Rule argument

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; ⊦ pre(gs, ls, retMember, a) ↔ (∃ b0. a = ARetMember(ls.tid, b0) ∧ (b0 ↔ ls.lb)); (s)

Proof step 79 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb))), pcf(tid := retMember)) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retMember, pcstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb)) = retMember, SetInv(gstate, lsf, pcf), SetInv (gstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb))), pcf(tid := retMember)), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb))), pcf(tid := retMember)) ' + sl1, al0 + ARetMember(tid, lstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb)).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (ARetMember(tid, lsf(tid).lb) ' + al0)[n0] = ADoMember(tid) ∧ ( lstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb)).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb))), pcf(tid := retMember)) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb))), pcf(tid := retMember)) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb)), lsf(tid := lstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb))), pcf(tid := retMember)) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (ARetMember(tid, lsf(tid).lb) ' + al0)[m0] ≠ τ ∧ (ARetMember(tid, lsf(tid).lb) ' + al0)[m0].tid ≠ tid), n < # al0 ∧ al0[n] = ADoMember(tid) ∧ (lstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb)).lb ↔ lsf1(tid).le ∈ gstate1.set) ∧ pcf1(tid) = invMember ∧ (n + 1 < m0 ∧ ¬ # al0 < m0 → (ARetMember(tid, lsf(tid).lb) ' + al0)[m0] ≠ τ ∧ (ARetMember(tid, lsf(tid).lb) ' + al0)[m0].tid ≠ tid), (lstepf(gstate, lsf(tid), retMember, ARetMember(tid, lsf(tid).lb)).lb ↔ lsf(tid).lb) ∧ (¬ # al0 < m → (ARetMember(tid, lsf(tid).lb) ' + al0)[m] ≠ τ ∧ (ARetMember(tid, lsf(tid).lb) ' + al0)[m].tid ≠ tid)

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 80:
⊦ ls.tid = tid → lstepf(gs, ls, retMember, ARetMember(tid, b0)) = ls

Rule argument

spec: Set, name:lstepf-retMember-RETMEMBER, seq: ⊦ ls.tid = tid → lstepf(gs, ls, retMember, ARetMember(tid, b0)) = ls, subst:[gs, ls, tid, b0] → [gstate, lsf(tid), tid, lsf(tid).lb], <all paths>

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; ⊦ ls.tid = tid → pcstepf(gs, ls, retMember, ARetMember(tid, b0)) = idle; (s) ⊦ idle ≠ retMember; (s) Used terms: gstate, lsf(tid), tid, lsf(tid).lb

Proof step 80 from proof frag-retMem (previous step) (back to tree)

⊦ ls.tid = tid → lstepf(gs, ls, retMember, ARetMember(tid, b0)) = ls

A spec-lemma

Proof step 81 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retMember, tid0 ≠ tid, SetInv(gstate, lsf, pcf), SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1, al0 + ARetMember(tid, (tid0 = tid ⊃ lstepf(gstate, lsf(tid), pcf(tid), a);lsf(tid)).lb) '), pre(gstate, lsf(tid0), pcf(tid0), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( (tid0 = tid ⊃ lstepf(gstate, lsf(tid), pcf(tid), a);lsf(tid)).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), ((tid0 = tid ⊃ lstepf(gstate, lsf(tid), pcf(tid), a);lsf(tid)).lb ↔ lsf(tid).lb) ∧ pcf(tid) = retMember ∧ (¬ # al0 < m → (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 82:
# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retMember, tid0 ≠ tid, SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1, al0 + ARetMember(tid, lsf(tid).lb) '), pre(gstate, lsf(tid0), pcf(tid0), a), m ≤ # al0, ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid

Rule argument

Additional information

Used simplifier rules: ⊦ m < n ↔ ¬ n ≤ m; (ss)

Proof step 82 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retMember, tid0 ≠ tid, SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1, al0 + ARetMember(tid, lsf(tid).lb) '), pre(gstate, lsf(tid0), pcf(tid0), a), m ≤ # al0, ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid

User applied rule apply rewrite lemma

And obtained the following new goals

Proof step 83:
⊦ ¬ n < # x → (x + y)[n] = y[n - # x]
Proof step 84:
# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retMember, tid0 ≠ tid, m < # a ', SetInv(gstate, lsf, pcf), SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1, al0 + ARetMember(tid, lsf(tid).lb) '), pre(gstate, lsf(tid0), pcf(tid0), a), m ≤ # al0, ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid
Proof step 88:
# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retMember, tid0 ≠ tid, SetInv(gstate, lsf, pcf), SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1, al0 + ARetMember(tid, lsf(tid).lb) '), pre(gstate, lsf(tid0), pcf(tid0), a), m ≤ # al0, ¬ m < # a ', ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), al0[m - # a '] ≠ τ ∧ al0[m - # a '].tid ≠ tid

Rule argument

spec: list-del, name:get-append-grt, seq: ⊦ ¬ n < # x → (x + y)[n] = y[n - # x], subst:[n, x, y] → [m, a ', al0]; ['a] → [SetAction], <all paths>

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list Used terms: m, a ', al0

Proof step 83 from proof frag-retMem (previous step) (back to tree)

⊦ ¬ n < # x → (x + y)[n] = y[n - # x]

A spec-lemma

Proof step 84 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retMember, tid0 ≠ tid, m < # a ', SetInv(gstate, lsf, pcf), SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1, al0 + ARetMember(tid, lsf(tid).lb) '), pre(gstate, lsf(tid0), pcf(tid0), a), m ≤ # al0, ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), (a ' + al0)[m] ≠ τ ∧ (a ' + al0)[m].tid ≠ tid

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 85:
# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retMember, tid0 ≠ tid, SetInv(gstate, lsf, pcf), SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1, al0 + ARetMember(tid, lsf(tid).lb) '), pre(gstate, lsf(tid0), pcf(tid0), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), a ≠ τ ∧ a.tid ≠ tid

Rule argument

Additional information

Used simplifier rules: a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ (a ' + x)[0] = a; (s) ⊦ 0 ≤ m; (s) ⊦ m < 1 ↔ m = 0; (s) ⊦ # a ' = 0 +1; (s)

Proof step 85 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retMember, tid0 ≠ tid, SetInv(gstate, lsf, pcf), SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1, al0 + ARetMember(tid, lsf(tid).lb) '), pre(gstate, lsf(tid0), pcf(tid0), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), a ≠ τ ∧ a.tid ≠ tid

User applied rule constructor cut

And obtained the following new goals

Proof step 86:
# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retMember, pcf(tid0) = idle, tid0 ≠ tid, SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1, al0 + ARetMember(tid, lsf(tid).lb) '), pre(gstate, lsf(tid0), pcf(tid0), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), a ≠ τ ∧ a.tid ≠ tid

Rule argument

term: pcf(tid0)

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; SetPC freely generated by idle, invInsert, invMember, retInsert, retMember;; ⊦ pre(gs, ls, retMember, a) ↔ (∃ b0. a = ARetMember(ls.tid, b0) ∧ (b0 ↔ ls.lb)); (s) ⊦ ARetMember(tid, b) ≠ τ; (s) ⊦ ARetMember(tid, b).tid = tid; (s) ⊦ pre(gs, ls, retInsert, a) ↔ (∃ b0. a = ARetInsert(ls.tid, b0) ∧ (b0 ↔ ls.lb)); (s) ⊦ ARetInsert(tid, b) ≠ τ; (s) ⊦ ARetInsert(tid, b).tid = tid; (s) ⊦ pre(gs, ls, invMember, a) ↔ a = ADoMember(ls.tid); (s) ⊦ ADoMember(tid) ≠ τ; (s) ⊦ ADoMember(tid).tid = tid; (s) ⊦ pre(gs, ls, invInsert, a) ↔ (∃ b. a = ADoInsert(ls.tid, b)); (s) ⊦ ADoInsert(tid, b) ≠ τ; (s) ⊦ ADoInsert(tid, b).tid = tid; (s)

Proof step 86 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retMember, pcf(tid0) = idle, tid0 ≠ tid, SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1, al0 + ARetMember(tid, lsf(tid).lb) '), pre(gstate, lsf(tid0), pcf(tid0), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), a ≠ τ ∧ a.tid ≠ tid

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 87:
# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid0 := lstepf(gstate, lsf(tid0), idle, a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), idle, a))) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retMember, pcf(tid0) = idle, tid0 ≠ tid, SetInv(gstate, lsf(tid0 := lstepf(gstate, lsf(tid0), idle, a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), idle, a))), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid0 := lstepf(gstate, lsf(tid0), idle, a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), idle, a))) ' + sl1, al0 + ARetMember(tid, lsf(tid).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid, a = AInvInsert(tid0, e) ∧ e ≠ ⊥ ∨ a = AInvMember(tid0, e0) ∧ e0 ≠ ⊥ ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid0 := lstepf(gstate, lsf(tid0), idle, a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), idle, a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid0 := lstepf(gstate, lsf(tid0), idle, a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), idle, a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid0 := lstepf(gstate, lsf(tid0), idle, a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), idle, a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), a ≠ τ ∧ a.tid ≠ tid

Rule argument

Additional information

Used simplifier rules: inv-tid: ⊦ SetInv(gstate, lsf, pcf) → lsf(tid).tid = tid; a: ⊦ (x + y) + z = x + y + z; from specification list ⊦ gstepf(gs, ls, idle, a) = gs; (s) ⊦ pre(gs, ls, idle, a) ↔ (∃ e. a = AInvInsert(ls.tid, e) ∧ e ≠ ⊥) ∨ (∃ e. a = AInvMember(ls.tid, e) ∧ e ≠ ⊥); (s)

Proof step 87 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, (mkstate(gstate, lsf(tid0 := lstepf(gstate, lsf(tid0), idle, a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), idle, a))) ' + sl1)[n] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retMember, pcf(tid0) = idle, tid0 ≠ tid, SetInv(gstate, lsf(tid0 := lstepf(gstate, lsf(tid0), idle, a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), idle, a))), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) (mkstate(gstate, lsf(tid0 := lstepf(gstate, lsf(tid0), idle, a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), idle, a))) ' + sl1, al0 + ARetMember(tid, lsf(tid).lb) '), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid, a = AInvInsert(tid0, e) ∧ e ≠ ⊥ ∨ a = AInvMember(tid0, e0) ∧ e0 ≠ ⊥ ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid0 := lstepf(gstate, lsf(tid0), idle, a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), idle, a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid0 := lstepf(gstate, lsf(tid0), idle, a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), idle, a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate(gstate, lsf(tid0 := lstepf(gstate, lsf(tid0), idle, a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), idle, a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), a ≠ τ ∧ a.tid ≠ tid

User applied rule case distinction

And closed the goal!

Rule argument

pos: left 10

Additional information

Used simplifier rules: ⊦ AInvMember(tid, e) ≠ τ; (s) ⊦ AInvMember(tid, e).tid = tid; (s) ⊦ AInvInsert(tid, e) ≠ τ; (s) ⊦ AInvInsert(tid, e).tid = tid; (s)

Proof step 88 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retMember, tid0 ≠ tid, SetInv(gstate, lsf, pcf), SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1, al0 + ARetMember(tid, lsf(tid).lb) '), pre(gstate, lsf(tid0), pcf(tid0), a), m ≤ # al0, ¬ m < # a ', ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), al0[m - # a '] ≠ τ ∧ al0[m - # a '].tid ≠ tid

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 89:
# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retMember, m ≠ 0, tid0 ≠ tid, SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1, al0 + ARetMember(tid, lsf(tid).lb) '), pre(gstate, lsf(tid0), pcf(tid0), a), m ≤ # al0, ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), al0[m - 1] ≠ τ ∧ al0[m - 1].tid ≠ tid

Rule argument

Additional information

Used simplifier rules: ⊦ # a ' = 0 +1; (s) ⊦ m < 1 ↔ m = 0; (s)

Proof step 89 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retMember, m ≠ 0, tid0 ≠ tid, SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))), SetInv(gstate, lsf, pcf), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1, al0 + ARetMember(tid, lsf(tid).lb) '), pre(gstate, lsf(tid0), pcf(tid0), a), m ≤ # al0, ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), al0[m - 1] ≠ τ ∧ al0[m - 1].tid ≠ tid

Heuristic elimination applied rule apply elim lemma

And obtained the following new goals

Proof step 90:
# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), m = m1 + 1, pcf(tid) = retMember, m ≠ 0, tid0 ≠ tid, SetInv(gstate, lsf, pcf), SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1, al0 + ARetMember(tid, lsf(tid).lb) '), pre(gstate, lsf(tid0), pcf(tid0), a), m ≤ # al0, ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), al0[m1] ≠ τ ∧ al0[m1].tid ≠ tid

Rule argument

spec: nat, name:elim-pred-c, seq:n ≠ 0 ⊦ m = n - 1 ↔ n = m + 1, subst:[n, m] → [m, m1]

Additional information

Used simplifier rules: n ≠ 0 ⊦ m = n - 1 ↔ n = m + 1; (elim) Used terms: m, m1

Proof step 90 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), m = m1 + 1, pcf(tid) = retMember, m ≠ 0, tid0 ≠ tid, SetInv(gstate, lsf, pcf), SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1, al0 + ARetMember(tid, lsf(tid).lb) '), pre(gstate, lsf(tid0), pcf(tid0), a), m ≤ # al0, ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), al0[m1] ≠ τ ∧ al0[m1].tid ≠ tid

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 91:
# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retMember, al0 ≠ [], tid0 ≠ tid, m1 < # al0, SetInv(gstate, lsf, pcf), SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1, al0 + ARetMember(tid, lsf(tid).lb) '), pre(gstate, lsf(tid0), pcf(tid0), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), al0[m1] ≠ τ ∧ al0[m1].tid ≠ tid

Rule argument

Additional information

Used simplifier rules: ⊦ # x = 0 ↔ x = []; (s) f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic c: ⊦ m + n = n + m; from specification nat-basic a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic ⊦ m + 1 ≤ n ↔ m < n; (s) ⊦ m + 1 ≠ 0; (s)

Proof step 91 from proof frag-retMem (previous step) (back to tree)

# sl1 = # al0 + 1, ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n ] = mkstate(gstate1, lsf1, pcf1), pcf(tid) = retMember, al0 ≠ [], tid0 ≠ tid, m1 < # al0, SetInv(gstate, lsf, pcf), SetInv (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))), frag*(IOAut(setInit, setStep, setExt)) ( mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1, al0 + ARetMember(tid, lsf(tid).lb) '), pre(gstate, lsf(tid0), pcf(tid0), a), ∀ m. m < # al0 → al0[m] ≠ τ ∧ al0[m].tid ≠ tid ⊦ ∃ n0. ¬ # al0 < n0 ∧ (a ' + al0)[n0] = ADoMember(tid) ∧ ( lsf(tid).lb ↔ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .lsf (tid) .le ∈ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .gstate .set) ∧ ( mkstate(gstate, lsf, pcf) ' + mkstate (gstepf(gstate, lsf(tid0), pcf(tid0), a), lsf(tid0 := lstepf(gstate, lsf(tid0), pcf(tid0), a)), pcf(tid0 := pcstepf(gstate, lsf(tid0), pcf(tid0), a))) ' + sl1 )[n0 ] .pcf (tid) = invMember ∧ (∀ m0. n0 < m0 ∧ ¬ # al0 < m0 → (a ' + al0)[m0] ≠ τ ∧ (a ' + al0)[m0].tid ≠ tid), al0[m1] ≠ τ ∧ al0[m1].tid ≠ tid