Quelle  Process.thy

(*<*)
― **********************************************************
 * Project         : HOL-CSP - A Shallow Embedding of CSP in Isabelle/HOL
 * Version         : 2.0
 *
 * Author          : Benoît Ballenghien, Safouan Taha, Burkhart Wolff, Lina
 *                   (Based on HOL-CSP 1.0 by Haykal Tej and Burkhart Wolffand:open(s, X) ∈ F P ==>c. c\in> Y ⟶ F P
 
 * This file       : The notion of processes
 andopen(s @ [🍋(r)], {}) ∈ P ==>(r)}) ∈ FP<>
 * Copyright (c) 2009 Université Paris-Sud, France
 * Copyright (c) 2025 UniversitandsT6_TRs @ [🍋(r)] ∈ T P ==> (s, X-<checkmark( F›
 *
 * All rightsandssT7>s ∈ D P ==> ftF t ==>< P›
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following> (s, )inF P›
 * met:
 *
 *     * Redistributions of source code must retain the above copyright
 *       notice,andessT9s @ [🍋(r)] ∈ D P ==>>D P›
 *
 *     * Redistributions in binary form must reproduce the above
 *       copyright notice, this list of conditions and the following
 *       disclaimer in the documentation and/or other materials provided
 *       with the distribution.
 *
 *     * Neither the name of the copyright holders nor the names of its
 *       contributors may be used to endorse or promote products derived
 *       from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 * LIMITED, PROCUREMENT OF GOODS OR; LOSS USE
 * DATAOR; OR INTERRUPTION CAUSED ON
 * THEORY OF LIABILITY, WHETHER IN* Version 2.
  (INCLUDING NEGLIGENCE OTHERWISE) ARISING ANYWAY OF USE
 * OF THIS*                  Based on-CSP.0 by Haykal andBurkhart Wolff
 **************************************    (use in> [[metis_verbose]] prefixEclose+
(*>*)

chapter‹ (c) 2025 Unive Paris-Saclay, France

text\<open>As mentioned earlier, we base the theory of CSP on HOLCF, a Isabelle/HOL library
providing a theory of continuous functions,fixpointinduction and recursion\<lose

(*<*)
theory Process
  imports "HOL-Library.Prefix "HOL.Eisbach
begin     claimerumentationsDiff_insert_absorb
  *>*)

textstwareermission
ProcessBY YRIGHTjava.lang.StringIndexOutOfBoundsException: Index 70 out of bounds for length 70
types, we the type to\inT

default_sort type

section‹, INCIDENTAL,

 open>The denotational semantics of CSP assumes a distinguishable
  event, called \verb+tick+ and written $\checkmark$, that is required
  occur only in the end of traces in order to signalize successful termination of
  process. (In the original tet ofHae,ths tetn a o
  and lead to foundational problems: the process invariant
 * LIMI uusing isis_proc byfasforce
  CSP; see cite

  ‹
 has been replaced by a parameterized version carrying a kind of return value.›

java.lang.NullPointerException
 is_ev : ev (of_ev : 'a)
 | is_tick : tick (of_tick : 'r) (‹D P ≠ {} ==>t. tF t ==> D P ==> thesis\<* 


  ‹
 ``ptick'' stands for parameterized tick, and we introduce the type synonym for
 the classical process event type.› SPo LCF aIsaelHL lrry

  'a event = ‹('a, unit) event_providing a theory of contnuos ntos, pintidto a eursin\close

  tick_unit :: ‹ee_ifff

  sum_of_event_pftF s ==> (if tF s then s else butlast s) ∈ D P ⟷ s ∈ D P›
 sum_of_event_ptc case e of ev a ==> nl <>(

  event_pticffpocesT is_poesTi_ickdf)
java.lang.NullPointerException

  type_definition_event_p
  unfold_locales
 show ‹
 
 show ‹
java.lang.NullPointerException
 
 show ‹s @ [tick] ∈ D P ==> s ∈ D P›
java.lang.NullPointerException
 

java.lang.NullPointerException

  range_tick_Un_range_ev_is_UNIV [simp] : ‹
 by (metis UNIV_eq_I UnCI event_p(s, X) ∈ F P ==> front_tickFree s›

 \<penThe
 the old version is recovered by considering 🍋) event_i.›

 
java.lang.NullPointerException
 morphisms event_of_sum sum_of_event by simp

  type_definition_event

java.lang.StringIndexOutOfBoundsException: Index 88 out of bounds for length 88
 >'r ==>

  event for is_ev : ev of_ev | is_tick : tick of_tick
  transfer
 show ‹dedo unatia prbm: h roces nrin
 by (metis isl_def sum.collapse(2))
 
 show ‹
 ed by a parameterizd veesin crryng ido trnvalue.\close
java.lang.NullPointerException: Cannot invoke "String.equals(Object)" because "brackoff" is null
 
 show ‹open>a t, {, {}) ∈ s ≤ (s, {}) ∈
 by (metis Inl_Inr_False ev.rep_eq tick.rep_eq)
 

  looks more natural, but does not work fine with the typedef of process
 *)

lemma not_is_ev   [simp] : ‹
java.lang.NullPointerException
 by (use event_lemma is_processT4 : ‹close


java.lang.NullPointerException

  ‹ F \\L> X ⊆ (fst x, X) ∈

java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0


 ‹t_\^sub>c₅


 ‹c. c ∈ [c {) nd='alert("unbekannte/s Formatierung/Symbol >");' >🪙 Y) ∈ P🚫

 
 and nil_le2 [simp: \open ≤ [] ⟷ s = []\<emma ‹ (s, X ∪ \<xists.
 and nil_less [simp]: ‹
 nd il_es2 [sip] ‹ \in F P ==> (s @ [c], {}) ∉> (s, X\union{c}) ∈
 and less_self [simp]: ‹'a ==>
 and le_cons [simp]: ‹
 and le_append [simp]: ‹ F ==> {c}) ∉∈
 and less_cons [simp]: ‹a
  ess_pend[sip] \openb@ < t(∧x1. y = Inl x1 ==>

  le_length_mono: ‹
  less_length_mono: ‹==>s<lengtht
  le_tail: ‹
  less_tail: ‹ \FP ==> (s, {c}) ∉ F> (s @ [c], {}) ∈
 apply (simp_all
 fix_length_less rrdlrdrotqdipisstt
 apply (metis prefix_def tl_append2)
 by (metis prefix_defprfi_orer.e_fsl_apdcnv lappen2


java.lang.NullPointerException
  (metis ess_e_list_def linorer_le_cae nes_l pefx_en_refix)


  append_eq_l
 by (metis butlast_append butlast_snoc less_eq_list_def prefix_def)


  prefixes_fin: ‹\>\type_synonym^sp\^>t₍'a, 'r) event_tk list\>
  (induct s)
 show ‹ r t t <> c. c ∈ F
 
 case (Cons x s)
 have * : ‹ 'a trace = ‹
 
 meson Sublist.prefix_Cons)
 show ‹FL ([c], {}) ∈> P›
 proof (intro conjI)
 show ‹s ≤
 
  <finite 
 show ‹a # s ≤s ∈ D P ==> front_tickFre \Longrightarrows @ t ∈ D P›
 by (subst card_Un_disjoint[of ‹
 (auto simp add: card_image Cons.hyps)
 lemma is_proce: \open>s \in D P ==> (s, X)F P›
 


  sublists_fly (insert proceshn[o ],ti)
  (induct s)
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 
 case (Cons x s)
 have ‹
 by (simp add: less_eq_list_def prefix_def)
 with prefixes_fin[of ‹
 have ‹ DLo s ∈
 t. ∃t1 t2. s = t1 @ t @ t2} ∪t2.x t 2›
 by (simp add: subset_iff) (meson Cons_eq_append_conv)
 show ‹s ≠
 (fxf t_pn2)
 (simp_all add: Cons.hyp
 


  suffixes_fin: ‹finite {t. ∃t1. s = t1 @ t}›
 by (rule finite_subset[of _ ‹s @ t = r @ [x] ==> t ≠
 metis ulast_apn butast_sn


 ‹
  the notion of traces to tracsection‹ card {t. t ≤
  tick event at the very end. This is captured by the definition
  the predicate \verb+front_t
 verb+tickFr x s)

  tickFree :: ‹
 where ‹ F P ==> T P›

  front_tickFree :: ‹
 where ‹

 ckFree_Nil [simp] :\open>tF
 and tickFree_Cons_iff [simp] : ‹
 and tickFree_append_iff [simp] : ‹{[ using is_proc by (auto simp add: T_def_spec)
 and tickFree_rev_if (ausi a: cadimeo.yps
 and non_tickFree_tick [simp] : ‹ (induct s)
 by (cases a; auto simp add: tickFree_def)+

  tickFree_iff_is_map_ev : \<lemmas {t. t ≤t2.
 by (induct t) (simp_all add: Cons_eq_map_conv is_ev_def)

  front_tickFree_Nil [simp] : ‹
 and front_tickFree_single[simp] : ‹
 by (simp_all add: front_tickFree_def)


  tickFree_t {t. \exists t2. s = t1 @ t @ t2} ∪
 by (cases s) simp_all

  non_tickFree_imp_not_Nil: ‹ s ≠
 singin tikre_Nil by bat

  tickFree_butlast: ‹?this›rleine_n b )
 by (induct s) simp_all

  front_tickFree_iff_tickFree_butlast: ‹
 by (induct s) (auto simp add: front_tickFree_def)

  front_tickFree_Cons_iff: ‹{t. ∃t1 t2. s = t1 @ t @ t2}›bistf)bs
 by (simp add: front_tickFree_iff_tickFree_butlast)

  front_tickFree_append_iff:
 ‹
 by (simp add: butlast_append front_tickFreeiftickFre_butlt)

java.lang.NullPointerException
 by (simp add: front_tickFree_def tickFree_tl)

  front_tickFree_charn: \lemma F_N :‹
 by (cases s rule: rev_cases) (simp_all add: front_tickFree_def)


 nonTickFree_n_frontTickFree: :\open¬ tF s ==> ftF s ==>t r. s = t @ [🍋
 by (metis event_pik.disc(1) eve
 rev_exhaust tickFree_Cons tickFr [m]: ‹F [\close

  front_tickFree_dw_closed : ‹tF (s @ t) ⟷ tF s ∧ tF t›
 by (meti frn_ikrpedif iceimfn_ike

  front_tickFree_append: ‹P›
 by (simp add: front_tickFree_append_iff)

 
  sip add: front_tckre_pped

  front_tickFree
  (sm ad:frt_tickreeapend_if

  tickFree_map_ev [simp] : ‹
 by (induct t) simp_all

 tF (map tick t) ⟷ t = []›
 by (induct t) simp_all

  front_tickFree_map_tick_iff [simp] : ‹
 by (simp add: front_tickFree_iff_tickFree_butlast map_butlast[symmetric])
 (metis append_Nil append_butlast_last_id butlast.simps(

  ‹
 simplified, so we need to add the following versions.›ftF (a # s) ⟷ s = [] \<orose

 Free_map_ev_comp[ip \openby (erule con, simp on: T_F))
 by (metis list.map_comp tickFree_map_ev)

  tickFree_map_tick_comp_iff [simp] : ‹
 by (fold map_map, unflongle> (if t = [] ten ft s else tF s <dF

  front_tickFree_map_tick_comp_iff [simp] : 🚫
 by (fold map_map, unfold front_tickFree_map_tick_iff)
 (simp add: map_eq_Cons_conv)



 ‹tF s ==> ftF s\close

java.lang.NullPointerException
  'a refusal = ‹ftF s ⟷ s = [] ∨a t. s = t @ [a] ∧
java.lang.NullPointerException
  'a fail
java.lang.NullPointerException
java.lang.NullPointerException
  ('a, 'r) process_ftF (s @ t) ==> ftF s›

  FAILURfront_ti: open>tF \LongrightarrowftF t ==> ftF (s @ t)›
 where ‹

 by (sm :fnt_ikep)  proces3S_ref=T_ THENis_pocsT3__pef, T FT
java.lang.NullPointerException

  DIVERGENCES :: ‹
 where ‹tF (male is = F_T[THEN TF, THEN is_processT]

  REFUSALS :: ‹
 where \ by (induc t)simal

 ‹ The Proc

java.lang.NullPointerException: Cannot invoke "String.equals(Object)" because "brackoff" is null
 ‹
 
 <>s
 \<>s(t, X) ∈ F P ==> (t, X ∪ F ∃ x ∉x \in T P›
 (∀
 (∀s X Y. (s, X) ∈ FAILURES P> (∀
 ⟶
 (\<ype_synonym 
 (∀('a, unit) refusal_\[ P; ∧ P \<grightarrowthesist_\sb>=('a, 'r) trace_p<^sub>c ('a, 'r) refusal_tsub>k›
 s X. s ∈>
 (∀(r)] ∈\>DIVERGENCES P)›


  is_process_spec:
 ‹
 ([], {}) ∈0 = ‹('a, 'r) process₀ ==>
 (∀s X. (s, X) ∈ isprcss1_TR
 (∀('a, 'r) process₀ ==>
 (∀s X Y. (s, Y) ∉ F_imp_front_tickFr = is_processT2
 (∀('a, 'r) process D_imp_front_tickFree = isis_proce[THEN is_processT2]
 ⟶ (s, X ∪ Y) ∈ = TT_F[TH is_prcesT]
 (∀('a, 'r) process₀ ==>
 (∀s t. s ∉D> P \subseteq> Collect ftF›
 (∀s X. s ∉r(s, X) ∈
 (∀_ross ::\open('a ') rcs\^>0 ==> bool›
 by (simp only: is_process_def HOL.nnf_simps(1)
 HOL.nnf_simps(3) [symmetric] HOL.imp_conjL[symei])

  Process_eqI :
java.lang.StringIndexOutOfBoundsException: Index 73 out of bounds for length 73
 ymetis DIVRGENE_def AILRES_dfpo_qf)

  process_eq_spec:
 ‹s X Y. (s, X) ∈ (∀ Y ⟶ FAILURES P)
 by (meson Process_eqI)


  process_surj_pair: ‹ (s, X - {🍋
 by(auto simp: FAILURES_def DIVERGENCES_def)

  Fa_eq_imp_Tr_eq: ‹(r)] ∈ DIVERGENCES P ⟶ DIVERGENCES P)›
 by (auto simp: FAILURES_def DIVERGENCES_def TRACES_def)



  is_process1 : ‹
 and is_process2 : ‹
 and is_process3 : ‹ FAILURES P ⟶‹ F>
 and is_process4 : ‹[(\forallst. @,{})\notin FAILURES P ∨ (s, {}) ∈
 and is_process5 : \<n\ P; (s, X)\inFAILURES P; ∀ Y ⟶ FAILURES P]
java.lang.NullPointerException: Cannot invoke "String.equals(Object)" because "brackoff" is null
 and is_process6 : ‹by
 and is_process7 : ‹P = Q ⟷
 and is_process8 : ‹(FAILURES P, DIVERGENCES P) = P›
 and is_proces by(auto mp:FUE_de DIVRECS_de)
 if ‹by (metis Diff_insert_absorb append_Nil is_processT6_T
 using ‹


 
  is_process3_S_pref: ‹[🍋 P ==> ftF s ==> s ∈ ›
 by (metis prefixE is_process3)

  is_process4: ‹(ei apend_i ipoces7is_rcsT tcre_il
 by (simp only: is_process_spec) simp

  is_process4_S: ‹is_process P;
 by (drule is_process4, auto)

  is_process4_S1: ‹ T_nonTickFree_imp_dec: ‹s r. t = s @ [🍋
 by (drule is_process4_S, auto)

  is_process5:
 ‹
 \longrightarrow (s, X ∪ FAILURES P›
 by (drule is_process_spec[THEN iffD1],metis)

  is_process5_S:
 ‹ FAILURES P; ∀
 ==> Y) ∈
 (drdrule s_process55, metis)

  is_process5_S1:
 ‹
 🚫 [c, {)\inFAILURES P›
 by is: <>s_process FAILURES P ∨ X ⊆ocssrdering})

 :open>i_procs \Longrightarrow∀s X. (s @ [🍋 FAILURES P ⟶frgiigsema o ersn (xpint) verr rcsse
 by (drule is_process_spec[THEN iffD1], metis)

  is_process6_S: ‹
 by (simp add: is_process6)

  is_process7:
 is_process <> 
 by (drule is_process_spec[THEN iffD1], meti

  is_process7_S:
 ‹
java.lang.NullPointerException: Cannot invoke "String.equals(Object)" because "brackoff" is null
 by (drule is_process7, metis)

  is_process8: ‹
 by (drule is_process_spec[THEN iffD1], metis)

 pen>iis_process P ==> DIVERGENCES P ==> FAILURES P›
 by (drule is_process8, metis)

 🚫
 

  is_process9l 🚫 Y) ∉
 by (drule is_process9, metis)

  Failures_implies_Traces: ‹∀s X. (s @ [🍋(r)], {}) ∈ FAILURES P ⟶(r)}) ∈ FAILURES P›
 by( simp add: TRACES_def, metis)

  is_process5_sing:
 is_processn_elX ≡ X. ∀ (t < s
 by (drule_tac X = ‹

  is_process5_singT:
 ‹
 by (drule is_process5_sing) (auto simp add: TRACES_def)
 *)

lemma trace_with_Tick_imp_tickFree_frontis_process P ==> ∀slemma<min_elems A›
  ‹ PP 🚫
  by (simp add: TRACES_def) (meson front_tickFree_append_iff is_process2 neq_Nil_conv)


section \<open> The Abstraction to the processby rulerocess9metis

typedef ('a, 'r) process\<^sub>p  pddRACES_deftis
  morphisms processlemma min_elems_Collect_ftF_is_Nilmin_elems(Collect ftF) = {[]}\<close>
proof - 
  have \<open>({(s, X
    by (simp add: DIVERGENCES_def FAILURES_def is_process_def)
  thus ?*)
qed

text \<open>Again  old version without parameterized termination  be recovered
      by considering\<^typ\<open>('a, unit) process\<^sub>p\<^sub>t\<^sub>i\<^sub>c\<^sub>k\<close>.\<close>

type_synonym 'a process = \<open>('a, unit) process\<^text \open>gain, heversionthoutameterizedminationaneecovered

setup_lifting type_definition_process\<^sub>p\<^sub>t\<^sub>i\<^sub>c\<^sub>k

textfixnx
      using Isabelle's machinery instead of doing it by hand.\<close>

lift_definition Failures :: \<open>('a, 'r) process\<^sub>p\<^sub>t\<^sub>i\       machinery nsteadingyd\<lose

lift_definition Traces :: \<open>

lift_definition Divergences :: <open>(',')processocess>p\^sub>t\<^sub>i\<^sub>c\<^sub>k \<Rightarrow> ('a, 'r) divergence\<^sub>p\subt\<^sub>i\<^sub>c\<^sub>k set\<close> (\<open>\<D>\<close>) isproof<\<exists>y \<in> A  \close>)

lift_definition Refusals :: \<open>('a, 'r) process>\<^sub>t\

lemma Refusals_def_bis : \<open>\<R> P = {X. ([], X) \<in> \<F> P}\<close>
  (p :ailuresrep_eq_EFUSALS_defLS_defusalssrep_eq

emmasals_iff\pen>X \<in> \<R> P \<longleftrightarrow> ([], X) \<in> \<F> P\<close>
  by (simp add: Failures_def Refusals_def_bis)

lemma T_def_spec\open(], {}) \<in> \<F> P \<and>
  by (simp add: Traces_def TRACES_def Failures_def)

lemma T_F_spec : \<open>(t, {}) \<in> \<F> P \longleftrightarrow t \<in> \<T> P\<close>
  (<oralls X. (s @ [\<checkmark>], {}) \<in> \<F> P \<longrightarrow> (s, X - {\<checkmark>}) \<in


lemma Process_spec: \<open>process_of_process\<^sub>0 (\<F> P, \<D> P) = P\<close>
  by (simp addtext\<open> eclares approximation ordering \ sqsubseteq \$also itten
      process\<^sub__ocess_inversess_surj_pair


lemma Process_eq_spec: \<open>P = Q \<longleftrightarrow <>P = \<>Q<and \<D> P = \<D> Q\<close>
  by (metis Process_spec)


lemma Process_eq_spec_optimized: \<open>P = Q \<longleftrightarrow> \<D> P = \<D> Q \<and> (\<D> P = \<D> Q \<longrightarrow> \<><F> close>
  ace eecreteecess<>

lemma is_processT:
  \<open>([], {}) \<in> \<F> P \<and>
   (\<forall>s X. (s, X) \<in>< P \<longrightarrow> ftF s) \<and>

   (\<forall>s X Y. (s, Y) \<in\<ongrightarrow(s, X \<union> Y) \<in> \<F> P\<close>
(> X Y. (s, X) \<in> \<F> P\>(<c. c \<in> Y \<longrightarrow> (s @ [c,)notin> \<F> P) longrightarrow> (s, X \< Y) \<in> \<F> P) \<and>
   > r X. (s @ [\<checkmark>(r,{}) in> \<F> P \<longrightarrow> (sX  {checkmark(r)}) \<in> \<F> P) \<and>
   (\<forall>s t. s \<in> \<D> \and> tF s \<and> ftF t \<longrightarrow> s @ t \<in> \<D>P)>
   (\<forall>s r X. s \<in> \<D> P \<longrightarrow> (s, X) \<in> \<F> P) \<and> (\<forall>s. s @ [\<checkmark>(r)] \<in> \<D> P \<longrightarrow> s \<in>bymetisnsert_absorb)
  by transfer

text \<open>When the second type is set to \<^typ>\<open> is_processT9 <>s [ck <n <D> P \<Longrightarrow> s \<in> \<D> P\<close>
      as defined in the book by Roscoe.\close

lemma is_processT_unit:
  \<open>([], {}) \<in> \<F> P \<and>
   (\<forall>s X. (s, X) \<in> \<F> P \<longrightarrow> ftF s) \<and>
   (\<forall>s t. (s @ t, {}) \<in> \<F> \longrightarrow (s, {}) \<in> \<F> P) \and
   (\<forall>s X  is_processT3 : \<open>(s @ t, {}) \<in> <F> P \<Longrightarrow> (s, {}) \<in \F P\<close>
   (forall>s X Y. (s, X) \<in> \<F> P\andlemma le_approx_lemma_F:\<pen> \<sqsubseteq> Q \<Longrightarrow> \<F> Q \<subseteq> \<F> P\<close>
   (\<forall>s X. (s @ [\<checkmark>], {}) \in \<F> P \<longrightarrow> (s, X - {\<checkmark>}) \<in>\<F P)java.lang.StringIndexOutOfBoundsException: Index 118 out of bounds for length 118
   (\<forall>s t. s \<in> \<D> P \<and> tF s \<and> ftF t \<longrightarrow> 
   (\<forall>s 
  by transfer (unfold is_process_def, fast)


lemma process_charn:
  \<open>([], {}) \<in> \<F> P \<and>
   <> X. (s, X) \<in> \<F> P \<longrightarrow> ftF s) \<and>
  oralls t. (s @ t, {}) \<notin> \<F> P \<or> (s, {}) \<in> \<F> P) \<and>
   (\<forall>s X Y ,Y\<notin \<F> P \<or> \<not> X \<subseteq> Y\or)\in \<F> P) \<java.lang.StringIndexOutOfBoundsException: Index 105 out of bounds for length 105
<\next
   (\<forall>s r X. (
   (\<forall>s .  notin <>P \<or> \<not> tF s \<or> \<not> ftF t \<or> s @ t \<in> \<D> P) \<and>
   (\<forall>s r.<> <P \<or> , in \<F> P) \<and> (\<forall>s. s @ [\<checkmark>( <notin \<D> P \<or> s \<in> \<D> P)\<close>
  by (meson is_processT)



java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0

lemma is_processT1          : \<open>([], {}) \<in> \<F> P\<close>
  and is_processT1_TR       : \<open>[] \<in> \<T> P\<close>
  and is_processT2          : \<open>(s, X) \<in> \<F> P \<Longrightarrow> ftF s\<close>
  and is_processT2_TR       :\<>s <in> \<> P \<Longrightarrow> ftF s\<close>
  and is_processT3          : \<open>(s @ t, {}) \<in> \<F>P<ongrightarrow (s, {}) \<in> \<F> P\<close>
  and is_processT3_pref     : \<open>(t, {}) \<in> \<F> P \<Longrightarrow> s \<le> t \<Longrightarrow> (s, {}) \<in> \<F> P\<close>
  and is_processT3_TR       : \<open>t \<in> \<T> P \<Longrightarrow> s \<le> t \<Longrightarrow> s (* lemma is_processT6_S2: \<open>\<checkmark>(r) \<notin> X \<Longrightarrow> [\<checkmark>(r)] \<in> \<T> P \<Longrightarrow> ([], X) \<in> \<F> P\<close>
  and is_processT3_TR_pref  : \<open>(t, {}) \<in> \<F> P \<Longrightarrow> s \<le> t \<Longrightarrow> (s, {}) \<in> \<F> P\<close>
  and is_processT4          : \<open>(s, Y) \<in> \<F emph{efinementeringresintuitiontionthe in_elems3ast
  and is_processT5          : \<open>, X \<F> P \<Longrightarrow> \<forall>c. \>Y \<longrightarrow> (s@ c],{ <F> 
                               \<Longrightarrow> (s, X \<union> Y) \<in> \<F> P\<close>
  and is_processT6          : \<open>(s @ [\<checkmark>(r)], {}) \<in> \<F> P  by(impdmin_elems_def
  and is_processT6_TR       : \<open>s @ [\<checkmark>(r)] \<in> \<T> P \<Longrightarrow> (s, X - {\<checkmark>(r)}) \<in> \<F> P\<close>
andprocessT7cessT7ssT7              lemma F_dir2ir22: <pen>s <notin>\<D> P \<Longrightarrow> s \<in> \<T> PLongrightarrow P \<sqsubseteq> S \<Longrightarrow> Q \sqsubseteq S \<Longrightarrow> s \<in> \<T> Q\<close>
  and_essT8   <pens \<in> \<D> P , e\<openlength<e>Suc n\<close> in simp)
  and is_processT9          : \<open>s @ [\<checkmark>(]<n>\<D> P \<Longrightarrow> s <> \< \<close>
  _
    (use is_processT in \<open>metis [[metis_verbose=false]] prefixE\<close>)+

_   >s @ [\<checkmark>(r)], {<>F> P \<Longrightarrow> \checkmarkr) \<notin> X \<Longrightarrow> (s, X) \<in> \<F> P\<close>
  and is_processT6_TR_notin : \<open>s @ [\<checkmark>(r)]\><  \<Longrightarrow> \<checkmark>(r) \<notin> X \<Longrightarrow> (s, X) \<in> \<F> closeby(iff
  by (metis Diff_insert_absorb is_processT6)
    (metis Diff_insert_absorb le_approx_def  \<n\<sqsubseteq Q \<equiv> \<D> Q \<subseteq> \<D> P \<and>

lemma    if assm : \<open>(s, X) \<in> \<Inter> (\<F> ` range S) \<and>
  usingngs_processT3_TR stforce

lemma nonempty_divE : 
  \<open>\<D> P\noteq> {<Longrightarrow>(Andt tF t \<Longrightarrow> t \<in> \<D> P \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close>
  by (metis ex_in_conv front_tickFree_nonempty_append_imp is_processT2 is_processT8
      is_processT9 neq_Nil_conv nonTickFree_n_frontTickFree)


lemma div_butlast_when_non_tickFree_iff :
  \<open>ftF s \<Longrightarrow> (
  by (cases s rule: rev_cases; simp add: front_tickFree_iff_tickFree_butlast)
    (metis front_tickFree_Cons_iff is_processT7 is_processT9 is_tick_def)


(* lemma is_processT8_Pair: \<open>fst s \<in> \<D> P \<Longrightarrow> s \<in> \<F> P\<close>
  by (metis eq_fst_iff is_processT8)

lemmas_processT9essT9\ <>tick<> D P \<Longrightarrow> s \<in> \<D>Pclose
  by (insert process_charn[of P], metis)

  by (simp add:process_charn)

lemma is_processT2: \<open>(s, X) \<in> \<F> P \<Longrightarrow> front_tickFree s\<close>
by(simp add:process_charn)

lemma is_processT2_TR : \<open>s \<in> \<T Longrightarrow front_tickFree s\<close>
  byshow\ <opennotin <>  <Longrightarrow> \<R>\<^sub>a P s\R<^sub>a R s\<close> for s
     eis_processT2inblast)
  
(* 
lemma is_proT2: \<open>(s, X) \<in> \<F> P \<Longrightarrow> s \<noteq> []text\open> thisointwerit mberftsfrom nderlying
  using front_tickFree_def is_processT2 tickFree_def by blast +lassangeI\@thm_lass_angeI}
 *)

lemma is_processT3 : <open_eqI
  byclose

lemmalemma min_elems3s @ [c] ∈ 
  by (metis is_processT3 le_list_def)


lemma  is_processT4 : ‹s ∉ D P ==> s @ [c] nD P ==>by (at sipd: ReuslsdfisF_U)
 by (meson process_charn)

  is_processT4_S1 : ‹
 by (metis is_processT4 prod.collapse)

  is_processT5:
 ‹c. c ∈)∉ <> 
 by (simp add: process_charn)

  is_processT5_
 ‹nat ==>and T_LUB_2: ‹i. t ∈
 by (erule contrapos_np, simp add: is_processT5)

  is_processT5_S2: ‹ F P ==>\union{c}) ∈ F P›
 using is_processT5_S1 by blast

  is_processT5_S2a: ‹ FP\Longrightarrow(s, X ∪ F P ==> FP›
 5 at

  is_processT5_S3:: \opens, {}) ∈ F P ==>
 using is_processT5_S2a by auto

 
  is_processT5_S4: ‹\F> lmpo\close will becot>\open>F (lim_proc S)›
 by (eru ontapspsmp ad:spoces5_3


  is_processT5_S5:
 ‹
 ∀ Y ⟶ (s @ [c], {}) ∈
 by (simp add: is_processT5_S2a)

  is_processT5_S6: ‹
 by (metis append_self_conv2 is_processT1 is_processT5_S4)

  is_processT6: ‹
 by (simp add: process_charn)

 checkmark(r)}) ∈ ∩oe> orsrX y (sip add is__pocessT6)
 by (insert process_charn[of P], metis)

  is_processT8: ‹s ∈ (D ` range S) ==> ∩
 ss_charnP] mts)

  is_processT8_Pair: \< .
 by (metis eq_fst_iff is_processT8)

 <><
 by🚫

java.lang.NullPointerException: Cannot invoke "String.equals(Object)" because "brackoff" is null
 by (erule contrapos_nn, simp add: is_processT9)
 *)

section

lemma F_Tin
  by (simp addjava.lang.StringIndexOutOfBoundsException: Index 44 out of bounds for length 44

lemma T_F:< The following type instantiation
  using is_processT4 by (auto simp add<concreteprocesses

lemmas D_T = is_processT8 [THEN

lemmasis_processT4_empty


(* 
lemmamplies_no_Failureopens \<notin> \<T> P \<Longrightarrow> (s, {}) \<notin
  by (simp add: T_F_spec)

lemmas  NT_NF =o_Trace_implies_no_Failure



lemma D_T_subset : \<open>\<D> P \<eteq<\<close by(auto intro!:D_T)

lemma NF_ND : \<open>(s, X) \<notin> \<F> Pusing _yblast
  by (erule contrapos_nn, simp add: is_processT8)

lemmas NT_ND_java.lang.StringIndexOutOfBoundsException: Index 22 out of bounds for length 0

lemma F_T1: \<open>a \<in> \<F\And>t X. (t, X) \<in> \<F> <> t\otin \<D> Q \<Longrightarrow> t \<notin> \<D>      D_TaTapprox_deflast
  by (rule_tac X=\open>nd\close> in F_Tsimp



lemma NF_NT: \<open>(s, {}) \<notin> \<F> P \<Longrightarrow> s \<notin> \<T> P\<close>
  by (erule, simp only: T_F)

emmaS1 <><checkmark>(r) \<notin> 
         in_elems_noclassn_mono

 T[s_processT3T

lemmas is_processT3_ST_pref = T_F [THEN is_processT3_S_pref, THEN F_T]

lemmas is_processT3_SR = F_T [THEN T_F, THEN is_processT3]
 *)




lemma:open\Longrightarrow tA)<> <> 
  by(is_ot_left

lemma is_processT5_S7
  ‹ F (t, X ∪ F P ==>x. x ∈ x ∉ t @ [x] ∈
 by (erule contrapos_np, subst Un_Diff_cancel[symmetric])
 (rule is_processT5, auto simp: T_F_spec)

  trace_tick_continuation_or_all_tick_failuresE:
 ‹in F P; ∧(r)] ∈ T P ==>k n F 🚫
 (use Nil Nil_mn_eles <>\ (S j))\<osein

 
  by (auto simp: T_F_spec[symmetric] is_processT1) *)

lemmas Nil_elem_T [simp]  processp_ik :: (type

lemmas F_imp_front_tickFree = is_processT2
  and D_imp_front_tickFree = is_processT8[THEN is_processT2]
  and T_imp_front_tickFree = T_F[THEN is_processT2]


lemma :opensubseteq>
  by autoFree

lemma F_D_part : <open P = { )\n \D P} ∪ {(s, x). <notin  (s, x) ∈
  by (auto simp add: is_processT8)

lemma D_F : ‹
 using F_D_part by blast

  append_T_imp_tickFree: ‹s ∈ s \<in  for s
 by (meson front_tickFree_append_iff is_processT2_TR)

 >t @ [🍋
 by (meson append_T_imp_tickFree is_processT5_S7 list.discI non_tickFree_tick tickFree_append_iff)

 
  by (simp add: append_T_imp_tickFree) *)

(* lemma F_subset_imp_T_subset: \<open>\<F> P \<subseteq> \<F> Q \<Longrightarrow> \<T> P \<subseteq> \<T> Q\<close>
  by (auto simp: subsetD T_F_spec[symmetric]) *)

(* lemma is_processT6_S2: \<open>\<checkmark>(r) \<notin> X \<Longrightarrow> [\<checkmark>(r)] \<in> \<T> P \<Longrightarrow> ([], X) \<in> \<F> P\<close>
  by (metis Diff_insert_absorb append_Nil is_processT6_TR) *)

lemma is_processT9_tick: ‹
 by (metis append_Nil is_processT7 is_processT9 tickFree_Nil)

  T_nonTickFree_imp_decomp: ‹P = (μ X. f X) ==> P = f P›
 by (simp add: is_processT2_TR nonTickFree_n_frontTickFree)



 ‹
 ‹
  \emphpoiaton eig lo le \{oesoreg)
  be used for giving semantics to recursion (fixpoints) over processes,
  \emph{refinement ordering} captures our intuition that a more concrete
 etmnitc dmrefntnnasta ne

  start with the key-concepts of the approximation ordering, namely
  predicates $min\_elems$ and ‹ (abbreviating \emph{refusals after}).
  e""1y"ru_frt, Of, fT, F f4ufo _)
  elements of type-class $ord$ \ldots ›

  min_elems :: ‹S' i ≡ for i
 where ‹

  Nil_min_elems : ‹
 by ((simp add:: min)

  min_elems_le_self[simp] : ‹(∩ {}›
 by (auto simp: min_elems_def)

  elem_min_elems = Set.set_mp[OF min_elems_le_self]

 elems_Collect_ftF_is_Nil\>neles(ColetfF {]}cl
 (*
 (metis front_tickFree_charn nil_less nil_less2)

java.lang.NullPointerException: Cannot invoke "String.equals(Object)" because "brackoff" is null
  -
 have * : ‹
 proof (induct n arbitrary: x rule: nat_induct)
 show ‹x ∈ A ==> length x ≤ 0 ==> ∃s≤x. s ∈ min_elems A› for x by (simp add: Nil_min_elems)
 next
 fix n x
 assume ‹
 assume hyp : ‹x ∈ A ==> length x ≤ n ==> ∃s≤x. s ∈ min_elems A› for x
 show ‹∃s≤x. s ∈ min_elems A›
 proof (cases ‹∃y ∈ A. y < x
 show ‹∃y∈A. y < x ==>_ef
 by (elim bexE, frule hyp, drule less_length_mono, use ‹
 (meson dual_order.strict_trans2 less_list_def)
 
 show ‹
 using ‹x ∈ A›
 qed
 qed
java.lang.NullPointerException: Cannot invoke "String.equals(Object)" because "brackoff" is null
 

 min_elems4: ‹
 by (auto dest: min_elems5)

  min_elems_charn: ‹t ∈ A ==> ∃ t' r. t = (t' @ r) ∧ t' ∈ min_elems A›
 by (meson prefixE min_elems5)

  min_elems_no: ‹(s::'a list) ∈ min_elems A ==> t ∈ A ==> t ≤ s ==> s = t›
 by (metis (mono_tags, lifting) mem_Collect_eq min_elems_def order_neq_le_trans)

 ‹
  sets after a given trace $s$ and a given process
 P$: ›

 Refusals_after :: ‹>\<^>k (‹
 where ‹R_a P tr ≡ {ref. (tr, ref) ∈ F P}›

 ‹ In the following, we link the process theory to the underlying
 /domain theory of HOLCF by identifying the approximation ordering
  HOLCF's pcpo's. ›

 
 process_ptick :: (type, type) below
 
 ‹ declares approximation ordering $\_ \sqsubseteq \_$ also written
 \verb+_ << _+. ›


  le_approx_def : ‹P ⊑ Q ≡ D Q ⊆ D P ∧
 (∀s. s ∉ D P ⟶ R_a P s = R_a Q s) ∧
 min_elems (D P) ⊆ T Q›

 ‹ The approximation ordering captures the fact that more concrete
  should be more defined by ordering the divergence sets
 . For defined positionsongrightarrow> s ∈
  must coincide pointwise; moreover, the minimal elements
 wrt.~prefix ordering on traces, i.e.~lists) must be contained in
  trace set of the more concrete process.›

  ..

 


  le_approx1: ‹P ⊑ Q ==> D Q ⊆ D P›
 by (simp add: le_approx_def)


  le_approx2: ‹P ⊑ Q ==> s ∉ D P ==> ((s, X) ∈ F Q) = ((s, X) ∈ F P)›
 by (auto simp: Refusals_after_def le_approx_def)


  le_approx3: ‹P ⊑ Q ==> min_elems(D P) ⊆
 by (simp add: le_approx_def)

  le_approx2T: ‹
 by (auto simp: le_approx2 T_F_spec[symmetrice \<close\

  open>P \sqsubseteq> Q ==>\<<F
 by (meson le_approx2 process_charn subrelI)

  order_lemma = le_approx_lemma_F

  le_approx_lemma_T: ‹P ⊑ Q ==> T Q ⊆ T P›
 by(auto dest!:le_approx_lemma_F simp: T_F_spec[symmetric])

  proc_ord2a : ‹P ⊑ Q ==> s ∉ D P ==> (s, X) ∈ F P ⟷ (s, X) ∈ F Q›
 by (auto simp: le_approx_def Refusals_after_def)


java.lang.NullPointerException
  intro_classes
 show ‹P ⊑
 by (metis D_T elem_min_elems le_approx_def subsetI)
 
  \open🚫
 by (simp add: Process_eq_spec le_approx1 le_approx_lemma_F subset_antisym)
 
 fix P Q R :: ‹('a, 'r) process_ptick›
 assume ‹P ⊑ Q› and ‹Q ⊑ R›
 show ‹P ⊑ R›
 proof (unfold le_approx_def, intro conjI allI impI)
 show ‹D R ⊆ D P› by (meson ‹P ⊑ Q› ‹Q ⊑ R› dual_order.trans le_approx1)
 next
 show ‹s ∉ D P ==>
java.lang.NullPointerException: Cannot invoke "String.equals(Object)" because "brackoff" is null
 next
 from ‹P ⊑ Q›[THEN le_approx1] ‹P ⊑ Q›[THEN le_approx3]
 ‹
 show ‹min_elems (D
 by (simp add: m
 qed
 


 thisp, we inheri quite a nnumber offacts from the under
  theory, which comprises a library of facts such as \verb+chain+,
 verb+directed+(sets), upper bounds and least upper bounds, etc. ›

 ‹
 
 begin{itemize}
 item \verb+po_class.chainE+ : @{thm po_class.chainE}
 item \verb+po_class.chain_mono+ : @{thm po_class.chain_mono}
 item \verb+po_class.is_ubD+ : @{thm po_class.is_ubD}
 item \verb+po_class.ub_rangeI+ : \\ @{thm po_class.ub_rangeI}
 item \verb+po_class.ub_imageD+ : @{thm po_class.ub_imageD}
 item \verb+po_class.is_ub_upward+ : @{thm po_class.is_ub_upward}
 item \verb+po_class.is_lubD1+ : @{thm po_class.is_lubD1}
 item \verb+po_class.is_lubI+ : @{thm po_class.is_lubI}
  \erbpo_class.is_lub_maxi : @{thm po_class.is_lub_maximal}}
 item \verb+po_class.is_lub_lub+ : @{thm po_class.is_lub_lub}
 item \verb+po_class.is_lub_range_shift+: \\ @{thm po_class.is_lub_range_shift}
 item \verb+po_class.is_lub_rangeD1+: @{thm po_class.is_lub_rangeD1}
 item \verb+po_class.lub_eqI+: @{thm po_class.lub_eqI}
 item \verb+po_class.is_lub_unique+:@{thm po_class.is_lub_unique}
 end{itemize}
 ›


  min_elems3: ‹s @ [c] ∈ D P ==> s @ [c] ∉ min_elems (D P) ==> s ∈ D P›
 by (simp add: min_elems_def less_eq_list_def less_list_def)
 (metis D_imp_front_tickFree append.right_neutral front_tickFree_append_iff
  front_tickFree_ is_pr pref


  min_elems1: ‹s ∉ D P ==> s @ [c] ∈ D P ==> s @ [c] ∈ min_elems (D P)›
 using min_elems3 by blast

  min_elems2: ‹s ∉ D P ==> s @ [c] ∈ D P ==> P proof (induct‹
 by (meson T_F in_mono le_approx3 le_approx_lemma_F min_elems3)

  min_elems6: ‹s ∉
 proof (case ‹

  ND_F_dir2: ‹
 by (meson is_processT8 le_approx2)

  ND_F_dir2': ‹s ∉ D P ==> s ∈ j 🚫
 by (meson D_T le_approx2T)


  chain_lemma: ‹chain S ==> S i ⊑ S k ∨ S k ⊑ S i›
 by (metis chain_mono_less not_le_imp_less po_class.chain_mono)


  fixes S :: ‹nat ==> ('a, 'r) process_ptick›
 assumes ‹chain S›
 

  lim_proc :: ‹('a, 'r) process_ptick›
 is ‹
  (unfold is_process_def FAILURES_def DIVERGENCES_def fst_conv snd_conv, intro conjI allI impI)
 show ‹([], {}) ∈ ∩ (F ` range S)› by (simp add: is_processT)
 
 show ‹((metis "1.prems"(2)) add_f1fini le_add1)
 by (meson INT_iff UNIV_I image_eqI is_processT2)
 
 show ‹(s @ t, {}) ∈ ∩ (F ` range S) ==>
 (s, {}) ∈ ∩ (F ` range S)› for s t by (auto intro: is_processT3)
 
 show ‹(s, Y) ∈ ∩ (F ` range S) ∧ X ⊆ Y ==> (s, X) ∈ ∩ (F ` range S)› for s X Y
 by (metis (full_types) INT_iff is_processT4)
 
 show ‹(s, X ∪ Y) ∈ ∩ (F ` range S)›open>S' ≡
 if assm : ‹(s, X) ∈ ∩ (F ` range S) ∧
 (∀c. c ∈ Y ⟶ (s @ [c], {}) ∉ ∩ (F ` range S))› for s X Y
 proof (rule ccontr)
 assume <>(
 then obtain i where ‹(s, X ∪ Y) ∉ F (S i)› by blast
 moreover have ‹(s, X) ∈ F (S j)› for j using assm by blast
 ultimately obtain c where ‹c ∈ Y› and * : ‹(s @ [c], {}) ∈ F (S i)›
 using is_processT5 by blast
 from ‹(s, X ∪ Y) ∉ F (S i)› is_processT8 have ‹s ∉ D (S i)› by blast
  \<>c

 from chain_lemma[OF ‹chain S›, of i j] "*" "**" show False
 by (elim disjE; use ‹s ∉ D (S i)› is_processT8 min_elems6 proc_ord2a in blast)
 qed
 
 show ‹(s @ [🍋(r)], {}) ∈ ∩ (F ` range S) ==>
 (s, X - {🍋(r)}) ∈ ∩ (F ` range S)› for s r X by (simp add: is_processT6)
 
 show ‹s ∈ ∩ (Dby simp add: INF_greatest INF_lowe INF_mo' S'_de equal)
 s @ t ∈ ∩ (Dfinallysho \<>(
 
 show ‹s ∈ ∩
 by (simp add: is_processT8)
 
java.lang.NullPointerException
 by (auto intro: is_processT9)
 


  F_LUB: 🚫
  .rep_q proces prod.sel(1)

  D_LUB: ‹
 by (metis Divergences.rep_eq lim_proc.rep_eq process_surj_pair prod.inject)

  T_LUB: ‹T lim_proc = ∩ (T ` range S)›
 by (insert F_LUB, auto simp add: T_def_spec) (meson F_T T_F)

  LUB_projs = F_LUB D_LUB T_LUB

  Refusals_LUB: ‹
 by (auto simp add: Refusals_def_bis F_LUB)

  Refusals_after_LUB: ‹R_a lim_proc s = (∩i. (R_a (S i) s))›
 by (auto simp add: Refusals_after_def F_LUB)

  F_LUB_2: ‹(s, X) ∈ F lim_proc ⟷ (∀i. (s, X) ∈ F (S i))›
 and D_LUB_2: ‹t ∈ D lim_proc ⟷ (∀i. t ∈ D (S i))›
 and T_LUB_2: ‹t ∈ T lim_proc ⟷ (∀i. t ∈ T (S i))›
 and Refusals_LUB_2: ‹X ∈ R lim_proc ⟷ (∀i. X ∈ R (S i))›
 and Refusals_after_LUB_2: ‹X ∈ R_a lim_proc s ⟷ (∀i. X ∈ R_a (S i) s)›
 by (simp_all add: F_LUB D_LUB T_LUB Refusals_LUB Refusals_after_LUB)

 


  ‹By exiting the context, terms like ‹F lim_proc› will become term‹F (lim_proc S)›
 and the assumption term‹chain S› will be added.›


 ‹ Process Refinement is a Partial Ordering›

 ‹ The following type instantiation declares the refinement order
 \_ \le \_ $ written \verb+_ <= _+. It captures the intuition that more
  processes should be more deterministic and more defined.›

  process_ptick :: (type, type) ord
 

  less_eq_process_ptick :: ‹('a, 'r) process_ptick ==> ('a, 'r) process_ptick ==> bool›
 where ‹less_eq_process_ptick P Q ≡ D Q ⊆ D P ∧ F Q ⊆ F P›

  less_process_ptick :: ‹('a, 'r) process_ptick ==> ('a, 'r) process_ptick ==> bool›
 where ‹less_process_ptick P Q ≡ P ≤ Q ∧ P ≠ Q›

  ..

 



 ‹Note that this just another syntax to our standard process refinement order
 defined in the theory Process. ›


  le_ref1 : ‹P ≤ Q ==> D Q ⊆ D P›
 and le_ref2 : ‹P ≤ Q ==> F Q ⊆ F P›
 and le_ref2T : ‹P ≤ Q ==> T Q ⊆ T P›
 and le_approx_imp_le_ref: ‹(P::('a, 'r) process_ptick) ⊑ Q ==> P ≤ Q›
 by (simp_all add: less_eq_process_{ptick_def} le_approx1 le_approx_lemma_F)
 (use T_F_spec in blast)

  F_subset_imp_T_subset : ‹F P ⊆ F Q ==> T P ⊆ T Q›
 using T_F_spec by blast

  D_extended_is_D :
 ‹{t @ u |t u. t ∈ D P ∧ tF t ∧ ftF u} = D P›
 by (auto simp add: is_processT7)
 (metis D_imp_front_tickFree append.right_neutral butlast_snoc front_tickFree_append_iff
 front_tickFree_charn is_processT9 nonTickFree_n_frontTickFree tickFree_Nil)


  Process_eq_optimizedI :
 ‹[∧t. t ∈ D P ==> t ∈ D Q; ∧t. t ∈ D Q ==> t ∈ D P;
 ∧t X. (t, X) ∈ F P ==> t ∉ D P ==> t ∉ D Q ==> (t, X) ∈ F Q;
 ∧t X. (t, X) ∈ F Q ==> t ∉ D Q ==> t ∉ D P ==> (t, X) ∈ F P] ==> P = Q›
 by (simp add: Process_eq_spec_optimized, safe, auto intro: is_processT8)



  process_ptick :: (type, type) order
 by intro_classes (auto simp: less_eq_process_{ptick_def} less_process_{ptick_def} Process_eq_spec)


  lim_proc_is_ub: ‹chain S ==> range S <| lim_proc S›
 by (simp add: is_ub_def le_approx_def F_LUB D_LUB T_LUB Refusals_after_def)
 (intro allI conjI, blast, use chain_lemma is_processT8 le_approx2 in blast,
 use D_T chain_lemma le_approx2T le_approx_def in blast)


 
  lim_proc_is_lub3a: ‹front_tickFree s ==> s ∉ D P ==> t ∈ D P ==> ¬ t < s @ [c]›
 by (auto simp: le_list_def less_list_def)
 (metis butlast_append butlast_snoc front_tickFree_append_iff process_charn self_append_conv)
 *)


lemma chain_min_elem_div_is_min_for_sequel:
  ‹chain S ==> s ∈ min_elems (D (S i)) ==> i ≤ j ==> s ∈ D (S j) ==> s ∈ min_elems (D (S j))›
  by (metis elem_min_elems insert_absorb insert_subset le_approx1 
      min_elems5 min_elems_no po_class.chain_mono)


lemma limproc_is_lub: ‹range S <<| lim_proc S› if ‹chain S›
proof (unfold is_lub_def, intro conjI allI impI)
  show ‹range S <| lim_proc S› by (simp add: lim_proc_is_ub ‹chain S›)
next
  show ‹lim_proc S ⊑ P› if ‹range S <| P› for P
  proof (unfold le_approx_def, intro conjI allI impI subsetI)
    show ‹s ∈ D P ==> s ∈ D (lim_proc S)› for s
      by (meson D_LUB_2 ‹chain S› ‹range S <| P› is_ub_def le_approx1 rangeI subsetD)
  next
    show ‹s ∉ D (lim_proc S) ==> R_a (lim_proc S) s = R_a P s› for s
      by (metis ‹chain S› ‹range S <| P› D_LUB_2 le_approx_def lim_proc_is_ub ub_rangeD)
  next
    fix s
    assume ‹s ∈ min_elems (D (lim_proc S))›
    from elem_min_elems[OF this] have ‹∀i. s ∈ D (S i)›
      by (simp add: ‹chain S› D_LUB)
    have ‹∃i. ∀j≥i. s ∈ min_elems (D (S j))›
    proof (rule ccontr)
      assume ‹∄i. ∀j≥i. s ∈ min_elems (D (S j))›
      hence ‹∀i. ∃j≥i. s ∉ min_elems (D (S j))› by simp
      with ‹∀i. s ∈ D (S i)› chain_min_elem_div_is_min_for_sequel ‹chain S›
      have ‹∀j. s ∉ min_elems (D (S j))› by blast
      from ‹s ∈ min_elems (D (lim_proc S))› ‹∀i. s ∈ D (S i)› show False
        by (cases s rule: rev_cases; simp add: min_elems_def D_LUB ‹chain S›)
          (use Nil_min_elems ‹∀j. s ∉ min_elems (D (S j))› in blast,
            metis (no_types, lifting) INT_iff ‹∀j. s ∉ min_elems (D (S j))› less_self min_elems3)
    qed
    thus ‹s ∈ T P› by (meson le_approx3 order.refl subset_eq ‹range S <| P› ub_rangeD)
  qed
qed


lemma limproc_is_thelub: ‹chain S ==> (⊔i. S i) = lim_proc S›
  by (frule limproc_is_lub, frule po_class.lub_eqI, simp)


instance process_ptick :: (type, type) cpo
  by intro_classes (use limproc_is_lub in blast)



instance process_ptick :: (type, type) pcpo
proof
  define bot₀ :: ‹('a, 'r) process₀› where ‹bot₀ ≡ ({(s, X). ftF s}, {d. ftF d})›
  define bot :: ‹('a, 'r) process_ptick› where ‹bot ≡ process_of_process₀ bot₀›

  have ‹is_process bot₀›
    unfolding is_process_def bot₀_def
    by (simp add: FAILURES_def DIVERGENCES_def)
      (meson front_tickFree_append_iff front_tickFree_dw_closed)
  have F_bot : ‹F bot = {(s, X). ftF s}›
    by (metis CollectI FAILURES_def Failures.rep_eq ‹is_process bot₀›
        bot₀_def bot_def fst_eqD process_of_process₀_inverse)
  have D_bot : ‹D bot = {d. ftF d}›
    by (metis CollectI DIVERGENCES_def Divergences.rep_eq ‹is_process bot₀›
        bot₀_def bot_def process_of_process₀_inverse prod.sel(2))

  show ‹∃x :: ('a, 'r) process_ptick. ∀ y. x ⊑ y›
  proof (intro exI allI)
    show ‹bot ⊑ y› for y
    proof (unfold le_approx_def, intro conjI allI impI subsetI)
      show ‹s ∈ D y ==> s ∈ D bot› for s
        by (simp add: D_bot D_imp_front_tickFree)
    next
      from F_imp_front_tickFree show ‹s ∉ D bot ==> R_a bot s = R_a y s› for s
        by (auto simp add: D_bot Refusals_after_def F_bot)
    next
      show ‹s ∈ min_elems (D bot) ==> s ∈ T y› for s
        by (simp add: D_bot min_elems_Collect_ftF_is_Nil)
    qed
  qed
qed



section‹ Process Refinement is Admissible ›

lemma le_FD_adm : ‹cont (u :: ('b::cpo) ==> ('a, 'r) process_ptick) ==> monofun v ==> adm (λx. u x ≤ v x)›
  apply (unfold less_eq_process_{ptick_def} adm_def)
  apply (simp add: cont2contlubE D_LUB F_LUB ch2ch_cont limproc_is_thelub monofun_def)
  by (meson INF_greatest dual_order.trans is_ub_thelub le_approx1 le_approx_lemma_F)

lemmas le_FD_adm_cont[simp] = le_FD_adm[OF _ cont2mono]

section‹ The Conditional Statement is Continuous ›
text‹The conditional operator of CSP is obtained by a direct shallow embedding. Here we prove it continuous›

lemma if_then_else_cont[simp]:
  ‹[∧x. P x ==> cont (f x); ∧x. ¬ P x ==> cont (g x)] ==>
 cont (λy. if P x then f x y else g x y)›
  for f :: ‹'c ==> 'b :: cpo ==> ('a, 'r) process_ptick›
  by (auto simp: cont_def)


section ‹Tools for proving continuity›

― ‹The following result is very useful (especially for ProcOmata).›

lemma cont_process_rec: ‹P = (μ X. f X) ==> cont f ==> P = f P›
  by (simp add: def_cont_fix_eq)


lemma Inter_nonempty_finite_chained_sets: ‹(∩i. S i) ≠ {}›
  if ‹∧i. j ≤ i ==> S i ≠ {}› ‹finite (S j)› ‹∧i. S (Suc i) ⊆ S i› for S :: ‹nat ==> 'a set›
proof -
  have * : ‹∀i. S i ≠ {} ==> finite (S 0) ==> ∀i. S (Suc i) ⊆ S i ==> (∩i. S i) ≠ {}›
    for S :: ‹nat ==> 'a set›
  proof (induct ‹card (S 0)› arbitrary: S rule: nat_less_induct)
    case 1
    show ?case
    proof (cases ‹∀i. S i = S 0›)
      case True
      thus ?thesis by (metis "1.prems"(1) INT_iff ex_in_conv)
    next 
      case False
      have f1: ‹i ≤ j ==> S j ⊆ S i› for i j by (simp add: "1.prems"(3) lift_Suc_antimono_le)
      with False obtain j m where f2: ‹m < card (S 0)› and f3: ‹m = card (S j)›
        by (metis "1.prems"(2) psubsetI psubset_card_mono zero_le)
      define T where ‹T i ≡ S (i + j)› for i
      have f4: ‹m = card (T 0)› unfolding T_def by (simp add: f3)
      from f1 have f5: ‹(∩i. S i) = (∩i. T i)› unfolding T_def by (auto intro: le_add1)
      show ?thesis
        apply (subst f5)
        apply (rule "1.hyps"[rule_format, OF f2, of T, OF f4], unfold T_def)
        by (simp_all add: "1.prems"(1, 3) lift_Suc_antimono_le)
          (metis "1.prems"(2) add_0 f1 finite_subset le_add1)
    qed
  qed
  define S' where ‹S' i ≡ S (j + i)› for i
  have ‹∀i. S' i ≠ {}› by (simp add: S'_def ‹∧i. j ≤ i ==> S i ≠ {}›)
  moreover have ‹finite (S' 0)› by (simp add: ‹S' ≡ λi. S (j + i)› ‹finite (S j)›)
  moreover have ‹∀i. S' (Suc i) ⊆ S' i› by (simp add: S'_def ‹∧i. S (Suc i) ⊆ S i›)
  ultimately have ‹(∩i. S' i) ≠ {}› by (fact "*")
  also from lift_Suc_antimono_le[where f = S, OF ‹∧i. S (Suc i) ⊆ S i›]
  have ‹(∩i. S' i) = (∩i. S i)›
    by (simp add: INF_greatest INF_lower INF_mono' S'_def equalityI)
  finally show ‹(∩i. S i) ≠ {}› .
qed


method prove_finite_subset_of_prefixes for t :: ‹('a, 'r) trace_ptick› =
  ―‹Useful for establishing the second hypothesis›
  solves ‹(rule finite_UnI; prove_finite_subset_of_prefixes t) |
 (rule finite_subset[of _ ‹{u. u ≤ t}›],
 use prefixI in blast, simp add: prefixes_fin)›


(*<*)
end
  (*>*)