[STATEMENT]
lemma Label_Proc_CFG_Entry_Exit_path_Main:
  assumes "Rep_wf_prog wfp = (prog,procs)" and "l < #:prog"
  obtains as as' where "wfp \<turnstile> (Main,Label l) -as\<rightarrow>* (Main,Exit)"
  and "\<forall>a \<in> set as. intra_kind (kind a)"
  and "wfp \<turnstile> (Main,Entry) -as'\<rightarrow>* (Main,Label l)"
  and "\<forall>a \<in> set as'. intra_kind (kind a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>as as'. \<lbrakk>ProcCFG.path wfp (Main, Label l) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); ProcCFG.path wfp (Main, Entry) as' (Main, Label l); \<forall>a\<in>set as'. intra_kind (kind a)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
proof(atomize_elim)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>Rep_wf_prog wfp = (prog,procs)\<close>
[PROOF STATE]
proof (chain)
picking this:
Rep_wf_prog wfp = (prog, procs)
[PROOF STEP]
have wf:"well_formed procs"
[PROOF STATE]
proof (prove)
using this:
Rep_wf_prog wfp = (prog, procs)

goal (1 subgoal):
 1. well_formed procs
[PROOF STEP]
by(fastforce intro:wf_wf_prog)
[PROOF STATE]
proof (state)
this:
well_formed procs

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>l < #:prog\<close> \<open>Rep_wf_prog wfp = (prog,procs)\<close>
[PROOF STATE]
proof (chain)
picking this:
l < #:prog
Rep_wf_prog wfp = (prog, procs)
[PROOF STEP]
show "\<exists>as as'. wfp \<turnstile> (Main, Label l) -as\<rightarrow>* (Main, Exit) \<and>
    (\<forall>a\<in>set as. intra_kind (kind a)) \<and>
    wfp \<turnstile> (Main, Entry) -as'\<rightarrow>* (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))"
[PROOF STATE]
proof (prove)
using this:
l < #:prog
Rep_wf_prog wfp = (prog, procs)

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
proof(induct prog arbitrary:l wfp)
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. \<And>l wfp. \<lbrakk>l < #:Skip; Rep_wf_prog wfp = (Skip, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 x2 l wfp. \<lbrakk>l < #:x1:=x2; Rep_wf_prog wfp = (x1:=x2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:prog1;; prog2; Rep_wf_prog wfp = (prog1;; prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 4. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 5. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 6. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
case Skip
[PROOF STATE]
proof (state)
this:
l < #:Skip
Rep_wf_prog wfp = (Skip, procs)

goal (6 subgoals):
 1. \<And>l wfp. \<lbrakk>l < #:Skip; Rep_wf_prog wfp = (Skip, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 x2 l wfp. \<lbrakk>l < #:x1:=x2; Rep_wf_prog wfp = (x1:=x2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:prog1;; prog2; Rep_wf_prog wfp = (prog1;; prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 4. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 5. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 6. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
note [simp] = \<open>Rep_wf_prog wfp = (Skip, procs)\<close>
[PROOF STATE]
proof (state)
this:
Rep_wf_prog wfp = (Skip, procs)

goal (6 subgoals):
 1. \<And>l wfp. \<lbrakk>l < #:Skip; Rep_wf_prog wfp = (Skip, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 x2 l wfp. \<lbrakk>l < #:x1:=x2; Rep_wf_prog wfp = (x1:=x2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:prog1;; prog2; Rep_wf_prog wfp = (prog1;; prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 4. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 5. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 6. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>l < #:Skip\<close>
[PROOF STATE]
proof (chain)
picking this:
l < #:Skip
[PROOF STEP]
have [simp]:"l = 0"
[PROOF STATE]
proof (prove)
using this:
l < #:Skip

goal (1 subgoal):
 1. l = 0
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
l = 0

goal (6 subgoals):
 1. \<And>l wfp. \<lbrakk>l < #:Skip; Rep_wf_prog wfp = (Skip, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 x2 l wfp. \<lbrakk>l < #:x1:=x2; Rep_wf_prog wfp = (x1:=x2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:prog1;; prog2; Rep_wf_prog wfp = (prog1;; prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 4. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 5. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 6. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
have "wfp \<turnstile> (Main,Entry) -[((Main,Entry),(\<lambda>s. True)\<^sub>\<surd>,(Main,Label 0))]\<rightarrow>*
      (Main,Label 0)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label 0)
[PROOF STEP]
by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_Entry
                   simp:valid_edge_def ProcCFG.valid_node_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label 0)

goal (6 subgoals):
 1. \<And>l wfp. \<lbrakk>l < #:Skip; Rep_wf_prog wfp = (Skip, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 x2 l wfp. \<lbrakk>l < #:x1:=x2; Rep_wf_prog wfp = (x1:=x2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:prog1;; prog2; Rep_wf_prog wfp = (prog1;; prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 4. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 5. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 6. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label 0)

goal (6 subgoals):
 1. \<And>l wfp. \<lbrakk>l < #:Skip; Rep_wf_prog wfp = (Skip, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 x2 l wfp. \<lbrakk>l < #:x1:=x2; Rep_wf_prog wfp = (x1:=x2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:prog1;; prog2; Rep_wf_prog wfp = (prog1;; prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 4. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 5. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 6. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
have "wfp \<turnstile> (Main,Label l) -[((Main,Label l),\<Up>id,(Main,Exit))]\<rightarrow>* (Main,Exit)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Label l) [((Main, Label l), \<Up>id, Main, Exit)] (Main, Exit)
[PROOF STEP]
by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_Skip simp:valid_edge_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label l) [((Main, Label l), \<Up>id, Main, Exit)] (Main, Exit)

goal (6 subgoals):
 1. \<And>l wfp. \<lbrakk>l < #:Skip; Rep_wf_prog wfp = (Skip, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 x2 l wfp. \<lbrakk>l < #:x1:=x2; Rep_wf_prog wfp = (x1:=x2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:prog1;; prog2; Rep_wf_prog wfp = (prog1;; prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 4. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 5. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 6. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label 0)
ProcCFG.path wfp (Main, Label l) [((Main, Label l), \<Up>id, Main, Exit)] (Main, Exit)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label 0)
ProcCFG.path wfp (Main, Label l) [((Main, Label l), \<Up>id, Main, Exit)] (Main, Exit)

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
by(fastforce simp:intra_kind_def)
[PROOF STATE]
proof (state)
this:
\<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (5 subgoals):
 1. \<And>x1 x2 l wfp. \<lbrakk>l < #:x1:=x2; Rep_wf_prog wfp = (x1:=x2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:prog1;; prog2; Rep_wf_prog wfp = (prog1;; prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 4. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 5. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>x1 x2 l wfp. \<lbrakk>l < #:x1:=x2; Rep_wf_prog wfp = (x1:=x2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:prog1;; prog2; Rep_wf_prog wfp = (prog1;; prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 4. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 5. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
case (LAss V e)
[PROOF STATE]
proof (state)
this:
l < #:V:=e
Rep_wf_prog wfp = (V:=e, procs)

goal (5 subgoals):
 1. \<And>x1 x2 l wfp. \<lbrakk>l < #:x1:=x2; Rep_wf_prog wfp = (x1:=x2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:prog1;; prog2; Rep_wf_prog wfp = (prog1;; prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 4. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 5. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
note [simp] = \<open>Rep_wf_prog wfp = (V:=e, procs)\<close>
[PROOF STATE]
proof (state)
this:
Rep_wf_prog wfp = (V:=e, procs)

goal (5 subgoals):
 1. \<And>x1 x2 l wfp. \<lbrakk>l < #:x1:=x2; Rep_wf_prog wfp = (x1:=x2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:prog1;; prog2; Rep_wf_prog wfp = (prog1;; prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 4. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 5. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>l < #:V:=e\<close>
[PROOF STATE]
proof (chain)
picking this:
l < #:V:=e
[PROOF STEP]
have "l = 0 \<or> l = 1"
[PROOF STATE]
proof (prove)
using this:
l < #:V:=e

goal (1 subgoal):
 1. l = 0 \<or> l = 1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
l = 0 \<or> l = 1

goal (5 subgoals):
 1. \<And>x1 x2 l wfp. \<lbrakk>l < #:x1:=x2; Rep_wf_prog wfp = (x1:=x2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:prog1;; prog2; Rep_wf_prog wfp = (prog1;; prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 4. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 5. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
l = 0 \<or> l = 1

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l = 1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
assume [simp]:"l = 0"
[PROOF STATE]
proof (state)
this:
l = 0

goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l = 1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
have "wfp \<turnstile> (Main,Entry) -[((Main,Entry),(\<lambda>s. True)\<^sub>\<surd>,(Main,Label 0))]\<rightarrow>*
        (Main,Label 0)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label 0)
[PROOF STEP]
by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_Entry
                    simp:valid_edge_def ProcCFG.valid_node_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label 0)

goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l = 1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label 0)

goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l = 1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
have "wfp \<turnstile> (Main,Label 0)
        -((Main,Label 0),\<Up>(\<lambda>cf. update cf V e),(Main,Label 1))#
        [((Main,Label 1),\<Up>id,(Main,Exit))]\<rightarrow>* (Main,Exit)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Label 0) [((Main, Label 0), \<Up>\<lambda>cf. update cf V e, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)
[PROOF STEP]
by(fastforce intro:ProcCFG.Cons_path ProcCFG.path.intros Main Proc_CFG_LAss
          Proc_CFG_LAssSkip simp:valid_edge_def ProcCFG.valid_node_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label 0) [((Main, Label 0), \<Up>\<lambda>cf. update cf V e, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)

goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l = 1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label 0)
ProcCFG.path wfp (Main, Label 0) [((Main, Label 0), \<Up>\<lambda>cf. update cf V e, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label 0)
ProcCFG.path wfp (Main, Label 0) [((Main, Label 0), \<Up>\<lambda>cf. update cf V e, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
by(fastforce simp:intra_kind_def)
[PROOF STATE]
proof (state)
this:
\<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (1 subgoal):
 1. l = 1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. l = 1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
assume [simp]:"l = 1"
[PROOF STATE]
proof (state)
this:
l = 1

goal (1 subgoal):
 1. l = 1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
have "wfp \<turnstile> (Main,Entry) -((Main,Entry),(\<lambda>s. True)\<^sub>\<surd>,(Main,Label 0))#
        [((Main,Label 0),\<Up>(\<lambda>cf. update cf V e),(Main,Label 1))]\<rightarrow>* (Main,Label 1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0), ((Main, Label 0), \<Up>\<lambda>cf. update cf V e, Main, Label 1)] (Main, Label 1)
[PROOF STEP]
by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_LAss ProcCFG.Cons_path
          Main Proc_CFG_Entry simp:ProcCFG.valid_node_def valid_edge_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0), ((Main, Label 0), \<Up>\<lambda>cf. update cf V e, Main, Label 1)] (Main, Label 1)

goal (1 subgoal):
 1. l = 1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0), ((Main, Label 0), \<Up>\<lambda>cf. update cf V e, Main, Label 1)] (Main, Label 1)

goal (1 subgoal):
 1. l = 1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
have "wfp \<turnstile> (Main,Label 1) -[((Main,Label 1),\<Up>id,(Main,Exit))]\<rightarrow>*
        (Main,Exit)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Label 1) [((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)
[PROOF STEP]
by(fastforce intro:ProcCFG.path.intros  Main Proc_CFG_LAssSkip
        simp:valid_edge_def ProcCFG.valid_node_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label 1) [((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)

goal (1 subgoal):
 1. l = 1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0), ((Main, Label 0), \<Up>\<lambda>cf. update cf V e, Main, Label 1)] (Main, Label 1)
ProcCFG.path wfp (Main, Label 1) [((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0), ((Main, Label 0), \<Up>\<lambda>cf. update cf V e, Main, Label 1)] (Main, Label 1)
ProcCFG.path wfp (Main, Label 1) [((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
by(fastforce simp:intra_kind_def)
[PROOF STATE]
proof (state)
this:
\<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (4 subgoals):
 1. \<And>prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:prog1;; prog2; Rep_wf_prog wfp = (prog1;; prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 4. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:prog1;; prog2; Rep_wf_prog wfp = (prog1;; prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 4. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
case (Seq c\<^sub>1 c\<^sub>2)
[PROOF STATE]
proof (state)
this:
\<lbrakk>?l < #:c\<^sub>1; Rep_wf_prog ?wfp = (c\<^sub>1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path ?wfp (Main, Label ?l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path ?wfp (Main, Entry) as' (Main, Label ?l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
\<lbrakk>?l < #:c\<^sub>2; Rep_wf_prog ?wfp = (c\<^sub>2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path ?wfp (Main, Label ?l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path ?wfp (Main, Entry) as' (Main, Label ?l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
l < #:c\<^sub>1;; c\<^sub>2
Rep_wf_prog wfp = (c\<^sub>1;; c\<^sub>2, procs)

goal (4 subgoals):
 1. \<And>prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:prog1;; prog2; Rep_wf_prog wfp = (prog1;; prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 4. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
note IH1 = \<open>\<And>l wfp. \<lbrakk>l < #:c\<^sub>1; Rep_wf_prog wfp = (c\<^sub>1, procs)\<rbrakk> \<Longrightarrow>
      \<exists>as as'. wfp \<turnstile> (Main, Label l) -as\<rightarrow>* (Main, Exit) \<and>
      (\<forall>a\<in>set as. intra_kind (kind a)) \<and>
      wfp \<turnstile> (Main, Entry) -as'\<rightarrow>* (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))\<close>
[PROOF STATE]
proof (state)
this:
\<lbrakk>?l < #:c\<^sub>1; Rep_wf_prog ?wfp = (c\<^sub>1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path ?wfp (Main, Label ?l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path ?wfp (Main, Entry) as' (Main, Label ?l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (4 subgoals):
 1. \<And>prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:prog1;; prog2; Rep_wf_prog wfp = (prog1;; prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 4. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
note IH2 = \<open>\<And>l wfp. \<lbrakk>l < #:c\<^sub>2; Rep_wf_prog wfp = (c\<^sub>2, procs)\<rbrakk> \<Longrightarrow>
      \<exists>as as'. wfp \<turnstile> (Main, Label l) -as\<rightarrow>* (Main, Exit) \<and>
      (\<forall>a\<in>set as. intra_kind (kind a)) \<and>
      wfp \<turnstile> (Main, Entry) -as'\<rightarrow>* (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))\<close>
[PROOF STATE]
proof (state)
this:
\<lbrakk>?l < #:c\<^sub>2; Rep_wf_prog ?wfp = (c\<^sub>2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path ?wfp (Main, Label ?l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path ?wfp (Main, Entry) as' (Main, Label ?l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (4 subgoals):
 1. \<And>prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:prog1;; prog2; Rep_wf_prog wfp = (prog1;; prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 4. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
note [simp] = \<open>Rep_wf_prog wfp = (c\<^sub>1;; c\<^sub>2, procs)\<close>
[PROOF STATE]
proof (state)
this:
Rep_wf_prog wfp = (c\<^sub>1;; c\<^sub>2, procs)

goal (4 subgoals):
 1. \<And>prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:prog1;; prog2; Rep_wf_prog wfp = (prog1;; prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 4. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
proof(cases "l < #:c\<^sub>1")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
l < #:c\<^sub>1

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>Rep_wf_prog wfp = (c\<^sub>1;; c\<^sub>2, procs)\<close>
[PROOF STATE]
proof (chain)
picking this:
Rep_wf_prog wfp = (c\<^sub>1;; c\<^sub>2, procs)
[PROOF STEP]
obtain wfp' where [simp]:"Rep_wf_prog wfp' = (c\<^sub>1, procs)"
[PROOF STATE]
proof (prove)
using this:
Rep_wf_prog wfp = (c\<^sub>1;; c\<^sub>2, procs)

goal (1 subgoal):
 1. (\<And>wfp'. Rep_wf_prog wfp' = (c\<^sub>1, procs) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(erule wfp_Seq1)
[PROOF STATE]
proof (state)
this:
Rep_wf_prog wfp' = (c\<^sub>1, procs)

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from IH1[OF True this]
[PROOF STATE]
proof (chain)
picking this:
\<exists>as as'. ProcCFG.path wfp' (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp' (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
obtain as as'
        where path1:"wfp' \<turnstile> (Main, Label l) -as\<rightarrow>* (Main, Exit)"
        and intra1:"\<forall>a\<in>set as. intra_kind (kind a)"
        and path2:"wfp' \<turnstile> (Main, Entry) -as'\<rightarrow>* (Main, Label l)"
        and intra2:"\<forall>a\<in>set as'. intra_kind (kind a)"
[PROOF STATE]
proof (prove)
using this:
\<exists>as as'. ProcCFG.path wfp' (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp' (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (1 subgoal):
 1. (\<And>as as'. \<lbrakk>ProcCFG.path wfp' (Main, Label l) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); ProcCFG.path wfp' (Main, Entry) as' (Main, Label l); \<forall>a\<in>set as'. intra_kind (kind a)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp' (Main, Label l) as (Main, Exit)
\<forall>a\<in>set as. intra_kind (kind a)
ProcCFG.path wfp' (Main, Entry) as' (Main, Label l)
\<forall>a\<in>set as'. intra_kind (kind a)

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from path1
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp' (Main, Label l) as (Main, Exit)
[PROOF STEP]
have "as \<noteq> []"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp' (Main, Label l) as (Main, Exit)

goal (1 subgoal):
 1. as \<noteq> []
[PROOF STEP]
by(fastforce elim:ProcCFG.path.cases)
[PROOF STATE]
proof (state)
this:
as \<noteq> []

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
as \<noteq> []
[PROOF STEP]
obtain ax asx where [simp]:"as = asx@[ax]"
[PROOF STATE]
proof (prove)
using this:
as \<noteq> []

goal (1 subgoal):
 1. (\<And>asx ax. as = asx @ [ax] \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(cases as rule:rev_cases) fastforce+
[PROOF STATE]
proof (state)
this:
as = asx @ [ax]

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with path1
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp' (Main, Label l) as (Main, Exit)
as = asx @ [ax]
[PROOF STEP]
have "wfp' \<turnstile> (Main, Label l) -asx\<rightarrow>* sourcenode ax"
        and "valid_edge wfp' ax" and "targetnode ax = (Main, Exit)"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp' (Main, Label l) as (Main, Exit)
as = asx @ [ax]

goal (1 subgoal):
 1. ProcCFG.path wfp' (Main, Label l) asx (sourcenode ax) &&& valid_edge wfp' ax &&& targetnode ax = (Main, Exit)
[PROOF STEP]
by(auto elim:ProcCFG.path_split_snoc)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp' (Main, Label l) asx (sourcenode ax)
valid_edge wfp' ax
targetnode ax = (Main, Exit)

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>valid_edge wfp' ax\<close> \<open>targetnode ax = (Main, Exit)\<close>
[PROOF STATE]
proof (chain)
picking this:
valid_edge wfp' ax
targetnode ax = (Main, Exit)
[PROOF STEP]
obtain nx where "sourcenode ax = (Main,nx)"
[PROOF STATE]
proof (prove)
using this:
valid_edge wfp' ax
targetnode ax = (Main, Exit)

goal (1 subgoal):
 1. (\<And>nx. sourcenode ax = (Main, nx) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(fastforce elim:PCFG.cases simp:valid_edge_def)
[PROOF STATE]
proof (state)
this:
sourcenode ax = (Main, nx)

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with \<open>wfp' \<turnstile> (Main, Label l) -asx\<rightarrow>* sourcenode ax\<close>
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp' (Main, Label l) asx (sourcenode ax)
sourcenode ax = (Main, nx)
[PROOF STEP]
have "nx \<noteq> Entry"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp' (Main, Label l) asx (sourcenode ax)
sourcenode ax = (Main, nx)

goal (1 subgoal):
 1. nx \<noteq> Entry
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
nx \<noteq> Entry

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
nx \<noteq> Entry

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>valid_edge wfp' ax\<close> \<open>sourcenode ax = (Main,nx)\<close>
[PROOF STATE]
proof (chain)
picking this:
valid_edge wfp' ax
sourcenode ax = (Main, nx)
[PROOF STEP]
have "nx \<noteq> Exit"
[PROOF STATE]
proof (prove)
using this:
valid_edge wfp' ax
sourcenode ax = (Main, nx)

goal (1 subgoal):
 1. nx \<noteq> Exit
[PROOF STEP]
by(fastforce intro:ProcCFGExit.Exit_source)
[PROOF STATE]
proof (state)
this:
nx \<noteq> Exit

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
nx \<noteq> Entry
nx \<noteq> Exit
[PROOF STEP]
obtain lx where [simp]:"nx = Label lx"
[PROOF STATE]
proof (prove)
using this:
nx \<noteq> Entry
nx \<noteq> Exit

goal (1 subgoal):
 1. (\<And>lx. nx = Label lx \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(cases nx) auto
[PROOF STATE]
proof (state)
this:
nx = Label lx

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with \<open>wfp' \<turnstile> (Main, Label l) -asx\<rightarrow>* sourcenode ax\<close>
        \<open>sourcenode ax = (Main,nx)\<close> intra1
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp' (Main, Label l) asx (sourcenode ax)
sourcenode ax = (Main, nx)
\<forall>a\<in>set as. intra_kind (kind a)
nx = Label lx
[PROOF STEP]
have path3:"wfp \<turnstile> (Main, Label l) -asx\<rightarrow>* (Main, Label lx)"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp' (Main, Label l) asx (sourcenode ax)
sourcenode ax = (Main, nx)
\<forall>a\<in>set as. intra_kind (kind a)
nx = Label lx

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Label l) asx (Main, Label lx)
[PROOF STEP]
by -(rule path_SeqFirst,auto)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label l) asx (Main, Label lx)

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>valid_edge wfp' ax\<close> \<open>targetnode ax = (Main, Exit)\<close>
        \<open>sourcenode ax = (Main,nx)\<close> wf
[PROOF STATE]
proof (chain)
picking this:
valid_edge wfp' ax
targetnode ax = (Main, Exit)
sourcenode ax = (Main, nx)
well_formed procs
[PROOF STEP]
obtain etx where "c\<^sub>1 \<turnstile> Label lx -etx\<rightarrow>\<^sub>p Exit"
[PROOF STATE]
proof (prove)
using this:
valid_edge wfp' ax
targetnode ax = (Main, Exit)
sourcenode ax = (Main, nx)
well_formed procs

goal (1 subgoal):
 1. (\<And>etx. c\<^sub>1 \<turnstile> Label lx -etx\<rightarrow>\<^sub>p Exit \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(fastforce elim!:PCFG.cases simp:valid_edge_def)
[PROOF STATE]
proof (state)
this:
c\<^sub>1 \<turnstile> Label lx -etx\<rightarrow>\<^sub>p Exit

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
c\<^sub>1 \<turnstile> Label lx -etx\<rightarrow>\<^sub>p Exit
[PROOF STEP]
obtain et where [simp]:"etx = IEdge et"
[PROOF STATE]
proof (prove)
using this:
c\<^sub>1 \<turnstile> Label lx -etx\<rightarrow>\<^sub>p Exit

goal (1 subgoal):
 1. (\<And>et. etx = IEdge et \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(cases etx)(auto dest:Proc_CFG_Call_Labels)
[PROOF STATE]
proof (state)
this:
etx = IEdge et

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with \<open>c\<^sub>1 \<turnstile> Label lx -etx\<rightarrow>\<^sub>p Exit\<close>
[PROOF STATE]
proof (chain)
picking this:
c\<^sub>1 \<turnstile> Label lx -etx\<rightarrow>\<^sub>p Exit
etx = IEdge et
[PROOF STEP]
have "intra_kind et"
[PROOF STATE]
proof (prove)
using this:
c\<^sub>1 \<turnstile> Label lx -etx\<rightarrow>\<^sub>p Exit
etx = IEdge et

goal (1 subgoal):
 1. intra_kind et
[PROOF STEP]
by(fastforce intro:Proc_CFG_IEdge_intra_kind)
[PROOF STATE]
proof (state)
this:
intra_kind et

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>c\<^sub>1 \<turnstile> Label lx -etx\<rightarrow>\<^sub>p Exit\<close> path3
[PROOF STATE]
proof (chain)
picking this:
c\<^sub>1 \<turnstile> Label lx -etx\<rightarrow>\<^sub>p Exit
ProcCFG.path wfp (Main, Label l) asx (Main, Label lx)
[PROOF STEP]
have path4:"wfp \<turnstile> (Main, Label l) -asx@
        [((Main, Label lx),et,(Main,Label 0 \<oplus> #:c\<^sub>1))] \<rightarrow>* (Main,Label 0 \<oplus> #:c\<^sub>1)"
[PROOF STATE]
proof (prove)
using this:
c\<^sub>1 \<turnstile> Label lx -etx\<rightarrow>\<^sub>p Exit
ProcCFG.path wfp (Main, Label l) asx (Main, Label lx)

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Label l) (asx @ [((Main, Label lx), et, Main, Label 0 \<oplus> #:c\<^sub>1)]) (Main, Label 0 \<oplus> #:c\<^sub>1)
[PROOF STEP]
by(fastforce intro:ProcCFG.path_Append ProcCFG.path.intros Proc_CFG_SeqConnect
          Main simp:ProcCFG.valid_node_def valid_edge_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label l) (asx @ [((Main, Label lx), et, Main, Label 0 \<oplus> #:c\<^sub>1)]) (Main, Label 0 \<oplus> #:c\<^sub>1)

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>Rep_wf_prog wfp = (c\<^sub>1;; c\<^sub>2, procs)\<close>
[PROOF STATE]
proof (chain)
picking this:
Rep_wf_prog wfp = (c\<^sub>1;; c\<^sub>2, procs)
[PROOF STEP]
obtain wfp'' where [simp]:"Rep_wf_prog wfp'' = (c\<^sub>2, procs)"
[PROOF STATE]
proof (prove)
using this:
Rep_wf_prog wfp = (c\<^sub>1;; c\<^sub>2, procs)

goal (1 subgoal):
 1. (\<And>wfp''. Rep_wf_prog wfp'' = (c\<^sub>2, procs) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(erule wfp_Seq2)
[PROOF STATE]
proof (state)
this:
Rep_wf_prog wfp'' = (c\<^sub>2, procs)

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from IH2[OF _ this,of "0"]
[PROOF STATE]
proof (chain)
picking this:
0 < #:c\<^sub>2 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp'' (Main, Label 0) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp'' (Main, Entry) as' (Main, Label 0) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
obtain asx'
        where "wfp'' \<turnstile> (Main, Label 0) -asx'\<rightarrow>* (Main, Exit)"
        and "\<forall>a\<in>set asx'. intra_kind (kind a)"
[PROOF STATE]
proof (prove)
using this:
0 < #:c\<^sub>2 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp'' (Main, Label 0) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp'' (Main, Entry) as' (Main, Label 0) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (1 subgoal):
 1. (\<And>asx'. \<lbrakk>ProcCFG.path wfp'' (Main, Label 0) asx' (Main, Exit); \<forall>a\<in>set asx'. intra_kind (kind a)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp'' (Main, Label 0) asx' (Main, Exit)
\<forall>a\<in>set asx'. intra_kind (kind a)

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with path4 intra1 \<open>intra_kind et\<close>
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp (Main, Label l) (asx @ [((Main, Label lx), et, Main, Label 0 \<oplus> #:c\<^sub>1)]) (Main, Label 0 \<oplus> #:c\<^sub>1)
\<forall>a\<in>set as. intra_kind (kind a)
intra_kind et
ProcCFG.path wfp'' (Main, Label 0) asx' (Main, Exit)
\<forall>a\<in>set asx'. intra_kind (kind a)
[PROOF STEP]
have "wfp \<turnstile> (Main, Label l)
        -(asx@[((Main, Label lx),et,(Main,Label 0 \<oplus> #:c\<^sub>1))])@(asx' \<oplus>s #:c\<^sub>1)\<rightarrow>*
        (Main, Exit \<oplus> #:c\<^sub>1)"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Label l) (asx @ [((Main, Label lx), et, Main, Label 0 \<oplus> #:c\<^sub>1)]) (Main, Label 0 \<oplus> #:c\<^sub>1)
\<forall>a\<in>set as. intra_kind (kind a)
intra_kind et
ProcCFG.path wfp'' (Main, Label 0) asx' (Main, Exit)
\<forall>a\<in>set asx'. intra_kind (kind a)

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Label l) ((asx @ [((Main, Label lx), et, Main, Label 0 \<oplus> #:c\<^sub>1)]) @ (asx' \<oplus>s #:c\<^sub>1)) (Main, Exit \<oplus> #:c\<^sub>1)
[PROOF STEP]
by -(erule ProcCFG.path_Append,rule path_Main_SeqSecond,auto)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label l) ((asx @ [((Main, Label lx), et, Main, Label 0 \<oplus> #:c\<^sub>1)]) @ (asx' \<oplus>s #:c\<^sub>1)) (Main, Exit \<oplus> #:c\<^sub>1)

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label l) ((asx @ [((Main, Label lx), et, Main, Label 0 \<oplus> #:c\<^sub>1)]) @ (asx' \<oplus>s #:c\<^sub>1)) (Main, Exit \<oplus> #:c\<^sub>1)

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from intra1 \<open>intra_kind et\<close> \<open>\<forall>a\<in>set asx'. intra_kind (kind a)\<close>
[PROOF STATE]
proof (chain)
picking this:
\<forall>a\<in>set as. intra_kind (kind a)
intra_kind et
\<forall>a\<in>set asx'. intra_kind (kind a)
[PROOF STEP]
have "\<forall>a \<in> set ((asx@[((Main, Label lx),et,(Main,Label #:c\<^sub>1))])@(asx' \<oplus>s #:c\<^sub>1)).
        intra_kind (kind a)"
[PROOF STATE]
proof (prove)
using this:
\<forall>a\<in>set as. intra_kind (kind a)
intra_kind et
\<forall>a\<in>set asx'. intra_kind (kind a)

goal (1 subgoal):
 1. \<forall>a\<in>set ((asx @ [((Main, Label lx), et, Main, Label #:c\<^sub>1)]) @ (asx' \<oplus>s #:c\<^sub>1)). intra_kind (kind a)
[PROOF STEP]
by(auto simp:label_incrs_def)
[PROOF STATE]
proof (state)
this:
\<forall>a\<in>set ((asx @ [((Main, Label lx), et, Main, Label #:c\<^sub>1)]) @ (asx' \<oplus>s #:c\<^sub>1)). intra_kind (kind a)

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<forall>a\<in>set ((asx @ [((Main, Label lx), et, Main, Label #:c\<^sub>1)]) @ (asx' \<oplus>s #:c\<^sub>1)). intra_kind (kind a)

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from path2 intra2
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp' (Main, Entry) as' (Main, Label l)
\<forall>a\<in>set as'. intra_kind (kind a)
[PROOF STEP]
have "wfp \<turnstile> (Main, Entry) -as'\<rightarrow>* (Main, Label l)"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp' (Main, Entry) as' (Main, Label l)
\<forall>a\<in>set as'. intra_kind (kind a)

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Entry) as' (Main, Label l)
[PROOF STEP]
by -(rule path_SeqFirst,auto)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Entry) as' (Main, Label l)

goal (2 subgoals):
 1. l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp (Main, Label l) ((asx @ [((Main, Label lx), et, Main, Label 0 \<oplus> #:c\<^sub>1)]) @ (asx' \<oplus>s #:c\<^sub>1)) (Main, Exit \<oplus> #:c\<^sub>1)
\<forall>a\<in>set ((asx @ [((Main, Label lx), et, Main, Label #:c\<^sub>1)]) @ (asx' \<oplus>s #:c\<^sub>1)). intra_kind (kind a)
ProcCFG.path wfp (Main, Entry) as' (Main, Label l)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Label l) ((asx @ [((Main, Label lx), et, Main, Label 0 \<oplus> #:c\<^sub>1)]) @ (asx' \<oplus>s #:c\<^sub>1)) (Main, Exit \<oplus> #:c\<^sub>1)
\<forall>a\<in>set ((asx @ [((Main, Label lx), et, Main, Label #:c\<^sub>1)]) @ (asx' \<oplus>s #:c\<^sub>1)). intra_kind (kind a)
ProcCFG.path wfp (Main, Entry) as' (Main, Label l)

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
using \<open>\<forall>a\<in>set as'. intra_kind (kind a)\<close>
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Label l) ((asx @ [((Main, Label lx), et, Main, Label 0 \<oplus> #:c\<^sub>1)]) @ (asx' \<oplus>s #:c\<^sub>1)) (Main, Exit \<oplus> #:c\<^sub>1)
\<forall>a\<in>set ((asx @ [((Main, Label lx), et, Main, Label #:c\<^sub>1)]) @ (asx' \<oplus>s #:c\<^sub>1)). intra_kind (kind a)
ProcCFG.path wfp (Main, Entry) as' (Main, Label l)
\<forall>a\<in>set as'. intra_kind (kind a)

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
\<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> l < #:c\<^sub>1

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
hence "#:c\<^sub>1 \<le> l"
[PROOF STATE]
proof (prove)
using this:
\<not> l < #:c\<^sub>1

goal (1 subgoal):
 1. #:c\<^sub>1 \<le> l
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
#:c\<^sub>1 \<le> l

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
#:c\<^sub>1 \<le> l
[PROOF STEP]
obtain l' where [simp]:"l = l' + #:c\<^sub>1" and "l' = l - #:c\<^sub>1"
[PROOF STATE]
proof (prove)
using this:
#:c\<^sub>1 \<le> l

goal (1 subgoal):
 1. (\<And>l'. \<lbrakk>l = l' + #:c\<^sub>1; l' = l - #:c\<^sub>1\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
l = l' + #:c\<^sub>1
l' = l - #:c\<^sub>1

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>l < #:c\<^sub>1;; c\<^sub>2\<close>
[PROOF STATE]
proof (chain)
picking this:
l < #:c\<^sub>1;; c\<^sub>2
[PROOF STEP]
have "l' < #:c\<^sub>2"
[PROOF STATE]
proof (prove)
using this:
l < #:c\<^sub>1;; c\<^sub>2

goal (1 subgoal):
 1. l' < #:c\<^sub>2
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
l' < #:c\<^sub>2

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>Rep_wf_prog wfp = (c\<^sub>1;; c\<^sub>2, procs)\<close>
[PROOF STATE]
proof (chain)
picking this:
Rep_wf_prog wfp = (c\<^sub>1;; c\<^sub>2, procs)
[PROOF STEP]
obtain wfp' where [simp]:"Rep_wf_prog wfp' = (c\<^sub>2, procs)"
[PROOF STATE]
proof (prove)
using this:
Rep_wf_prog wfp = (c\<^sub>1;; c\<^sub>2, procs)

goal (1 subgoal):
 1. (\<And>wfp'. Rep_wf_prog wfp' = (c\<^sub>2, procs) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(erule wfp_Seq2)
[PROOF STATE]
proof (state)
this:
Rep_wf_prog wfp' = (c\<^sub>2, procs)

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from IH2[OF \<open>l' < #:c\<^sub>2\<close> this]
[PROOF STATE]
proof (chain)
picking this:
\<exists>as as'. ProcCFG.path wfp' (Main, Label l') as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp' (Main, Entry) as' (Main, Label l') \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
obtain as as'
        where path1:"wfp' \<turnstile> (Main, Label l') -as\<rightarrow>* (Main, Exit)"
        and intra1:"\<forall>a\<in>set as. intra_kind (kind a)"
        and path2:"wfp' \<turnstile> (Main, Entry) -as'\<rightarrow>* (Main, Label l')"
        and intra2:"\<forall>a\<in>set as'. intra_kind (kind a)"
[PROOF STATE]
proof (prove)
using this:
\<exists>as as'. ProcCFG.path wfp' (Main, Label l') as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp' (Main, Entry) as' (Main, Label l') \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (1 subgoal):
 1. (\<And>as as'. \<lbrakk>ProcCFG.path wfp' (Main, Label l') as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); ProcCFG.path wfp' (Main, Entry) as' (Main, Label l'); \<forall>a\<in>set as'. intra_kind (kind a)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp' (Main, Label l') as (Main, Exit)
\<forall>a\<in>set as. intra_kind (kind a)
ProcCFG.path wfp' (Main, Entry) as' (Main, Label l')
\<forall>a\<in>set as'. intra_kind (kind a)

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from path1 intra1
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp' (Main, Label l') as (Main, Exit)
\<forall>a\<in>set as. intra_kind (kind a)
[PROOF STEP]
have "wfp \<turnstile> (Main, Label l' \<oplus> #:c\<^sub>1) -as \<oplus>s #:c\<^sub>1\<rightarrow>* (Main, Exit \<oplus> #:c\<^sub>1)"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp' (Main, Label l') as (Main, Exit)
\<forall>a\<in>set as. intra_kind (kind a)

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Label l' \<oplus> #:c\<^sub>1) (as \<oplus>s #:c\<^sub>1) (Main, Exit \<oplus> #:c\<^sub>1)
[PROOF STEP]
by -(rule path_Main_SeqSecond,auto)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label l' \<oplus> #:c\<^sub>1) (as \<oplus>s #:c\<^sub>1) (Main, Exit \<oplus> #:c\<^sub>1)

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label l' \<oplus> #:c\<^sub>1) (as \<oplus>s #:c\<^sub>1) (Main, Exit \<oplus> #:c\<^sub>1)

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from path2
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp' (Main, Entry) as' (Main, Label l')
[PROOF STEP]
have "as' \<noteq> []"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp' (Main, Entry) as' (Main, Label l')

goal (1 subgoal):
 1. as' \<noteq> []
[PROOF STEP]
by(fastforce elim:ProcCFG.path.cases)
[PROOF STATE]
proof (state)
this:
as' \<noteq> []

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with path2
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp' (Main, Entry) as' (Main, Label l')
as' \<noteq> []
[PROOF STEP]
obtain ax' asx' where [simp]:"as' = ax'#asx'"
        and "sourcenode ax' = (Main, Entry)" and "valid_edge wfp' ax'"
        and "wfp' \<turnstile> targetnode ax' -asx'\<rightarrow>* (Main, Label l')"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp' (Main, Entry) as' (Main, Label l')
as' \<noteq> []

goal (1 subgoal):
 1. (\<And>ax' asx'. \<lbrakk>as' = ax' # asx'; sourcenode ax' = (Main, Entry); valid_edge wfp' ax'; ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l')\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by -(erule ProcCFG.path_split_Cons,fastforce+)
[PROOF STATE]
proof (state)
this:
as' = ax' # asx'
sourcenode ax' = (Main, Entry)
valid_edge wfp' ax'
ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l')

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>wfp' \<turnstile> targetnode ax' -asx'\<rightarrow>* (Main, Label l')\<close>
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l')
[PROOF STEP]
have "targetnode ax' \<noteq> (Main,Exit)"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l')

goal (1 subgoal):
 1. targetnode ax' \<noteq> (Main, Exit)
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
targetnode ax' \<noteq> (Main, Exit)

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with \<open>valid_edge wfp' ax'\<close> \<open>sourcenode ax' = (Main, Entry)\<close> wf
[PROOF STATE]
proof (chain)
picking this:
valid_edge wfp' ax'
sourcenode ax' = (Main, Entry)
well_formed procs
targetnode ax' \<noteq> (Main, Exit)
[PROOF STEP]
have "targetnode ax' = (Main,Label 0)"
[PROOF STATE]
proof (prove)
using this:
valid_edge wfp' ax'
sourcenode ax' = (Main, Entry)
well_formed procs
targetnode ax' \<noteq> (Main, Exit)

goal (1 subgoal):
 1. targetnode ax' = (Main, Label 0)
[PROOF STEP]
by(fastforce elim:PCFG.cases dest:Proc_CFG_EntryD simp:valid_edge_def)
[PROOF STATE]
proof (state)
this:
targetnode ax' = (Main, Label 0)

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with \<open>wfp' \<turnstile> targetnode ax' -asx'\<rightarrow>* (Main, Label l')\<close> intra2
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l')
\<forall>a\<in>set as'. intra_kind (kind a)
targetnode ax' = (Main, Label 0)
[PROOF STEP]
have path3:"wfp \<turnstile> (Main,Label 0 \<oplus> #:c\<^sub>1) -asx' \<oplus>s #:c\<^sub>1\<rightarrow>*
        (Main, Label l' \<oplus> #:c\<^sub>1)"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l')
\<forall>a\<in>set as'. intra_kind (kind a)
targetnode ax' = (Main, Label 0)

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Label 0 \<oplus> #:c\<^sub>1) (asx' \<oplus>s #:c\<^sub>1) (Main, Label l' \<oplus> #:c\<^sub>1)
[PROOF STEP]
by -(rule path_Main_SeqSecond,auto)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label 0 \<oplus> #:c\<^sub>1) (asx' \<oplus>s #:c\<^sub>1) (Main, Label l' \<oplus> #:c\<^sub>1)

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>Rep_wf_prog wfp = (c\<^sub>1;; c\<^sub>2, procs)\<close>
[PROOF STATE]
proof (chain)
picking this:
Rep_wf_prog wfp = (c\<^sub>1;; c\<^sub>2, procs)
[PROOF STEP]
obtain wfp'' where [simp]:"Rep_wf_prog wfp'' = (c\<^sub>1, procs)"
[PROOF STATE]
proof (prove)
using this:
Rep_wf_prog wfp = (c\<^sub>1;; c\<^sub>2, procs)

goal (1 subgoal):
 1. (\<And>wfp''. Rep_wf_prog wfp'' = (c\<^sub>1, procs) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(erule wfp_Seq1)
[PROOF STATE]
proof (state)
this:
Rep_wf_prog wfp'' = (c\<^sub>1, procs)

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from IH1[OF _ this,of "0"]
[PROOF STATE]
proof (chain)
picking this:
0 < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp'' (Main, Label 0) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp'' (Main, Entry) as' (Main, Label 0) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
obtain xs
        where "wfp'' \<turnstile> (Main, Label 0) -xs\<rightarrow>* (Main, Exit)"
        and "\<forall>a\<in>set xs. intra_kind (kind a)"
[PROOF STATE]
proof (prove)
using this:
0 < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp'' (Main, Label 0) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp'' (Main, Entry) as' (Main, Label 0) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (1 subgoal):
 1. (\<And>xs. \<lbrakk>ProcCFG.path wfp'' (Main, Label 0) xs (Main, Exit); \<forall>a\<in>set xs. intra_kind (kind a)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp'' (Main, Label 0) xs (Main, Exit)
\<forall>a\<in>set xs. intra_kind (kind a)

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>wfp'' \<turnstile> (Main, Label 0) -xs\<rightarrow>* (Main, Exit)\<close>
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp'' (Main, Label 0) xs (Main, Exit)
[PROOF STEP]
have "xs \<noteq> []"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp'' (Main, Label 0) xs (Main, Exit)

goal (1 subgoal):
 1. xs \<noteq> []
[PROOF STEP]
by(fastforce elim:ProcCFG.path.cases)
[PROOF STATE]
proof (state)
this:
xs \<noteq> []

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
xs \<noteq> []
[PROOF STEP]
obtain x xs' where [simp]:"xs = xs'@[x]"
[PROOF STATE]
proof (prove)
using this:
xs \<noteq> []

goal (1 subgoal):
 1. (\<And>xs' x. xs = xs' @ [x] \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(cases xs rule:rev_cases) fastforce+
[PROOF STATE]
proof (state)
this:
xs = xs' @ [x]

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with \<open>wfp'' \<turnstile> (Main, Label 0) -xs\<rightarrow>* (Main, Exit)\<close>
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp'' (Main, Label 0) xs (Main, Exit)
xs = xs' @ [x]
[PROOF STEP]
have "wfp'' \<turnstile> (Main, Label 0) -xs'\<rightarrow>* sourcenode x"
        and "valid_edge wfp'' x" and "targetnode x = (Main, Exit)"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp'' (Main, Label 0) xs (Main, Exit)
xs = xs' @ [x]

goal (1 subgoal):
 1. ProcCFG.path wfp'' (Main, Label 0) xs' (sourcenode x) &&& valid_edge wfp'' x &&& targetnode x = (Main, Exit)
[PROOF STEP]
by(auto elim:ProcCFG.path_split_snoc)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp'' (Main, Label 0) xs' (sourcenode x)
valid_edge wfp'' x
targetnode x = (Main, Exit)

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>valid_edge wfp'' x\<close> \<open>targetnode x = (Main, Exit)\<close>
[PROOF STATE]
proof (chain)
picking this:
valid_edge wfp'' x
targetnode x = (Main, Exit)
[PROOF STEP]
obtain nx where "sourcenode x = (Main,nx)"
[PROOF STATE]
proof (prove)
using this:
valid_edge wfp'' x
targetnode x = (Main, Exit)

goal (1 subgoal):
 1. (\<And>nx. sourcenode x = (Main, nx) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(fastforce elim:PCFG.cases simp:valid_edge_def)
[PROOF STATE]
proof (state)
this:
sourcenode x = (Main, nx)

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with \<open>wfp'' \<turnstile> (Main, Label 0) -xs'\<rightarrow>* sourcenode x\<close>
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp'' (Main, Label 0) xs' (sourcenode x)
sourcenode x = (Main, nx)
[PROOF STEP]
have "nx \<noteq> Entry"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp'' (Main, Label 0) xs' (sourcenode x)
sourcenode x = (Main, nx)

goal (1 subgoal):
 1. nx \<noteq> Entry
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
nx \<noteq> Entry

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>valid_edge wfp'' x\<close> \<open>sourcenode x = (Main,nx)\<close>
[PROOF STATE]
proof (chain)
picking this:
valid_edge wfp'' x
sourcenode x = (Main, nx)
[PROOF STEP]
have "nx \<noteq> Exit"
[PROOF STATE]
proof (prove)
using this:
valid_edge wfp'' x
sourcenode x = (Main, nx)

goal (1 subgoal):
 1. nx \<noteq> Exit
[PROOF STEP]
by(fastforce intro:ProcCFGExit.Exit_source)
[PROOF STATE]
proof (state)
this:
nx \<noteq> Exit

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with \<open>nx \<noteq> Entry\<close>
[PROOF STATE]
proof (chain)
picking this:
nx \<noteq> Entry
nx \<noteq> Exit
[PROOF STEP]
obtain lx where [simp]:"nx = Label lx"
[PROOF STATE]
proof (prove)
using this:
nx \<noteq> Entry
nx \<noteq> Exit

goal (1 subgoal):
 1. (\<And>lx. nx = Label lx \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(cases nx) auto
[PROOF STATE]
proof (state)
this:
nx = Label lx

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>wfp'' \<turnstile> (Main, Label 0) -xs'\<rightarrow>* sourcenode x\<close>
        \<open>sourcenode x = (Main,nx)\<close> \<open>\<forall>a\<in>set xs. intra_kind (kind a)\<close>
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp'' (Main, Label 0) xs' (sourcenode x)
sourcenode x = (Main, nx)
\<forall>a\<in>set xs. intra_kind (kind a)
[PROOF STEP]
have "wfp \<turnstile> (Main, Entry)
        -((Main, Entry),(\<lambda>s. True)\<^sub>\<surd>,(Main, Label 0))#xs'\<rightarrow>* sourcenode x"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp'' (Main, Label 0) xs' (sourcenode x)
sourcenode x = (Main, nx)
\<forall>a\<in>set xs. intra_kind (kind a)

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # xs') (sourcenode x)
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ProcCFG.path wfp'' (Main, Label 0) xs' (Main, Label lx); sourcenode x = (Main, Label lx); intra_kind (kind x) \<and> (\<forall>a\<in>set xs'. intra_kind (kind a))\<rbrakk> \<Longrightarrow> ProcCFG.path wfp (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # xs') (Main, Label lx)
[PROOF STEP]
apply(rule path_SeqFirst[OF \<open>Rep_wf_prog wfp'' = (c\<^sub>1, procs)\<close>])
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>ProcCFG.path wfp'' (Main, Label 0) xs' (Main, Label lx); sourcenode x = (Main, Label lx); intra_kind (kind x) \<and> (\<forall>a\<in>set xs'. intra_kind (kind a))\<rbrakk> \<Longrightarrow> Rep_wf_prog wfp = (c\<^sub>1;; ?c\<^sub>29, procs)
 2. \<lbrakk>ProcCFG.path wfp'' (Main, Label 0) xs' (Main, Label lx); sourcenode x = (Main, Label lx); intra_kind (kind x) \<and> (\<forall>a\<in>set xs'. intra_kind (kind a))\<rbrakk> \<Longrightarrow> ProcCFG.path wfp'' (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # xs') (Main, Label lx)
 3. \<lbrakk>ProcCFG.path wfp'' (Main, Label 0) xs' (Main, Label lx); sourcenode x = (Main, Label lx); intra_kind (kind x) \<and> (\<forall>a\<in>set xs'. intra_kind (kind a))\<rbrakk> \<Longrightarrow> \<forall>a\<in>set (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # xs'). intra_kind (kind a)
[PROOF STEP]
apply(auto intro!:ProcCFG.Cons_path)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ProcCFG.path wfp'' (Main, Label 0) xs' (Main, Label lx); sourcenode x = (Main, Label lx); intra_kind (kind x); \<forall>a\<in>set xs'. intra_kind (kind a)\<rbrakk> \<Longrightarrow> valid_edge wfp'' ((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)
 2. \<lbrakk>ProcCFG.path wfp'' (Main, Label 0) xs' (Main, Label lx); sourcenode x = (Main, Label lx); intra_kind (kind x); \<forall>a\<in>set xs'. intra_kind (kind a)\<rbrakk> \<Longrightarrow> intra_kind (\<lambda>s. True)\<^sub>\<surd>
[PROOF STEP]
by(auto intro:Main Proc_CFG_Entry simp:valid_edge_def intra_kind_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # xs') (sourcenode x)

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with \<open>valid_edge wfp'' x\<close> \<open>targetnode x = (Main, Exit)\<close> path3
        \<open>sourcenode x = (Main,nx)\<close> \<open>nx \<noteq> Entry\<close> \<open>sourcenode x = (Main,nx)\<close> wf
[PROOF STATE]
proof (chain)
picking this:
valid_edge wfp'' x
targetnode x = (Main, Exit)
ProcCFG.path wfp (Main, Label 0 \<oplus> #:c\<^sub>1) (asx' \<oplus>s #:c\<^sub>1) (Main, Label l' \<oplus> #:c\<^sub>1)
sourcenode x = (Main, nx)
nx \<noteq> Entry
sourcenode x = (Main, nx)
well_formed procs
ProcCFG.path wfp (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # xs') (sourcenode x)
[PROOF STEP]
have "wfp \<turnstile> (Main, Entry) -((((Main, Entry),(\<lambda>s. True)\<^sub>\<surd>,(Main, Label 0))#xs')@
        [(sourcenode x,kind x,(Main,Label #:c\<^sub>1))])@(asx' \<oplus>s #:c\<^sub>1)\<rightarrow>*
        (Main, Label l' \<oplus> #:c\<^sub>1)"
[PROOF STATE]
proof (prove)
using this:
valid_edge wfp'' x
targetnode x = (Main, Exit)
ProcCFG.path wfp (Main, Label 0 \<oplus> #:c\<^sub>1) (asx' \<oplus>s #:c\<^sub>1) (Main, Label l' \<oplus> #:c\<^sub>1)
sourcenode x = (Main, nx)
nx \<noteq> Entry
sourcenode x = (Main, nx)
well_formed procs
ProcCFG.path wfp (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # xs') (sourcenode x)

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Entry) (((((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # xs') @ [(sourcenode x, kind x, Main, Label #:c\<^sub>1)]) @ (asx' \<oplus>s #:c\<^sub>1)) (Main, Label l' \<oplus> #:c\<^sub>1)
[PROOF STEP]
by(fastforce intro:ProcCFG.path_Append ProcCFG.path.intros Main
          Proc_CFG_SeqConnect elim!:PCFG.cases dest:Proc_CFG_Call_Labels
          simp:ProcCFG.valid_node_def valid_edge_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Entry) (((((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # xs') @ [(sourcenode x, kind x, Main, Label #:c\<^sub>1)]) @ (asx' \<oplus>s #:c\<^sub>1)) (Main, Label l' \<oplus> #:c\<^sub>1)

goal (1 subgoal):
 1. \<not> l < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp (Main, Label l' \<oplus> #:c\<^sub>1) (as \<oplus>s #:c\<^sub>1) (Main, Exit \<oplus> #:c\<^sub>1)
ProcCFG.path wfp (Main, Entry) (((((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # xs') @ [(sourcenode x, kind x, Main, Label #:c\<^sub>1)]) @ (asx' \<oplus>s #:c\<^sub>1)) (Main, Label l' \<oplus> #:c\<^sub>1)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Label l' \<oplus> #:c\<^sub>1) (as \<oplus>s #:c\<^sub>1) (Main, Exit \<oplus> #:c\<^sub>1)
ProcCFG.path wfp (Main, Entry) (((((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # xs') @ [(sourcenode x, kind x, Main, Label #:c\<^sub>1)]) @ (asx' \<oplus>s #:c\<^sub>1)) (Main, Label l' \<oplus> #:c\<^sub>1)

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
using intra1 intra2 \<open>\<forall>a\<in>set xs. intra_kind (kind a)\<close>
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Label l' \<oplus> #:c\<^sub>1) (as \<oplus>s #:c\<^sub>1) (Main, Exit \<oplus> #:c\<^sub>1)
ProcCFG.path wfp (Main, Entry) (((((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # xs') @ [(sourcenode x, kind x, Main, Label #:c\<^sub>1)]) @ (asx' \<oplus>s #:c\<^sub>1)) (Main, Label l' \<oplus> #:c\<^sub>1)
\<forall>a\<in>set as. intra_kind (kind a)
\<forall>a\<in>set as'. intra_kind (kind a)
\<forall>a\<in>set xs. intra_kind (kind a)

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
by(fastforce simp:label_incrs_def intra_kind_def)
[PROOF STATE]
proof (state)
this:
\<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (3 subgoals):
 1. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
case (Cond b c\<^sub>1 c\<^sub>2)
[PROOF STATE]
proof (state)
this:
\<lbrakk>?l < #:c\<^sub>1; Rep_wf_prog ?wfp = (c\<^sub>1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path ?wfp (Main, Label ?l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path ?wfp (Main, Entry) as' (Main, Label ?l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
\<lbrakk>?l < #:c\<^sub>2; Rep_wf_prog ?wfp = (c\<^sub>2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path ?wfp (Main, Label ?l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path ?wfp (Main, Entry) as' (Main, Label ?l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
l < #:if (b) c\<^sub>1 else c\<^sub>2
Rep_wf_prog wfp = (if (b) c\<^sub>1 else c\<^sub>2, procs)

goal (3 subgoals):
 1. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
note IH1 = \<open>\<And>l wfp. \<lbrakk>l < #:c\<^sub>1; Rep_wf_prog wfp = (c\<^sub>1, procs)\<rbrakk> \<Longrightarrow>
      \<exists>as as'. wfp \<turnstile> (Main, Label l) -as\<rightarrow>* (Main, Exit) \<and>
      (\<forall>a\<in>set as. intra_kind (kind a)) \<and>
      wfp \<turnstile> (Main, Entry) -as'\<rightarrow>* (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))\<close>
[PROOF STATE]
proof (state)
this:
\<lbrakk>?l < #:c\<^sub>1; Rep_wf_prog ?wfp = (c\<^sub>1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path ?wfp (Main, Label ?l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path ?wfp (Main, Entry) as' (Main, Label ?l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (3 subgoals):
 1. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
note IH2 = \<open>\<And>l wfp. \<lbrakk>l < #:c\<^sub>2; Rep_wf_prog wfp = (c\<^sub>2, procs)\<rbrakk> \<Longrightarrow>
      \<exists>as as'. wfp \<turnstile> (Main, Label l) -as\<rightarrow>* (Main, Exit) \<and>
      (\<forall>a\<in>set as. intra_kind (kind a)) \<and>
      wfp \<turnstile> (Main, Entry) -as'\<rightarrow>* (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))\<close>
[PROOF STATE]
proof (state)
this:
\<lbrakk>?l < #:c\<^sub>2; Rep_wf_prog ?wfp = (c\<^sub>2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path ?wfp (Main, Label ?l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path ?wfp (Main, Entry) as' (Main, Label ?l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (3 subgoals):
 1. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
note [simp] = \<open>Rep_wf_prog wfp = (if (b) c\<^sub>1 else c\<^sub>2, procs)\<close>
[PROOF STATE]
proof (state)
this:
Rep_wf_prog wfp = (if (b) c\<^sub>1 else c\<^sub>2, procs)

goal (3 subgoals):
 1. \<And>x1 prog1 prog2 l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog1; Rep_wf_prog wfp = (prog1, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); \<And>l wfp. \<lbrakk>l < #:prog2; Rep_wf_prog wfp = (prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:if (x1) prog1 else prog2; Rep_wf_prog wfp = (if (x1) prog1 else prog2, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 3. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
proof(cases "l = 0")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
l = 0

goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>Rep_wf_prog wfp = (if (b) c\<^sub>1 else c\<^sub>2, procs)\<close>
[PROOF STATE]
proof (chain)
picking this:
Rep_wf_prog wfp = (if (b) c\<^sub>1 else c\<^sub>2, procs)
[PROOF STEP]
obtain wfp' where [simp]:"Rep_wf_prog wfp' = (c\<^sub>1, procs)"
[PROOF STATE]
proof (prove)
using this:
Rep_wf_prog wfp = (if (b) c\<^sub>1 else c\<^sub>2, procs)

goal (1 subgoal):
 1. (\<And>wfp'. Rep_wf_prog wfp' = (c\<^sub>1, procs) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(erule wfp_CondTrue)
[PROOF STATE]
proof (state)
this:
Rep_wf_prog wfp' = (c\<^sub>1, procs)

goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from IH1[OF _ this,of 0]
[PROOF STATE]
proof (chain)
picking this:
0 < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp' (Main, Label 0) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp' (Main, Entry) as' (Main, Label 0) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
obtain as
        where path:"wfp' \<turnstile> (Main, Label 0) -as\<rightarrow>* (Main, Exit)"
        and intra:"\<forall>a\<in>set as. intra_kind (kind a)"
[PROOF STATE]
proof (prove)
using this:
0 < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp' (Main, Label 0) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp' (Main, Entry) as' (Main, Label 0) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (1 subgoal):
 1. (\<And>as. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp' (Main, Label 0) as (Main, Exit)
\<forall>a\<in>set as. intra_kind (kind a)

goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
have "if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main,Label 0)
        -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main,Label 0 \<oplus> 1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)
[PROOF STEP]
by(fastforce intro:Main Proc_CFG_CondTrue)
[PROOF STATE]
proof (state)
this:
if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)

goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with path intra
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp' (Main, Label 0) as (Main, Exit)
\<forall>a\<in>set as. intra_kind (kind a)
if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)
[PROOF STEP]
have "wfp \<turnstile> (Main,Label 0)
        -[((Main,Label 0),(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>,(Main,Label 0 \<oplus> 1))]@
        (as \<oplus>s 1)\<rightarrow>* (Main,Exit \<oplus> 1)"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp' (Main, Label 0) as (Main, Exit)
\<forall>a\<in>set as. intra_kind (kind a)
if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Label 0) ([((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1)] @ (as \<oplus>s 1)) (Main, Exit \<oplus> 1)
[PROOF STEP]
apply -
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)\<rbrakk> \<Longrightarrow> ProcCFG.path wfp (Main, Label 0) ([((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1)] @ (as \<oplus>s 1)) (Main, Exit \<oplus> 1)
[PROOF STEP]
apply(rule ProcCFG.path_Append)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)\<rbrakk> \<Longrightarrow> ProcCFG.path wfp (Main, Label 0) [((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1)] ?n''3
 2. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)\<rbrakk> \<Longrightarrow> ProcCFG.path wfp ?n''3 (as \<oplus>s 1) (Main, Exit \<oplus> 1)
[PROOF STEP]
apply(rule ProcCFG.path.intros)+
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)\<rbrakk> \<Longrightarrow> ProcCFG.valid_node wfp ?n''3
 2. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)\<rbrakk> \<Longrightarrow> valid_edge wfp ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1)
 3. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)\<rbrakk> \<Longrightarrow> sourcenode ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1) = (Main, Label 0)
 4. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)\<rbrakk> \<Longrightarrow> targetnode ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1) = ?n''3
 5. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)\<rbrakk> \<Longrightarrow> ProcCFG.path wfp ?n''3 (as \<oplus>s 1) (Main, Exit \<oplus> 1)
[PROOF STEP]
prefer 5
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)\<rbrakk> \<Longrightarrow> ProcCFG.path wfp ?n''3 (as \<oplus>s 1) (Main, Exit \<oplus> 1)
 2. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)\<rbrakk> \<Longrightarrow> ProcCFG.valid_node wfp ?n''3
 3. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)\<rbrakk> \<Longrightarrow> valid_edge wfp ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1)
 4. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)\<rbrakk> \<Longrightarrow> sourcenode ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1) = (Main, Label 0)
 5. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)\<rbrakk> \<Longrightarrow> targetnode ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1) = ?n''3
[PROOF STEP]
apply(rule path_Main_CondTrue)
[PROOF STATE]
proof (prove)
goal (9 subgoals):
 1. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)\<rbrakk> \<Longrightarrow> Rep_wf_prog ?wfp13 = (?prog13, ?procs13)
 2. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)\<rbrakk> \<Longrightarrow> Rep_wf_prog wfp = (if (?b13) ?prog13 else ?c\<^sub>213, ?procs13)
 3. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)\<rbrakk> \<Longrightarrow> ProcCFG.path ?wfp13 (Main, ?n13) as (Main, Exit)
 4. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)\<rbrakk> \<Longrightarrow> \<forall>a\<in>set as. intra_kind (kind a)
 5. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)\<rbrakk> \<Longrightarrow> ?n13 \<noteq> Entry
 6. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)\<rbrakk> \<Longrightarrow> ProcCFG.valid_node wfp (Main, ?n13 \<oplus> 1)
 7. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)\<rbrakk> \<Longrightarrow> valid_edge wfp ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1)
 8. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)\<rbrakk> \<Longrightarrow> sourcenode ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1) = (Main, Label 0)
 9. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 0 \<oplus> 1)\<rbrakk> \<Longrightarrow> targetnode ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1) = (Main, ?n13 \<oplus> 1)
[PROOF STEP]
apply(auto intro:ProcCFG.path.intros simp:valid_edge_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ProcCFG.path wfp' (Main, Label 0) as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Label 0) -(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>\<rightarrow> (Main, Label 1)\<rbrakk> \<Longrightarrow> ProcCFG.valid_node wfp (Main, Label 1)
[PROOF STEP]
by(fastforce simp:ProcCFG.valid_node_def valid_edge_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label 0) ([((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1)] @ (as \<oplus>s 1)) (Main, Exit \<oplus> 1)

goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label 0) ([((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1)] @ (as \<oplus>s 1)) (Main, Exit \<oplus> 1)

goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
have "if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main,Entry) -(\<lambda>s. True)\<^sub>\<surd>\<rightarrow>
        (Main,Label 0)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Entry) -(\<lambda>s. True)\<^sub>\<surd>\<rightarrow> (Main, Label 0)
[PROOF STEP]
by(fastforce intro:Main Proc_CFG_Entry)
[PROOF STATE]
proof (state)
this:
if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Entry) -(\<lambda>s. True)\<^sub>\<surd>\<rightarrow> (Main, Label 0)

goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
hence "wfp \<turnstile> (Main,Entry) -[((Main,Entry),(\<lambda>s. True)\<^sub>\<surd>,(Main,Label 0))]\<rightarrow>*
        (Main,Label 0)"
[PROOF STATE]
proof (prove)
using this:
if (b) c\<^sub>1 else c\<^sub>2,procs \<turnstile> (Main, Entry) -(\<lambda>s. True)\<^sub>\<surd>\<rightarrow> (Main, Label 0)

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label 0)
[PROOF STEP]
by(fastforce intro:ProcCFG.path.intros
                    simp:ProcCFG.valid_node_def valid_edge_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label 0)

goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp (Main, Label 0) ([((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1)] @ (as \<oplus>s 1)) (Main, Exit \<oplus> 1)
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label 0)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Label 0) ([((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1)] @ (as \<oplus>s 1)) (Main, Exit \<oplus> 1)
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label 0)

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
using \<open>l = 0\<close> \<open>\<forall>a\<in>set as. intra_kind (kind a)\<close>
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Label 0) ([((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1)] @ (as \<oplus>s 1)) (Main, Exit \<oplus> 1)
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label 0)
l = 0
\<forall>a\<in>set as. intra_kind (kind a)

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
by(fastforce simp:label_incrs_def intra_kind_def)
[PROOF STATE]
proof (state)
this:
\<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (1 subgoal):
 1. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
l \<noteq> 0

goal (1 subgoal):
 1. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
hence "0 < l"
[PROOF STATE]
proof (prove)
using this:
l \<noteq> 0

goal (1 subgoal):
 1. 0 < l
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
0 < l

goal (1 subgoal):
 1. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
0 < l
[PROOF STEP]
obtain l' where [simp]:"l = l' + 1" and "l' = l - 1"
[PROOF STATE]
proof (prove)
using this:
0 < l

goal (1 subgoal):
 1. (\<And>l'. \<lbrakk>l = l' + 1; l' = l - 1\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
l = l' + 1
l' = l - 1

goal (1 subgoal):
 1. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
proof(cases "l' < #:c\<^sub>1")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
l' < #:c\<^sub>1

goal (2 subgoals):
 1. l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>Rep_wf_prog wfp = (if (b) c\<^sub>1 else c\<^sub>2, procs)\<close>
[PROOF STATE]
proof (chain)
picking this:
Rep_wf_prog wfp = (if (b) c\<^sub>1 else c\<^sub>2, procs)
[PROOF STEP]
obtain wfp' where [simp]:"Rep_wf_prog wfp' = (c\<^sub>1, procs)"
[PROOF STATE]
proof (prove)
using this:
Rep_wf_prog wfp = (if (b) c\<^sub>1 else c\<^sub>2, procs)

goal (1 subgoal):
 1. (\<And>wfp'. Rep_wf_prog wfp' = (c\<^sub>1, procs) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(erule wfp_CondTrue)
[PROOF STATE]
proof (state)
this:
Rep_wf_prog wfp' = (c\<^sub>1, procs)

goal (2 subgoals):
 1. l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from IH1[OF True this]
[PROOF STATE]
proof (chain)
picking this:
\<exists>as as'. ProcCFG.path wfp' (Main, Label l') as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp' (Main, Entry) as' (Main, Label l') \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
obtain as as'
          where path1:"wfp' \<turnstile> (Main, Label l') -as\<rightarrow>* (Main, Exit)"
          and intra1:"\<forall>a\<in>set as. intra_kind (kind a)"
          and path2:"wfp' \<turnstile> (Main, Entry) -as'\<rightarrow>* (Main, Label l')"
          and intra2:"\<forall>a\<in>set as'. intra_kind (kind a)"
[PROOF STATE]
proof (prove)
using this:
\<exists>as as'. ProcCFG.path wfp' (Main, Label l') as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp' (Main, Entry) as' (Main, Label l') \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (1 subgoal):
 1. (\<And>as as'. \<lbrakk>ProcCFG.path wfp' (Main, Label l') as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); ProcCFG.path wfp' (Main, Entry) as' (Main, Label l'); \<forall>a\<in>set as'. intra_kind (kind a)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp' (Main, Label l') as (Main, Exit)
\<forall>a\<in>set as. intra_kind (kind a)
ProcCFG.path wfp' (Main, Entry) as' (Main, Label l')
\<forall>a\<in>set as'. intra_kind (kind a)

goal (2 subgoals):
 1. l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from path1 intra1
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp' (Main, Label l') as (Main, Exit)
\<forall>a\<in>set as. intra_kind (kind a)
[PROOF STEP]
have "wfp \<turnstile> (Main, Label l' \<oplus> 1) -as \<oplus>s 1\<rightarrow>* (Main, Exit \<oplus> 1)"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp' (Main, Label l') as (Main, Exit)
\<forall>a\<in>set as. intra_kind (kind a)

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Label l' \<oplus> 1) (as \<oplus>s 1) (Main, Exit \<oplus> 1)
[PROOF STEP]
by -(rule path_Main_CondTrue,auto)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label l' \<oplus> 1) (as \<oplus>s 1) (Main, Exit \<oplus> 1)

goal (2 subgoals):
 1. l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label l' \<oplus> 1) (as \<oplus>s 1) (Main, Exit \<oplus> 1)

goal (2 subgoals):
 1. l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from path2
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp' (Main, Entry) as' (Main, Label l')
[PROOF STEP]
obtain ax' asx' where [simp]:"as' = ax'#asx'"
          and "sourcenode ax' = (Main,Entry)" and "valid_edge wfp' ax'"
          and "wfp' \<turnstile> targetnode ax' -asx'\<rightarrow>* (Main, Label l')"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp' (Main, Entry) as' (Main, Label l')

goal (1 subgoal):
 1. (\<And>ax' asx'. \<lbrakk>as' = ax' # asx'; sourcenode ax' = (Main, Entry); valid_edge wfp' ax'; ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l')\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by -(erule ProcCFG.path.cases,fastforce+)
[PROOF STATE]
proof (state)
this:
as' = ax' # asx'
sourcenode ax' = (Main, Entry)
valid_edge wfp' ax'
ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l')

goal (2 subgoals):
 1. l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with wf
[PROOF STATE]
proof (chain)
picking this:
well_formed procs
as' = ax' # asx'
sourcenode ax' = (Main, Entry)
valid_edge wfp' ax'
ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l')
[PROOF STEP]
have "targetnode ax' = (Main,Label 0)"
[PROOF STATE]
proof (prove)
using this:
well_formed procs
as' = ax' # asx'
sourcenode ax' = (Main, Entry)
valid_edge wfp' ax'
ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l')

goal (1 subgoal):
 1. targetnode ax' = (Main, Label 0)
[PROOF STEP]
by(fastforce elim:PCFG.cases dest:Proc_CFG_EntryD Proc_CFG_Call_Labels
                      simp:valid_edge_def)
[PROOF STATE]
proof (state)
this:
targetnode ax' = (Main, Label 0)

goal (2 subgoals):
 1. l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with \<open>wfp' \<turnstile> targetnode ax' -asx'\<rightarrow>* (Main, Label l')\<close> intra2
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l')
\<forall>a\<in>set as'. intra_kind (kind a)
targetnode ax' = (Main, Label 0)
[PROOF STEP]
have "wfp \<turnstile> (Main,Entry) -((Main,Entry),(\<lambda>s. True)\<^sub>\<surd>,(Main,Label 0))#
          ((Main,Label 0),(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>,(Main,Label 0 \<oplus> 1))#
          (asx' \<oplus>s 1)\<rightarrow>* (Main,Label l' \<oplus> 1)"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l')
\<forall>a\<in>set as'. intra_kind (kind a)
targetnode ax' = (Main, Label 0)

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1) # (asx' \<oplus>s 1)) (Main, Label l' \<oplus> 1)
[PROOF STEP]
apply -
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l'); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> ProcCFG.path wfp (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1) # (asx' \<oplus>s 1)) (Main, Label l' \<oplus> 1)
[PROOF STEP]
apply(rule ProcCFG.path.intros)+
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<lbrakk>ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l'); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> ProcCFG.path wfp ?n''8 (asx' \<oplus>s 1) (Main, Label l' \<oplus> 1)
 2. \<lbrakk>ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l'); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> valid_edge wfp ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1)
 3. \<lbrakk>ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l'); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> sourcenode ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1) = ?n''3
 4. \<lbrakk>ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l'); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> targetnode ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1) = ?n''8
 5. \<lbrakk>ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l'); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> valid_edge wfp ((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)
 6. \<lbrakk>ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l'); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> sourcenode ((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) = (Main, Entry)
 7. \<lbrakk>ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l'); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> targetnode ((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) = ?n''3
[PROOF STEP]
apply(rule path_Main_CondTrue)
[PROOF STATE]
proof (prove)
goal (11 subgoals):
 1. \<lbrakk>ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l'); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> Rep_wf_prog ?wfp13 = (?prog13, ?procs13)
 2. \<lbrakk>ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l'); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> Rep_wf_prog wfp = (if (?b13) ?prog13 else ?c\<^sub>213, ?procs13)
 3. \<lbrakk>ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l'); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> ProcCFG.path ?wfp13 (Main, ?n13) asx' (Main, Label l')
 4. \<lbrakk>ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l'); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> \<forall>a\<in>set asx'. intra_kind (kind a)
 5. \<lbrakk>ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l'); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> ?n13 \<noteq> Entry
 6. \<lbrakk>ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l'); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> valid_edge wfp ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1)
 7. \<lbrakk>ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l'); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> sourcenode ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1) = ?n''3
 8. \<lbrakk>ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l'); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> targetnode ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1) = (Main, ?n13 \<oplus> 1)
 9. \<lbrakk>ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l'); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> valid_edge wfp ((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)
 10. \<lbrakk>ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l'); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> sourcenode ((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) = (Main, Entry)
A total of 11 subgoals...
[PROOF STEP]
by(auto intro:Main Proc_CFG_Entry Proc_CFG_CondTrue simp:valid_edge_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1) # (asx' \<oplus>s 1)) (Main, Label l' \<oplus> 1)

goal (2 subgoals):
 1. l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<not> l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp (Main, Label l' \<oplus> 1) (as \<oplus>s 1) (Main, Exit \<oplus> 1)
ProcCFG.path wfp (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1) # (asx' \<oplus>s 1)) (Main, Label l' \<oplus> 1)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Label l' \<oplus> 1) (as \<oplus>s 1) (Main, Exit \<oplus> 1)
ProcCFG.path wfp (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1) # (asx' \<oplus>s 1)) (Main, Label l' \<oplus> 1)

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
using intra1 intra2
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Label l' \<oplus> 1) (as \<oplus>s 1) (Main, Exit \<oplus> 1)
ProcCFG.path wfp (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 0 \<oplus> 1) # (asx' \<oplus>s 1)) (Main, Label l' \<oplus> 1)
\<forall>a\<in>set as. intra_kind (kind a)
\<forall>a\<in>set as'. intra_kind (kind a)

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
by(fastforce simp:label_incrs_def intra_kind_def)
[PROOF STATE]
proof (state)
this:
\<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (1 subgoal):
 1. \<not> l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> l' < #:c\<^sub>1

goal (1 subgoal):
 1. \<not> l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
hence "#:c\<^sub>1 \<le> l'"
[PROOF STATE]
proof (prove)
using this:
\<not> l' < #:c\<^sub>1

goal (1 subgoal):
 1. #:c\<^sub>1 \<le> l'
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
#:c\<^sub>1 \<le> l'

goal (1 subgoal):
 1. \<not> l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
#:c\<^sub>1 \<le> l'
[PROOF STEP]
obtain l'' where [simp]:"l' = l'' + #:c\<^sub>1" and "l'' = l' - #:c\<^sub>1"
[PROOF STATE]
proof (prove)
using this:
#:c\<^sub>1 \<le> l'

goal (1 subgoal):
 1. (\<And>l''. \<lbrakk>l' = l'' + #:c\<^sub>1; l'' = l' - #:c\<^sub>1\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
l' = l'' + #:c\<^sub>1
l'' = l' - #:c\<^sub>1

goal (1 subgoal):
 1. \<not> l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from  \<open>l < #:(if (b) c\<^sub>1 else c\<^sub>2)\<close>
[PROOF STATE]
proof (chain)
picking this:
l < #:if (b) c\<^sub>1 else c\<^sub>2
[PROOF STEP]
have "l'' < #:c\<^sub>2"
[PROOF STATE]
proof (prove)
using this:
l < #:if (b) c\<^sub>1 else c\<^sub>2

goal (1 subgoal):
 1. l'' < #:c\<^sub>2
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
l'' < #:c\<^sub>2

goal (1 subgoal):
 1. \<not> l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>Rep_wf_prog wfp = (if (b) c\<^sub>1 else c\<^sub>2, procs)\<close>
[PROOF STATE]
proof (chain)
picking this:
Rep_wf_prog wfp = (if (b) c\<^sub>1 else c\<^sub>2, procs)
[PROOF STEP]
obtain wfp'' where [simp]:"Rep_wf_prog wfp'' = (c\<^sub>2, procs)"
[PROOF STATE]
proof (prove)
using this:
Rep_wf_prog wfp = (if (b) c\<^sub>1 else c\<^sub>2, procs)

goal (1 subgoal):
 1. (\<And>wfp''. Rep_wf_prog wfp'' = (c\<^sub>2, procs) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(erule wfp_CondFalse)
[PROOF STATE]
proof (state)
this:
Rep_wf_prog wfp'' = (c\<^sub>2, procs)

goal (1 subgoal):
 1. \<not> l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from IH2[OF \<open>l'' < #:c\<^sub>2\<close> this]
[PROOF STATE]
proof (chain)
picking this:
\<exists>as as'. ProcCFG.path wfp'' (Main, Label l'') as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp'' (Main, Entry) as' (Main, Label l'') \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
obtain as as'
          where path1:"wfp'' \<turnstile> (Main, Label l'') -as\<rightarrow>* (Main, Exit)"
          and intra1:"\<forall>a\<in>set as. intra_kind (kind a)"
          and path2:"wfp'' \<turnstile> (Main, Entry) -as'\<rightarrow>* (Main, Label l'')"
          and intra2:"\<forall>a\<in>set as'. intra_kind (kind a)"
[PROOF STATE]
proof (prove)
using this:
\<exists>as as'. ProcCFG.path wfp'' (Main, Label l'') as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp'' (Main, Entry) as' (Main, Label l'') \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (1 subgoal):
 1. (\<And>as as'. \<lbrakk>ProcCFG.path wfp'' (Main, Label l'') as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); ProcCFG.path wfp'' (Main, Entry) as' (Main, Label l''); \<forall>a\<in>set as'. intra_kind (kind a)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp'' (Main, Label l'') as (Main, Exit)
\<forall>a\<in>set as. intra_kind (kind a)
ProcCFG.path wfp'' (Main, Entry) as' (Main, Label l'')
\<forall>a\<in>set as'. intra_kind (kind a)

goal (1 subgoal):
 1. \<not> l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from path1 intra1
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp'' (Main, Label l'') as (Main, Exit)
\<forall>a\<in>set as. intra_kind (kind a)
[PROOF STEP]
have "wfp \<turnstile> (Main, Label l'' \<oplus> (#:c\<^sub>1 + 1)) -as \<oplus>s (#:c\<^sub>1 + 1)\<rightarrow>*
          (Main, Exit \<oplus> (#:c\<^sub>1 + 1))"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp'' (Main, Label l'') as (Main, Exit)
\<forall>a\<in>set as. intra_kind (kind a)

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Label l'' \<oplus> #:c\<^sub>1 + 1) (as \<oplus>s #:c\<^sub>1 + 1) (Main, Exit \<oplus> #:c\<^sub>1 + 1)
[PROOF STEP]
by -(rule path_Main_CondFalse,auto simp:add.assoc)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label l'' \<oplus> #:c\<^sub>1 + 1) (as \<oplus>s #:c\<^sub>1 + 1) (Main, Exit \<oplus> #:c\<^sub>1 + 1)

goal (1 subgoal):
 1. \<not> l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label l'' \<oplus> #:c\<^sub>1 + 1) (as \<oplus>s #:c\<^sub>1 + 1) (Main, Exit \<oplus> #:c\<^sub>1 + 1)

goal (1 subgoal):
 1. \<not> l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from path2
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp'' (Main, Entry) as' (Main, Label l'')
[PROOF STEP]
obtain ax' asx' where [simp]:"as' = ax'#asx'"
          and "sourcenode ax' = (Main,Entry)" and "valid_edge wfp'' ax'"
          and "wfp'' \<turnstile> targetnode ax' -asx'\<rightarrow>* (Main, Label l'')"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp'' (Main, Entry) as' (Main, Label l'')

goal (1 subgoal):
 1. (\<And>ax' asx'. \<lbrakk>as' = ax' # asx'; sourcenode ax' = (Main, Entry); valid_edge wfp'' ax'; ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l'')\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by -(erule ProcCFG.path.cases,fastforce+)
[PROOF STATE]
proof (state)
this:
as' = ax' # asx'
sourcenode ax' = (Main, Entry)
valid_edge wfp'' ax'
ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l'')

goal (1 subgoal):
 1. \<not> l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with wf
[PROOF STATE]
proof (chain)
picking this:
well_formed procs
as' = ax' # asx'
sourcenode ax' = (Main, Entry)
valid_edge wfp'' ax'
ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l'')
[PROOF STEP]
have "targetnode ax' = (Main,Label 0)"
[PROOF STATE]
proof (prove)
using this:
well_formed procs
as' = ax' # asx'
sourcenode ax' = (Main, Entry)
valid_edge wfp'' ax'
ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l'')

goal (1 subgoal):
 1. targetnode ax' = (Main, Label 0)
[PROOF STEP]
by(fastforce elim:PCFG.cases dest:Proc_CFG_EntryD Proc_CFG_Call_Labels
                      simp:valid_edge_def)
[PROOF STATE]
proof (state)
this:
targetnode ax' = (Main, Label 0)

goal (1 subgoal):
 1. \<not> l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with \<open>wfp'' \<turnstile> targetnode ax' -asx'\<rightarrow>* (Main, Label l'')\<close> intra2
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l'')
\<forall>a\<in>set as'. intra_kind (kind a)
targetnode ax' = (Main, Label 0)
[PROOF STEP]
have "wfp \<turnstile> (Main,Entry) -((Main,Entry),(\<lambda>s. True)\<^sub>\<surd>,(Main,Label 0))#
          ((Main,Label 0),(\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>,
          (Main,Label (#:c\<^sub>1 + 1)))#(asx' \<oplus>s (#:c\<^sub>1 + 1))\<rightarrow>*
          (Main,Label l'' \<oplus> (#:c\<^sub>1 + 1))"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l'')
\<forall>a\<in>set as'. intra_kind (kind a)
targetnode ax' = (Main, Label 0)

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label (#:c\<^sub>1 + 1)) # (asx' \<oplus>s #:c\<^sub>1 + 1)) (Main, Label l'' \<oplus> #:c\<^sub>1 + 1)
[PROOF STEP]
apply -
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l''); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> ProcCFG.path wfp (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label (#:c\<^sub>1 + 1)) # (asx' \<oplus>s #:c\<^sub>1 + 1)) (Main, Label l'' \<oplus> #:c\<^sub>1 + 1)
[PROOF STEP]
apply(rule ProcCFG.path.intros)+
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<lbrakk>ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l''); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> ProcCFG.path wfp ?n''8 (asx' \<oplus>s #:c\<^sub>1 + 1) (Main, Label l'' \<oplus> #:c\<^sub>1 + 1)
 2. \<lbrakk>ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l''); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> valid_edge wfp ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label (#:c\<^sub>1 + 1))
 3. \<lbrakk>ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l''); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> sourcenode ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label (#:c\<^sub>1 + 1)) = ?n''3
 4. \<lbrakk>ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l''); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> targetnode ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label (#:c\<^sub>1 + 1)) = ?n''8
 5. \<lbrakk>ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l''); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> valid_edge wfp ((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)
 6. \<lbrakk>ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l''); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> sourcenode ((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) = (Main, Entry)
 7. \<lbrakk>ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l''); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> targetnode ((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) = ?n''3
[PROOF STEP]
apply(rule path_Main_CondFalse)
[PROOF STATE]
proof (prove)
goal (11 subgoals):
 1. \<lbrakk>ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l''); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> Rep_wf_prog ?wfp13 = (?prog13, ?procs13)
 2. \<lbrakk>ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l''); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> Rep_wf_prog wfp = (if (?b13) c\<^sub>1 else ?prog13, ?procs13)
 3. \<lbrakk>ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l''); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> ProcCFG.path ?wfp13 (Main, ?n13) asx' (Main, Label l'')
 4. \<lbrakk>ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l''); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> \<forall>a\<in>set asx'. intra_kind (kind a)
 5. \<lbrakk>ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l''); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> ?n13 \<noteq> Entry
 6. \<lbrakk>ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l''); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> valid_edge wfp ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label (#:c\<^sub>1 + 1))
 7. \<lbrakk>ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l''); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> sourcenode ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label (#:c\<^sub>1 + 1)) = ?n''3
 8. \<lbrakk>ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l''); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> targetnode ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label (#:c\<^sub>1 + 1)) = (Main, ?n13 \<oplus> #:c\<^sub>1 + 1)
 9. \<lbrakk>ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l''); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> valid_edge wfp ((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)
 10. \<lbrakk>ProcCFG.path wfp'' (targetnode ax') asx' (Main, Label l''); \<forall>a\<in>set as'. intra_kind (kind a); targetnode ax' = (Main, Label 0)\<rbrakk> \<Longrightarrow> sourcenode ((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) = (Main, Entry)
A total of 11 subgoals...
[PROOF STEP]
by(auto intro:Main Proc_CFG_Entry Proc_CFG_CondFalse simp:valid_edge_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label (#:c\<^sub>1 + 1)) # (asx' \<oplus>s #:c\<^sub>1 + 1)) (Main, Label l'' \<oplus> #:c\<^sub>1 + 1)

goal (1 subgoal):
 1. \<not> l' < #:c\<^sub>1 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp (Main, Label l'' \<oplus> #:c\<^sub>1 + 1) (as \<oplus>s #:c\<^sub>1 + 1) (Main, Exit \<oplus> #:c\<^sub>1 + 1)
ProcCFG.path wfp (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label (#:c\<^sub>1 + 1)) # (asx' \<oplus>s #:c\<^sub>1 + 1)) (Main, Label l'' \<oplus> #:c\<^sub>1 + 1)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Label l'' \<oplus> #:c\<^sub>1 + 1) (as \<oplus>s #:c\<^sub>1 + 1) (Main, Exit \<oplus> #:c\<^sub>1 + 1)
ProcCFG.path wfp (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label (#:c\<^sub>1 + 1)) # (asx' \<oplus>s #:c\<^sub>1 + 1)) (Main, Label l'' \<oplus> #:c\<^sub>1 + 1)

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
using intra1 intra2
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Label l'' \<oplus> #:c\<^sub>1 + 1) (as \<oplus>s #:c\<^sub>1 + 1) (Main, Exit \<oplus> #:c\<^sub>1 + 1)
ProcCFG.path wfp (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label (#:c\<^sub>1 + 1)) # (asx' \<oplus>s #:c\<^sub>1 + 1)) (Main, Label l'' \<oplus> #:c\<^sub>1 + 1)
\<forall>a\<in>set as. intra_kind (kind a)
\<forall>a\<in>set as'. intra_kind (kind a)

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
by(fastforce simp:label_incrs_def intra_kind_def add.assoc)
[PROOF STATE]
proof (state)
this:
\<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (2 subgoals):
 1. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
case (While b c')
[PROOF STATE]
proof (state)
this:
\<lbrakk>?l < #:c'; Rep_wf_prog ?wfp = (c', procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path ?wfp (Main, Label ?l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path ?wfp (Main, Entry) as' (Main, Label ?l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
l < #:while (b) c'
Rep_wf_prog wfp = (while (b) c', procs)

goal (2 subgoals):
 1. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
note IH = \<open>\<And>l wfp. \<lbrakk>l < #:c'; Rep_wf_prog wfp = (c', procs)\<rbrakk> \<Longrightarrow>
      \<exists>as as'. wfp \<turnstile> (Main, Label l) -as\<rightarrow>* (Main, Exit) \<and>
      (\<forall>a\<in>set as. intra_kind (kind a)) \<and>
      wfp \<turnstile> (Main, Entry) -as'\<rightarrow>* (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))\<close>
[PROOF STATE]
proof (state)
this:
\<lbrakk>?l < #:c'; Rep_wf_prog ?wfp = (c', procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path ?wfp (Main, Label ?l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path ?wfp (Main, Entry) as' (Main, Label ?l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (2 subgoals):
 1. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
note [simp] = \<open>Rep_wf_prog wfp = (while (b) c', procs)\<close>
[PROOF STATE]
proof (state)
this:
Rep_wf_prog wfp = (while (b) c', procs)

goal (2 subgoals):
 1. \<And>x1 prog l wfp. \<lbrakk>\<And>l wfp. \<lbrakk>l < #:prog; Rep_wf_prog wfp = (prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a)); l < #:while (x1) prog; Rep_wf_prog wfp = (while (x1) prog, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
proof(cases "l = 0")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
l = 0

goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
hence "wfp \<turnstile> (Main,Label l) -
        ((Main,Label 0),(\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>,(Main,Label 1))#
        [((Main,Label 1),\<Up>id,(Main,Exit))]\<rightarrow>* (Main,Exit)"
[PROOF STATE]
proof (prove)
using this:
l = 0

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Label l) [((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)
[PROOF STEP]
by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_WhileFalseSkip
          Proc_CFG_WhileFalse simp:valid_edge_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label l) [((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)

goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label l) [((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)

goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
have "while (b) c' \<turnstile> Entry -IEdge (\<lambda>s. True)\<^sub>\<surd>\<rightarrow>\<^sub>p Label 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. while (b) c' \<turnstile> Entry -IEdge (\<lambda>s. True)\<^sub>\<surd>\<rightarrow>\<^sub>p Label 0
[PROOF STEP]
by(rule Proc_CFG_Entry)
[PROOF STATE]
proof (state)
this:
while (b) c' \<turnstile> Entry -IEdge (\<lambda>s. True)\<^sub>\<surd>\<rightarrow>\<^sub>p Label 0

goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with \<open>l = 0\<close>
[PROOF STATE]
proof (chain)
picking this:
l = 0
while (b) c' \<turnstile> Entry -IEdge (\<lambda>s. True)\<^sub>\<surd>\<rightarrow>\<^sub>p Label 0
[PROOF STEP]
have "wfp \<turnstile> (Main,Entry)
        -[((Main,Entry),(\<lambda>s. True)\<^sub>\<surd>,(Main,Label 0))]\<rightarrow>* (Main,Label l)"
[PROOF STATE]
proof (prove)
using this:
l = 0
while (b) c' \<turnstile> Entry -IEdge (\<lambda>s. True)\<^sub>\<surd>\<rightarrow>\<^sub>p Label 0

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label l)
[PROOF STEP]
by(fastforce intro:ProcCFG.path.intros Main
                     simp:ProcCFG.valid_node_def valid_edge_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label l)

goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp (Main, Label l) [((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label l)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Label l) [((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label l)

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
by(fastforce simp:intra_kind_def)
[PROOF STATE]
proof (state)
this:
\<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (1 subgoal):
 1. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
l \<noteq> 0

goal (1 subgoal):
 1. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
hence "1 \<le> l"
[PROOF STATE]
proof (prove)
using this:
l \<noteq> 0

goal (1 subgoal):
 1. 1 \<le> l
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
1 \<le> l

goal (1 subgoal):
 1. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
1 \<le> l

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
proof(cases "l < 2")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>1 \<le> l; l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
l < 2

goal (2 subgoals):
 1. \<lbrakk>1 \<le> l; l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with \<open>1 \<le> l\<close>
[PROOF STATE]
proof (chain)
picking this:
1 \<le> l
l < 2
[PROOF STEP]
have [simp]:"l = 1"
[PROOF STATE]
proof (prove)
using this:
1 \<le> l
l < 2

goal (1 subgoal):
 1. l = 1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
l = 1

goal (2 subgoals):
 1. \<lbrakk>1 \<le> l; l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
have "wfp \<turnstile> (Main,Label l) -[((Main,Label 1),\<Up>id,(Main,Exit))]\<rightarrow>* (Main,Exit)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Label l) [((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)
[PROOF STEP]
by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_WhileFalseSkip
                      simp:valid_edge_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label l) [((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)

goal (2 subgoals):
 1. \<lbrakk>1 \<le> l; l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label l) [((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)

goal (2 subgoals):
 1. \<lbrakk>1 \<le> l; l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
have "while (b) c' \<turnstile> Label 0 -IEdge (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>\<rightarrow>\<^sub>p
          Label 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. while (b) c' \<turnstile> Label 0 -IEdge (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>\<rightarrow>\<^sub>p Label 1
[PROOF STEP]
by(rule Proc_CFG_WhileFalse)
[PROOF STATE]
proof (state)
this:
while (b) c' \<turnstile> Label 0 -IEdge (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>\<rightarrow>\<^sub>p Label 1

goal (2 subgoals):
 1. \<lbrakk>1 \<le> l; l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
hence "wfp \<turnstile> (Main,Entry) -((Main,Entry),(\<lambda>s. True)\<^sub>\<surd>,(Main,Label 0))#
          [((Main,Label 0),(\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>,(Main,Label 1))]\<rightarrow>*
          (Main,Label l)"
[PROOF STATE]
proof (prove)
using this:
while (b) c' \<turnstile> Label 0 -IEdge (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>\<rightarrow>\<^sub>p Label 1

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0), ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label 1)] (Main, Label l)
[PROOF STEP]
by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_Entry
                       simp:ProcCFG.valid_node_def valid_edge_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0), ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label 1)] (Main, Label l)

goal (2 subgoals):
 1. \<lbrakk>1 \<le> l; l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp (Main, Label l) [((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0), ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label 1)] (Main, Label l)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Label l) [((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0), ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label 1)] (Main, Label l)

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
by(fastforce simp:intra_kind_def)
[PROOF STATE]
proof (state)
this:
\<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (1 subgoal):
 1. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> l < 2

goal (1 subgoal):
 1. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with \<open>1 \<le> l\<close>
[PROOF STATE]
proof (chain)
picking this:
1 \<le> l
\<not> l < 2
[PROOF STEP]
have "2 \<le> l"
[PROOF STATE]
proof (prove)
using this:
1 \<le> l
\<not> l < 2

goal (1 subgoal):
 1. 2 \<le> l
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
2 \<le> l

goal (1 subgoal):
 1. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
2 \<le> l
[PROOF STEP]
obtain l' where [simp]:"l = l' + 2" and "l' = l - 2"
[PROOF STATE]
proof (prove)
using this:
2 \<le> l

goal (1 subgoal):
 1. (\<And>l'. \<lbrakk>l = l' + 2; l' = l - 2\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(simp del:add_2_eq_Suc')
[PROOF STATE]
proof (state)
this:
l = l' + 2
l' = l - 2

goal (1 subgoal):
 1. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>l < #:while (b) c'\<close>
[PROOF STATE]
proof (chain)
picking this:
l < #:while (b) c'
[PROOF STEP]
have "l' < #:c'"
[PROOF STATE]
proof (prove)
using this:
l < #:while (b) c'

goal (1 subgoal):
 1. l' < #:c'
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
l' < #:c'

goal (1 subgoal):
 1. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>Rep_wf_prog wfp = (while (b) c', procs)\<close>
[PROOF STATE]
proof (chain)
picking this:
Rep_wf_prog wfp = (while (b) c', procs)
[PROOF STEP]
obtain wfp' where [simp]:"Rep_wf_prog wfp' = (c', procs)"
[PROOF STATE]
proof (prove)
using this:
Rep_wf_prog wfp = (while (b) c', procs)

goal (1 subgoal):
 1. (\<And>wfp'. Rep_wf_prog wfp' = (c', procs) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(erule wfp_WhileBody)
[PROOF STATE]
proof (state)
this:
Rep_wf_prog wfp' = (c', procs)

goal (1 subgoal):
 1. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from IH[OF \<open>l' < #:c'\<close> this]
[PROOF STATE]
proof (chain)
picking this:
\<exists>as as'. ProcCFG.path wfp' (Main, Label l') as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp' (Main, Entry) as' (Main, Label l') \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
obtain as as'
          where path1:"wfp' \<turnstile> (Main, Label l') -as\<rightarrow>* (Main, Exit)"
          and intra1:"\<forall>a\<in>set as. intra_kind (kind a)"
          and path2:"wfp' \<turnstile> (Main, Entry) -as'\<rightarrow>* (Main, Label l')"
          and intra2:"\<forall>a\<in>set as'. intra_kind (kind a)"
[PROOF STATE]
proof (prove)
using this:
\<exists>as as'. ProcCFG.path wfp' (Main, Label l') as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp' (Main, Entry) as' (Main, Label l') \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (1 subgoal):
 1. (\<And>as as'. \<lbrakk>ProcCFG.path wfp' (Main, Label l') as (Main, Exit); \<forall>a\<in>set as. intra_kind (kind a); ProcCFG.path wfp' (Main, Entry) as' (Main, Label l'); \<forall>a\<in>set as'. intra_kind (kind a)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp' (Main, Label l') as (Main, Exit)
\<forall>a\<in>set as. intra_kind (kind a)
ProcCFG.path wfp' (Main, Entry) as' (Main, Label l')
\<forall>a\<in>set as'. intra_kind (kind a)

goal (1 subgoal):
 1. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from path1
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp' (Main, Label l') as (Main, Exit)
[PROOF STEP]
have "as \<noteq> []"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp' (Main, Label l') as (Main, Exit)

goal (1 subgoal):
 1. as \<noteq> []
[PROOF STEP]
by(fastforce elim:ProcCFG.path.cases)
[PROOF STATE]
proof (state)
this:
as \<noteq> []

goal (1 subgoal):
 1. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with path1
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp' (Main, Label l') as (Main, Exit)
as \<noteq> []
[PROOF STEP]
obtain ax asx where [simp]:"as = asx@[ax]"
          and "wfp' \<turnstile> (Main, Label l') -asx\<rightarrow>* sourcenode ax"
          and "valid_edge wfp' ax" and "targetnode ax = (Main, Exit)"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp' (Main, Label l') as (Main, Exit)
as \<noteq> []

goal (1 subgoal):
 1. (\<And>asx ax. \<lbrakk>as = asx @ [ax]; ProcCFG.path wfp' (Main, Label l') asx (sourcenode ax); valid_edge wfp' ax; targetnode ax = (Main, Exit)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by -(erule ProcCFG.path_split_snoc,fastforce+)
[PROOF STATE]
proof (state)
this:
as = asx @ [ax]
ProcCFG.path wfp' (Main, Label l') asx (sourcenode ax)
valid_edge wfp' ax
targetnode ax = (Main, Exit)

goal (1 subgoal):
 1. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with wf
[PROOF STATE]
proof (chain)
picking this:
well_formed procs
as = asx @ [ax]
ProcCFG.path wfp' (Main, Label l') asx (sourcenode ax)
valid_edge wfp' ax
targetnode ax = (Main, Exit)
[PROOF STEP]
obtain lx etx where "sourcenode ax = (Main,Label lx)"
          and "intra_kind (kind ax)"
[PROOF STATE]
proof (prove)
using this:
well_formed procs
as = asx @ [ax]
ProcCFG.path wfp' (Main, Label l') asx (sourcenode ax)
valid_edge wfp' ax
targetnode ax = (Main, Exit)

goal (1 subgoal):
 1. (\<And>lx. \<lbrakk>sourcenode ax = (Main, Label lx); intra_kind (kind ax)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
apply(auto elim!:PCFG.cases dest:Proc_CFG_Call_Labels simp:valid_edge_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>n. \<lbrakk>\<And>lx. \<lbrakk>n = Label lx; intra_kind (kind ax)\<rbrakk> \<Longrightarrow> thesis; well_formed procs; ProcCFG.path wfp' (Main, Label l') asx (Main, n); targetnode ax = (Main, Exit); sourcenode ax = (Main, n); c' \<turnstile> n -IEdge (kind ax)\<rightarrow>\<^sub>p Exit\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by(case_tac n)(auto dest:Proc_CFG_IEdge_intra_kind)
[PROOF STATE]
proof (state)
this:
sourcenode ax = (Main, Label lx)
intra_kind (kind ax)

goal (1 subgoal):
 1. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with \<open>wfp' \<turnstile> (Main, Label l') -asx\<rightarrow>* sourcenode ax\<close> intra1
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp' (Main, Label l') asx (sourcenode ax)
\<forall>a\<in>set as. intra_kind (kind a)
sourcenode ax = (Main, Label lx)
intra_kind (kind ax)
[PROOF STEP]
have "wfp \<turnstile> (Main, Label l' \<oplus> 2) -asx \<oplus>s 2\<rightarrow>* (Main,Label lx \<oplus> 2)"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp' (Main, Label l') asx (sourcenode ax)
\<forall>a\<in>set as. intra_kind (kind a)
sourcenode ax = (Main, Label lx)
intra_kind (kind ax)

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Label l' \<oplus> 2) (asx \<oplus>s 2) (Main, Label lx \<oplus> 2)
[PROOF STEP]
by -(rule path_Main_WhileBody,auto)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label l' \<oplus> 2) (asx \<oplus>s 2) (Main, Label lx \<oplus> 2)

goal (1 subgoal):
 1. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from \<open>valid_edge wfp' ax\<close> \<open>sourcenode ax = (Main,Label lx)\<close>
          \<open>targetnode ax = (Main, Exit)\<close> \<open>intra_kind (kind ax)\<close> wf
[PROOF STATE]
proof (chain)
picking this:
valid_edge wfp' ax
sourcenode ax = (Main, Label lx)
targetnode ax = (Main, Exit)
intra_kind (kind ax)
well_formed procs
[PROOF STEP]
have "while (b) c',procs \<turnstile> (Main,Label lx \<oplus> 2) -kind ax\<rightarrow>
          (Main,Label 0)"
[PROOF STATE]
proof (prove)
using this:
valid_edge wfp' ax
sourcenode ax = (Main, Label lx)
targetnode ax = (Main, Exit)
intra_kind (kind ax)
well_formed procs

goal (1 subgoal):
 1. while (b) c',procs \<turnstile> (Main, Label lx \<oplus> 2) -kind ax\<rightarrow> (Main, Label 0)
[PROOF STEP]
by(fastforce intro!:Main Proc_CFG_WhileBodyExit elim!:PCFG.cases
                        dest:Proc_CFG_Call_Labels simp:valid_edge_def)
[PROOF STATE]
proof (state)
this:
while (b) c',procs \<turnstile> (Main, Label lx \<oplus> 2) -kind ax\<rightarrow> (Main, Label 0)

goal (1 subgoal):
 1. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
hence "wfp \<turnstile> (Main,Label lx \<oplus> 2)
          -((Main,Label lx \<oplus> 2),kind ax,(Main,Label 0))#
          ((Main,Label 0),(\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>,(Main,Label 1))#
          [((Main,Label 1),\<Up>id,(Main,Exit))]\<rightarrow>* (Main,Exit)"
[PROOF STATE]
proof (prove)
using this:
while (b) c',procs \<turnstile> (Main, Label lx \<oplus> 2) -kind ax\<rightarrow> (Main, Label 0)

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Label lx \<oplus> 2) [((Main, Label lx \<oplus> 2), kind ax, Main, Label 0), ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)
[PROOF STEP]
by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_WhileFalse
            Proc_CFG_WhileFalseSkip simp:valid_edge_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label lx \<oplus> 2) [((Main, Label lx \<oplus> 2), kind ax, Main, Label 0), ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)

goal (1 subgoal):
 1. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with \<open>wfp \<turnstile> (Main, Label l' \<oplus> 2) -asx \<oplus>s 2\<rightarrow>* (Main,Label lx \<oplus> 2)\<close>
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp (Main, Label l' \<oplus> 2) (asx \<oplus>s 2) (Main, Label lx \<oplus> 2)
ProcCFG.path wfp (Main, Label lx \<oplus> 2) [((Main, Label lx \<oplus> 2), kind ax, Main, Label 0), ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)
[PROOF STEP]
have "wfp \<turnstile> (Main, Label l) -(asx \<oplus>s 2)@
          (((Main,Label lx \<oplus> 2),kind ax,(Main,Label 0))#
          ((Main,Label 0),(\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>,(Main,Label 1))#
          [((Main,Label 1),\<Up>id,(Main,Exit))])\<rightarrow>* (Main,Exit)"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Label l' \<oplus> 2) (asx \<oplus>s 2) (Main, Label lx \<oplus> 2)
ProcCFG.path wfp (Main, Label lx \<oplus> 2) [((Main, Label lx \<oplus> 2), kind ax, Main, Label 0), ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Label l) ((asx \<oplus>s 2) @ [((Main, Label lx \<oplus> 2), kind ax, Main, Label 0), ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)]) (Main, Exit)
[PROOF STEP]
by(fastforce intro:ProcCFG.path_Append)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label l) ((asx \<oplus>s 2) @ [((Main, Label lx \<oplus> 2), kind ax, Main, Label 0), ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)]) (Main, Exit)

goal (1 subgoal):
 1. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label l) ((asx \<oplus>s 2) @ [((Main, Label lx \<oplus> 2), kind ax, Main, Label 0), ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)]) (Main, Exit)

goal (1 subgoal):
 1. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
from path2
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp' (Main, Entry) as' (Main, Label l')
[PROOF STEP]
have "as' \<noteq> []"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp' (Main, Entry) as' (Main, Label l')

goal (1 subgoal):
 1. as' \<noteq> []
[PROOF STEP]
by(fastforce elim:ProcCFG.path.cases)
[PROOF STATE]
proof (state)
this:
as' \<noteq> []

goal (1 subgoal):
 1. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with path2
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp' (Main, Entry) as' (Main, Label l')
as' \<noteq> []
[PROOF STEP]
obtain ax' asx' where [simp]:"as' = ax'#asx'"
          and "wfp' \<turnstile> targetnode ax' -asx'\<rightarrow>* (Main,Label l')"
          and "valid_edge wfp' ax'" and "sourcenode ax' = (Main, Entry)"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp' (Main, Entry) as' (Main, Label l')
as' \<noteq> []

goal (1 subgoal):
 1. (\<And>ax' asx'. \<lbrakk>as' = ax' # asx'; ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l'); valid_edge wfp' ax'; sourcenode ax' = (Main, Entry)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by -(erule ProcCFG.path_split_Cons,fastforce+)
[PROOF STATE]
proof (state)
this:
as' = ax' # asx'
ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l')
valid_edge wfp' ax'
sourcenode ax' = (Main, Entry)

goal (1 subgoal):
 1. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with wf
[PROOF STATE]
proof (chain)
picking this:
well_formed procs
as' = ax' # asx'
ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l')
valid_edge wfp' ax'
sourcenode ax' = (Main, Entry)
[PROOF STEP]
have "targetnode ax' = (Main,Label 0)" and "intra_kind (kind ax')"
[PROOF STATE]
proof (prove)
using this:
well_formed procs
as' = ax' # asx'
ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l')
valid_edge wfp' ax'
sourcenode ax' = (Main, Entry)

goal (1 subgoal):
 1. targetnode ax' = (Main, Label 0) &&& intra_kind (kind ax')
[PROOF STEP]
by(fastforce elim!:PCFG.cases dest:Proc_CFG_Call_Labels
            Proc_CFG_EntryD simp:intra_kind_def valid_edge_def)+
[PROOF STATE]
proof (state)
this:
targetnode ax' = (Main, Label 0)
intra_kind (kind ax')

goal (1 subgoal):
 1. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with \<open>wfp' \<turnstile> targetnode ax' -asx'\<rightarrow>* (Main,Label l')\<close> intra2
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l')
\<forall>a\<in>set as'. intra_kind (kind a)
targetnode ax' = (Main, Label 0)
intra_kind (kind ax')
[PROOF STEP]
have "wfp \<turnstile> (Main, Label 0 \<oplus> 2) -asx' \<oplus>s 2\<rightarrow>* (Main,Label l' \<oplus> 2)"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp' (targetnode ax') asx' (Main, Label l')
\<forall>a\<in>set as'. intra_kind (kind a)
targetnode ax' = (Main, Label 0)
intra_kind (kind ax')

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Label 0 \<oplus> 2) (asx' \<oplus>s 2) (Main, Label l' \<oplus> 2)
[PROOF STEP]
by -(rule path_Main_WhileBody,auto simp del:add_2_eq_Suc')
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label 0 \<oplus> 2) (asx' \<oplus>s 2) (Main, Label l' \<oplus> 2)

goal (1 subgoal):
 1. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
hence "wfp \<turnstile> (Main,Entry) -((Main,Entry),(\<lambda>s. True)\<^sub>\<surd>,(Main,Label 0))#
          ((Main,Label 0),(\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>,(Main,Label 2))#
          (asx' \<oplus>s 2)\<rightarrow>* (Main,Label l)"
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Label 0 \<oplus> 2) (asx' \<oplus>s 2) (Main, Label l' \<oplus> 2)

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 2) # (asx' \<oplus>s 2)) (Main, Label l)
[PROOF STEP]
by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_WhileTrue
            Proc_CFG_Entry simp:valid_edge_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 2) # (asx' \<oplus>s 2)) (Main, Label l)

goal (1 subgoal):
 1. \<lbrakk>1 \<le> l; \<not> l < 2\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp (Main, Label l) ((asx \<oplus>s 2) @ [((Main, Label lx \<oplus> 2), kind ax, Main, Label 0), ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)]) (Main, Exit)
ProcCFG.path wfp (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 2) # (asx' \<oplus>s 2)) (Main, Label l)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Label l) ((asx \<oplus>s 2) @ [((Main, Label lx \<oplus> 2), kind ax, Main, Label 0), ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)]) (Main, Exit)
ProcCFG.path wfp (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 2) # (asx' \<oplus>s 2)) (Main, Label l)

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
using \<open>intra_kind (kind ax)\<close> intra1 intra2
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Label l) ((asx \<oplus>s 2) @ [((Main, Label lx \<oplus> 2), kind ax, Main, Label 0), ((Main, Label 0), (\<lambda>cf. state_check cf b (Some false))\<^sub>\<surd>, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)]) (Main, Exit)
ProcCFG.path wfp (Main, Entry) (((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0) # ((Main, Label 0), (\<lambda>cf. state_check cf b (Some true))\<^sub>\<surd>, Main, Label 2) # (asx' \<oplus>s 2)) (Main, Label l)
intra_kind (kind ax)
\<forall>a\<in>set as. intra_kind (kind a)
\<forall>a\<in>set as'. intra_kind (kind a)

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
by(fastforce simp:label_incrs_def intra_kind_def)
[PROOF STATE]
proof (state)
this:
\<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (1 subgoal):
 1. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
case (Call p es rets)
[PROOF STATE]
proof (state)
this:
l < #:Call p es rets
Rep_wf_prog wfp = (Call p es rets, procs)

goal (1 subgoal):
 1. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
note Rep [simp] = \<open>Rep_wf_prog wfp = (Call p es rets, procs)\<close>
[PROOF STATE]
proof (state)
this:
Rep_wf_prog wfp = (Call p es rets, procs)

goal (1 subgoal):
 1. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
have cC:"containsCall procs (Call p es rets) [] p"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. containsCall procs (Call p es rets) [] p
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
containsCall procs (Call p es rets) [] p

goal (1 subgoal):
 1. \<And>x1 x2 x3 l wfp. \<lbrakk>l < #:Call x1 x2 x3; Rep_wf_prog wfp = (Call x1 x2 x3, procs)\<rbrakk> \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
proof(cases "l = 0")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
l = 0

goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
have "wfp \<turnstile> (Main,Label 0) -((Main,Label 0),(\<lambda>s. False)\<^sub>\<surd>,(Main,Label 1))#
        [((Main,Label 1),\<Up>id,(Main,Exit))]\<rightarrow>* (Main,Exit)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Label 0) [((Main, Label 0), (\<lambda>s. False)\<^sub>\<surd>, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)
[PROOF STEP]
by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_CallSkip MainCallReturn
          Proc_CFG_Call simp:valid_edge_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label 0) [((Main, Label 0), (\<lambda>s. False)\<^sub>\<surd>, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)

goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label 0) [((Main, Label 0), (\<lambda>s. False)\<^sub>\<surd>, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)

goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
have "Call p es rets,procs \<turnstile> (Main,Entry) -(\<lambda>s. True)\<^sub>\<surd>\<rightarrow> (Main,Label 0)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Call p es rets,procs \<turnstile> (Main, Entry) -(\<lambda>s. True)\<^sub>\<surd>\<rightarrow> (Main, Label 0)
[PROOF STEP]
by(fastforce intro:Main Proc_CFG_Entry)
[PROOF STATE]
proof (state)
this:
Call p es rets,procs \<turnstile> (Main, Entry) -(\<lambda>s. True)\<^sub>\<surd>\<rightarrow> (Main, Label 0)

goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
hence "wfp \<turnstile> (Main,Entry) -[((Main,Entry),(\<lambda>s. True)\<^sub>\<surd>,(Main,Label 0))]\<rightarrow>*
        (Main,Label 0)"
[PROOF STATE]
proof (prove)
using this:
Call p es rets,procs \<turnstile> (Main, Entry) -(\<lambda>s. True)\<^sub>\<surd>\<rightarrow> (Main, Label 0)

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label 0)
[PROOF STEP]
by(fastforce intro:ProcCFG.path.intros
          simp:ProcCFG.valid_node_def valid_edge_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label 0)

goal (2 subgoals):
 1. l = 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
 2. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp (Main, Label 0) [((Main, Label 0), (\<lambda>s. False)\<^sub>\<surd>, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label 0)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Label 0) [((Main, Label 0), (\<lambda>s. False)\<^sub>\<surd>, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label 0)

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
using \<open>l = 0\<close>
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Label 0) [((Main, Label 0), (\<lambda>s. False)\<^sub>\<surd>, Main, Label 1), ((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0)] (Main, Label 0)
l = 0

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
by(fastforce simp:intra_kind_def)
[PROOF STATE]
proof (state)
this:
\<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal (1 subgoal):
 1. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
l \<noteq> 0

goal (1 subgoal):
 1. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
with \<open>l < #:Call p es rets\<close>
[PROOF STATE]
proof (chain)
picking this:
l < #:Call p es rets
l \<noteq> 0
[PROOF STEP]
have "l = 1"
[PROOF STATE]
proof (prove)
using this:
l < #:Call p es rets
l \<noteq> 0

goal (1 subgoal):
 1. l = 1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
l = 1

goal (1 subgoal):
 1. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
have "wfp \<turnstile> (Main,Label 1) -[((Main,Label 1),\<Up>id,(Main,Exit))]\<rightarrow>* (Main,Exit)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Label 1) [((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)
[PROOF STEP]
by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_CallSkip
                    simp:valid_edge_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label 1) [((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)

goal (1 subgoal):
 1. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Label 1) [((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)

goal (1 subgoal):
 1. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
have "Call p es rets,procs \<turnstile> (Main,Label 0) -(\<lambda>s. False)\<^sub>\<surd>\<rightarrow> (Main,Label 1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Call p es rets,procs \<turnstile> (Main, Label 0) -(\<lambda>s. False)\<^sub>\<surd>\<rightarrow> (Main, Label 1)
[PROOF STEP]
by(fastforce intro:MainCallReturn Proc_CFG_Call)
[PROOF STATE]
proof (state)
this:
Call p es rets,procs \<turnstile> (Main, Label 0) -(\<lambda>s. False)\<^sub>\<surd>\<rightarrow> (Main, Label 1)

goal (1 subgoal):
 1. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
hence "wfp \<turnstile> (Main,Entry) -((Main,Entry),(\<lambda>s. True)\<^sub>\<surd>,(Main,Label 0))#
        [((Main,Label 0),(\<lambda>s. False)\<^sub>\<surd>,(Main,Label 1))]\<rightarrow>* (Main,Label 1)"
[PROOF STATE]
proof (prove)
using this:
Call p es rets,procs \<turnstile> (Main, Label 0) -(\<lambda>s. False)\<^sub>\<surd>\<rightarrow> (Main, Label 1)

goal (1 subgoal):
 1. ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0), ((Main, Label 0), (\<lambda>s. False)\<^sub>\<surd>, Main, Label 1)] (Main, Label 1)
[PROOF STEP]
by(fastforce intro:ProcCFG.path.intros Main Proc_CFG_Entry
                    simp:ProcCFG.valid_node_def valid_edge_def)
[PROOF STATE]
proof (state)
this:
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0), ((Main, Label 0), (\<lambda>s. False)\<^sub>\<surd>, Main, Label 1)] (Main, Label 1)

goal (1 subgoal):
 1. l \<noteq> 0 \<Longrightarrow> \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ProcCFG.path wfp (Main, Label 1) [((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0), ((Main, Label 0), (\<lambda>s. False)\<^sub>\<surd>, Main, Label 1)] (Main, Label 1)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Label 1) [((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0), ((Main, Label 0), (\<lambda>s. False)\<^sub>\<surd>, Main, Label 1)] (Main, Label 1)

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
using \<open>l = 1\<close>
[PROOF STATE]
proof (prove)
using this:
ProcCFG.path wfp (Main, Label 1) [((Main, Label 1), \<Up>id, Main, Exit)] (Main, Exit)
ProcCFG.path wfp (Main, Entry) [((Main, Entry), (\<lambda>s. True)\<^sub>\<surd>, Main, Label 0), ((Main, Label 0), (\<lambda>s. False)\<^sub>\<surd>, Main, Label 1)] (Main, Label 1)
l = 1

goal (1 subgoal):
 1. \<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))
[PROOF STEP]
by(fastforce simp:intra_kind_def)
[PROOF STATE]
proof (state)
this:
\<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>as as'. ProcCFG.path wfp (Main, Label l) as (Main, Exit) \<and> (\<forall>a\<in>set as. intra_kind (kind a)) \<and> ProcCFG.path wfp (Main, Entry) as' (Main, Label l) \<and> (\<forall>a\<in>set as'. intra_kind (kind a))

goal:
No subgoals!
[PROOF STEP]
qed