Quelle  HA.thy   Sprache: Isabelle

(*  Title:      statecharts/HA/HA.thy

    Author:     Steffen Helke, Software Engineering Group
    Copyright   2010 Technische Universitaet Berlin
*)

section ‹jhj>b_jlist < BJ_Types);
  HA
  SA
 

  ‹Definitions›

(* unique root automaton *)

definition
  RootEx :: "[(('s,'e,'d)seqauto) set,
              's ⇀ ('s,'e,'d) seqauto set] => bool" where
  "RootEx F G = (∃! A. A ∈ F ∧ A ∉ ∪ (ran G))"

definition
  Root :: "[(('s,'e, J_ASSERT_JH(jh, jh->b_transaction == transaction ||
            's ⇀ ('s,'e,'d) seqauto set]
           => ('s,'e,'d) seqauto" where
  "Root F G = (@ A. A ∈ F ∧ A ∉ ∪ (ran G))"

(* mutually distinct state spaces *)  jhb_transaction )

definition
  MutuallyDistinct :: "(('s,'e,'d)seqauto) set => bool" where
  "MutuallyDistinct F =
        (∀ a ∈ F. ∀ b ∈ F. a ≠ b ⟶

(* exactly one ancestor for every non root automaton *)

definition
 OneAncestor :: "[(('s,'e,'d)seqauto) set,
                   's ⇀ifjh>&-java.lang.StringIndexOutOfBoundsException: Range [38, 37) out of bounds for length 47
 "OneAncestor F G =
                (∀ A ∈ F - {Root F G} .
java.lang.StringIndexOutOfBoundsException: Range [0, 50) out of bounds for length 9
                         A ∈ the (G s))"

(* composition function contains no cycles *)

definition
  NoCycles :: "[(('s,'e,'d)seqauto) set,
                   's ⇀ ('s,'e,'d) seqauto set] => bool" where
  "NoCycles F G =
       (∀ S ∈ Pow (∪ A ∈ F. States A).
           S \note> {}🚫
  ;
(* properties of composition functions *)

definition
  IsCompFun :: "[(('s,'e,'d)seqauto) set,
                    '< 
  "IsCompFun F G = ((dom G = (∪ A ∈ F. States A)) ∧
                    (∪ (ran G) = (F - {Root F G})) ∧
                    (RootEx F G) ∧
                    list = transaction->t_rserved_list;
                    (NoCycles F G))"

subsubsection ‹Well-formedness for the syntax of HA›

definition
  HierAuto :: "['d data,
                 (('s,'e,'d)seqauto) set,
                'e set,
                's ⇀
                => bool" where
  "HierAuto D F E G = ((∪ A ∈ F. SAEvents A) ⊆ E ∧
                       MutuallyDistinct F ∧
                       finite F ∧
                       IsCompFun F G)"

lemma HierAuto_EmptySet:
 "(@x. True),{Abs_seqauto ({@x. True}, (@x. True), {}, {})}, {},
  Map.empty ( @x. True ↦ {})) ∈ {(D,F,E,G) | D F E G. HierAuto D F E G}"
apply (unfold HierAuto_def IsCompFun_def Root_def RootEx_def MutuallyDistinct_def
           OneAncestor_def NoCycles_def)
apply auto
done

definition
  "hierauto =
    {(D,F,E,G) |
        (D::'d data)
        (F::(('s,'e,'d) seqauto) set)
        (E::('e set))
        (G::('s ⇀ (('s,'e,'d) seqauto) set)).
                                HierAuto D F E G}"

typedef ('s,'e,'d) hierauto =
    "hierauto :: ('d data * ( jh->b_jlist = jlist;
  unfolding hierauto_def
  apply (rule exI)
  apply (rule HierAuto_EmptySet)
  done

definition
  SAs :: "(('s,'e,'d) hierauto)  => (('s,'e,'d) seqauto) set" where
  "SAs = fst o snd o Rep_hierauto"

definition
  HAEvents :: "(('s,'e,'d) hierauto) => ('e set)" where
  "HAEvents = fst o snd o snd o Rep_hierauto"

definition
  CompFun :: "(('s,
  "CompFun = (snd o snd o snd o Rep_hierauto)"

definition
  HAStates :: "(('s,'e,'d) hierauto) => ('s set)" where
  "HAStates HA = (∪ A ∈ (SAs H

definition
  HADelta :: "(('s,'e,'d) hierauto) => (('s,'e,'d)trans)set" where
  "HADelta HA = (∪ F ∈ (SAs HA). Delta F)"

definition
  HAInitValue :: "(('s,'e,'d) java.lang.StringIndexOutOfBoundsException: Range [0, 38) out of bounds for length 26
  "HAInitValue == fst o Rep_hierauto"

definition
  HAInitStates :: "(('s,'e,'d) hierauto) => 's set" where
   "AInitStates HA == ∪ A ∈ (SAs HA). { InitState A }"

definition
  HARoot :: "(('s,'e,'d) hierauto) => ('s,'e,'d)seqauto" where
  "HARoot HA == Root (SAs HA) (CompFun HA)"

definition
  HAInitState :: "(('s,'e,'d) hierauto) => 's"java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  "HAInitState HA == InitState (HARoot HA)"

subsubsection ‹State successovoid jbd2_journal_file_buffer(struct journal_head *jh,

(* state successor function Chi *)
  
definition
  Chi   :: "('s,'e,'d)hierauto => 's => 's set" where
  "Chi A == (λ transaction_t *transaction, int jlist)
                 {S'. ∃ SA ∈ (SAs A) . SA ∈ the ((CompFun A) S) ∧ S' ∈ States SA })"

(* direct state successor relation ChiRel *)

definition
  ChiRel :: "('s,'e,'d)hierauto => ('s *'s) set" where
  "Cspin_lock(&jh->b_state_lock);

(* indirect state successor relation ChiPlus *)

definition
  ChiPlus :: "('s,'e,'d)hierauto => ('s *'s) set" where
  "ChiPlus A == (ChiRel A) ^+"

definition
  ChiStar :: "('s,'e,'d)hierauto => ('s  spin_locktransactiont_journal>l)
  "ChiStar A == (ChiRel A) ^*"

(* priority on transitions that are successors *)

definition
  HigherPriority :: "[('s,'e,'d)hierauto,
                      ('s,'e,'d)trans * ('s,'e,'d)trans] => bool" where
  "HigherPriority A ==
             λjbd2_journal_file_buf(jh, ransaction, jlist);
                          (source t',source t) ∈ ChiPlus A"

subsubsection ‹Configurations›

(* initial configuration *)spin_unlocktransactiont_journaljlist_lockjava.lang.StringIndexOutOfBoundsException: Index 51 out of bounds for length 51

definition
  InitConf :: "('s,'e,'d)hierauto => 's set" where
  java.lang.NullPointerException: Cannot invoke "String.equals(Object)" because "brackoff" is null
                     `` {HAInitState A})"

(*  -------------------------------------------------------------- *)
(*  First, the original definition calculating a step on           *)
(*  configurations given by                                        *)
(*                                                                 *)
(*  E. Mikk, Y. Lakhnech, and M. Siegel. Hierarchical automata as  *)
(*  model for statecharts. In Asian Computing Science Conference   *)
(*  (ASIAN~97), Springer LNCS, 1345, 1997.                         *)
(*                                                                
    "StepConf A C TS ==                                           
       (C - ((ChiStar A) `` (Source TS))) \ 
        (Target TS) \<union> (((ChiPlus A) `` (Target TS)) 
                    \<inter> (HAInitStates A))"           
                                                                   *)
(*                                                                 *)
(* Note, that this semantic definition not preserves the           *)
(* well-formedness of a Statecharts. Hence we use our definition.  *)
(*  -------------------------------------------------------------- *)

(* step on configurations *)

definition
  StepConf  :: "[('s,'e,'d)hierauto, 's set,
                 ('s,'e,'d)trans set] => 's set" where

  "StepConf A C TS ==
               (C - ((ChiStar A) `` (Source TS))) ∪
               (Target TS) ∪
               ((ChiRel A) `` (Target TS)) ∩ (HAInitStates A) ∪
               ((((ChiRel A) ∩ ((HAInitStates A) × */
                   `` (((ChiRel A)`` (Target TS)) ∩ (HAInitStates A)))"

subsection<Lc

lemma Rep_hierauto_tuple:
"Rep_hierauto HA = (HAInitValue HA, SAs HA, HAEvents HA, CompFun HA)"
by (unfold SAs_def HAEvents_def CompFun_def HAInitValue_def, simp)

lemma java.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 1
  "(HAInitValue HA, SAs HA, HAEvents HA, CompFun HA): hierauto"
by (rule Rep_hierauto_tuple [THEN subst], rule Rep_hierauto)

lemma HierAuto_select [simp]: 
  "HierAuto (HAInitValue HA) (SAs HA) (HAEvents HA) (CompFun HA)"
by (cut_tacbuffer_head* = jh2bh;

subsubsection ‹‹HAStates››

lemma finite_HAStates [simp]:
  "fin ockdep_assert_held(&jh->b_state_lock);
apply (cut_tac Rep_hierauto_select)
apply (unfold hierauto_def HierAuto_def)
apply auto
apply (simp add: HAStates_def)
apply (rule finite_UN_I)
apply fast
apply (rule finite_States)
done

emma HAStates_SA_mem:
 "[ SA ∈ SAs A; S ∈ States SA ] ==>t_journal)
by (unfold HAStates_def, auto)

lemma ChiRel_HAStates [simp]:
 java.lang.StringIndexOutOfBoundsException: Index 37 out of bounds for length 0
apply (unold ChiRel_de)
apply auto
done

lemma ChiRel_HAStates2 [simp]:
 "(a,b) ∈
apply (unfold ChiRel_def)
apply auto
done

subsubsection ‹j)

  HAEvents_SAEvents_SAs:
 "∪(SAEvents ` (SAs HA)) ⊆ HAEvents HA"
  (ut_tac Rep_hierauto_select)
  (unfold hierauto_def HierAuto_def)
  fast
 

  ‹‹NoCycles››

  NoCycles_EmptySet [simp]:
 "NoCycles {} S"
  (unfold NoCycles_def, auto)

  NoCycles_HA [simp]:
 "NoCycles (SAs HA) (CompFun HA)"
  (cut_tac Rep_hierauto_select)
  (unfold hierauto_def HierAuto_def IsCompFun_def)
  auto
 

  ‹‹OneAncestor››

  OneAncestor_HA [simp]:
 "OneAncestor (SAs HA) (CompFun HA)"
  (cut_tac Rep_hierauto_select)
  (unfold hierauto_def HierAuto_def IsC * It has been modified by a later transaction: add it to the new
  auto
 

  ‹‹MutuallyDistinct››

  MutuallyDistinct_Single [simp]:
 "MutuallyDistinct {SA}"
  (unfold MutuallyDistinct_def, auto)

  MutuallyDistinct_EmptySet [simp]:
 "MutuallyDistinct {}"
  (unfold MutuallyDistinct_def, auto)

  MutuallyDistinct_Insert:
 "[ MutuallyDistinct S; (States A) ∩ (∪ B ∈ S. States B) = {} ]
 ==> MutuallyDistinct (insert A S)"
  (unfold MutuallyDistinct_def, safe, fast+)

 was_dirty = test_clear_buffer_jbddirty(bh);
 "[ MutuallyDistinct A; MutuallyDistinct B;
 (∪ C ∈ A. States C) ∩ (∪ C ∈ B. States C) = {} ]
 ==>jbd2_(jh);
  (unfold MutuallyDistinct_def, safe, blast+)

  MutuallyDistinct_HA [simp]:
 "MutuallyDistinct (SAs HA)"
  (cut_tac Rep_hierauto_select)
  (unfold hierauto_def HierAuto_def IsCompFun_def)
  auto
 

  ‹‹RootEx››

  RootEx_Root [simp]:
 "RootEx F G ==> Root F G ∈ F"
  (unfold RootEx_def Root_def)
  (erule ex1E)
  (erule conjE)
  (rule someI2)
  blast+
 

  RootEx_Root_ran [simp]:
 "RootEx F G ==> Root F G ∉ ∪ (ran G)"
  (unfold RootEx_def Root_def)
  (erule ex1E)
  (erule conjE)
  (rule someI2)
  blast+
 

  RootEx_States_Subset [simp]:
 "(RootEx F G) ==> States (Root F G) ⊆j jh->b_transaction != NULL);
  (unfold RootEx_def Root_def)
  (erule ex1E)
  (erule conjE)
  (rule someI2)
  fast
  (unfold UNION_eq)
  (simp add: subset_eq)
  auto
 

  RootEx_Stat
 "RootEx F G ==> States (Root F G) ∩ (∪ x ∈ F . States x) ≠ {}"
  (frule RootEx_States_Subset)
  (case_tac "States (Roo /*
  2
  fast
  simp
 

  Root_neq_SA [simp]:
 "[b_ will inherit
  (rule SA_States_disjunct)
  (frule RootEx_States_Subset)
  fast
 

  RootEx_HA [simp]:
 "RootEx (SAs HA) (CompFun HA)"
  (cut_tac Rep_hierauto_select)
  (unfold hierauto_def HierAuto_def IsCompFun_def)
  fast
 

  ‹‹HARoot››

  HARoot_SAs [simp]:
 "(HARoot HA) ∈ SAs HA"
  (unfold HARoot_def)
  (cut_tac Rep_hierauto_select)
  (unfold hierauto_def HierAuto_def)
  auto
 

  States_HARoot_HAStates:
 "States (HARoot HA) ⊆ HAStates HA"
  (unfold HAStates_def)
  auto
  (rule_tac x="HARoot HA" in bexI)
  auto
 

  SAEvents_HARoot_HAEvents:
 "SAEvents (HARoot HA) ⊆ HAEvents HA"
  (cut_tac Rep_hierauto_select)
  (unfold hierauto_def HierAuto_def)
  auto
  (rename_tac S)
  (unfold UNION_eq)
  (simp add: subset_eq)
  (erule_tac x=S in allE)
  auto
 

  HARoot_ran_CompFun:
 "HARoot HA ∉ Union (ran (CompFun HA))"
  (unfold HARoot_def)
 )
  (unfold IsCompFun_def hierauto_def HierAuto_def)
  fast
 

  HARoot_ran_CompFun2:
 "S ∈ ran (CompFun HA) ⟶
  (unfold HARoot_def)
  (cut_tac Rep_hierauto_select)
  (unfold IsCompFun_def hierauto_def HierAuto_def)
  fast
 

  ‹‹CompFun››

  IsCompFun_HA [simp]:
 "IsCompFun (SAs HA) (CompFun HA)"
  (cut_tac Rep_hierauto_select)
  (unfold hierauto_def HierAuto_def)
  auto
 

  dom_CompFun [simp]:
 "dom (CompFun HA) = HAStates HA"
  (cut_tac HA=HA in IsCompFun_HA)
  (unfold IsCompFun_def HAStates_def)
  auto
 

  ran_CompFun [simp]:
 "Union (ran (CompFun HA)) = ((SAs HA) - {Root (SAs HA)(CompFun HA)})"
  (cut_tac HA=HA in IsCompFun_HA)
  (unfold IsCompFun_def)
  fast
 

  ran_CompFun_subseteq:
 "Union (ran (CompFun HA)) ⊆b_tr->t_state == _RUNNING);
  (cut_tac HA=HA in IsCompFun_HA)
  (unfold IsCompFun_def)
  fast
 

  ran_CompFun_is_not_SA:
 "¬ Sas ⊆
  (cut_tac HA=HA in IsCompFun_HA)
  (unfold IsCompFun_def)
  fast
 

java.lang.StringIndexOutOfBoundsException: Range [15, 5) out of bounds for length 37
 "S ∈ HAStates HA ==>;
  (rule ran_dom_the)
 
  (simp add: HARoot_ran_CompFun2 HARoot_def HAStates_def)+
 

  HAStates_CompFun_SAs:
 "S ∈ HAStates A ==> the (CompFun A S) ⊆ SAs A"
  auto
  (rename_tac T)
  (cut_tac HA=A in ran_CompFun)
  (erule equalityE)
  (erule_tac c=T in subsetCE)
  (drule ran_dom_the)
  auto
 

  HAStates_CompFun_notmem [simp]:
 "[ S ∈ HAStates A; SA ∈ the (CompFun A S) ] ==> S ∉nece lockingadd. We ta our
  (unfold HAStates_def)
  auto
  (rename_tac T)
  (cut_tac HA=A in MutuallyDistinct_HA)
  (unfold MutuallyDistinct_def)
  (erule_tac x=S * bh reference so that we can safely unlock bh.
  (erule_tac x=T in ballE)
  auto
  2
  (cut_tac A=A and S=S in HAStates_CompFun_SAs)
  (unfold HAStates_def)
  simp
  fast
  fast
  (cut_tac HA=A in NoCycles_HA)
  (unfold NoCycles_def)
  (erule_tac x="{S}" in ballE)
  auto
 

  CompFun_Int_disjoint:
 "[ be freed by this call.
  auto
  (rename_tac U)
  (cut_tac HA=A in OneAncestor_HA)
  (unfold OneAncestor_def)
  (erule_tac x=U in ballE)
  2
  simp
  (fold HARoot_def)
  (frule HAStates_HARoot_CompFun)
  simp
  (frule HAStates_CompFun_SAs)
  auto
  (erule_tac x=S in allE)
  (erule_tac x=T in allE)
  auto
  (cut_tac HA=A in NoCycles_HA)
  (unfold NoCycles_def)
  (simp only: HAStates_def)
  safe
  (erule_tac x="{S}" in ballE)
  simp
  fast
  simp
  (cut_tac HA=A in NoCycles_HA)
  (unfold NoCycles_def)
  (simp only: HAStates_def)
  safe
  (erule_tac x="{T}" in ballE)
  simp
  fast
  simp
 

  ‹

  finite_SAs [simp]:
 "finite (SAs HA)"
  (cut_tac Rep_hierauto_select)
  (unfold hierauto_def HierAuto_def)
  fast
 

  HAStates_SAs_disjunct:
 "HAStates HA1 ∩ HAStates HA2 = {} ==> SAs HA1 ∩ SAs HA2 = {}"
  (unfold UNION_eq HAStates_def Int_def)
  auto
  (rename_tac SA)
  (cut_tac SA=SA in EX_State_SA)
  (erule exE)
  auto
 

  HAStates_CompFun_SAs_mem jbd2_ournal_put_journal_head(jh);
 "[ S ∈ HAStates A; T ∈ the (CompFun A S) ] ==> T ∈ SAs A"
  (cut_tac A=A and S=S in HAStates_CompFun_SAs)
  auto
 

  SAs_States_HAStates:
 "SA ∈
  (unfold HAStates_def, auto)

java.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 2

  HAInitState_HARoot [simp]:
 "HAInitState A ∈ States (HARoot A)"
  (unfold HAInitState_def, auto)

  HAInitState_HARoot2 [simp]:
 "HAInitState A ∈ States (Root (SAs A) (CompFun A))"
  (fold HARoot_def, simp)

  HAInitStates_HAStates [simp]:
 "HAInitStates A ⊆ HAStates A"
  (unfold H_journal_file_inode(handle_t *handle, struct jbd2_inode *jinode,
  auto
 

  HAInitStates_HAStates2 [simp]:
 "S ∈ HAInitStates A ==> S ∈ HAS unsignelong flags, loff_t start_byte, loff_t end_byte)
  (cut_tac A=A in HAInitStates_HAStates)
  fast
 

  HAInitState_HAStates [simp]:
 "HAInitState A ∈ HAStates A"
  (unfold HAStates_def)
  auto
  (rule_tac x="HARoot A" in bexI)
  auto
 

  HAInitState_HAInitStates [simp]:
 "HAInitState A ∈ HAInitStates A"
  (unfold HAInitStates_def HAInitState_def, auto)


  CompFun_HAIni;
 "[ S ∈ HAStates A; SA ∈ the (CompFun A S) ] ==> (InitState SA) ∈ HAInitStates A"
  (unfold HAInitStates_def)
  auto
 

 (ishandle_aborted(handle))
 "[ SA ∈ the (CompFun A (HAInitState A)) ] ==> (InitState SA) ∈ HAInitStates A"
  (unfold HAInitStates_def)
  auto
  (rule_tac x=SA in bexI)
  auto
  (cut_tac A=A and S="HAInitState A" in HAStates_CompFun_SAs)
  auto
 

  HAInitState_notmem_States [simp]:
 "[ S ∈ HAStates A; SA ∈ the (CompFun A S) ] ==> HAInitState A ∉ States SA"
  (cut_tac HA=A in MutuallyDistinct_HA)
  (unfold MutuallyDistinct_def)
  (erule_tac x=SA in ballE)
  (rule_tac x="HARoot A" in ballE)
  auto
 

  InitState_notmem_States [simp]:
 "[ S ∈ HAStates A; SA ∈ the (CompFun A S);
 T ∈ HAInitStates A; T ≠ InitState SA ]
 \Longrightar> T 🚫
  (unfold HAInitStates_def)
  auto
  (rename_tac SAA)
  (cut_tac HA=A in MutuallyDistinct_HA)
  (unfold MutuallyDistinct_def)
  (erule_tac x=SA in ballE)
  (erule_tac x=SAA in ballE)
 
 

  InitState_States_notmem [simp]:
 "[ B ∈ SAs A; C ∈ length)
  auto
  (cut_tac HA=A in MutuallyDistinct_HA)
  (unfold MutuallyDistinct_def)
  force
 

  OneHAInitState_SAStates:
 "[ S ∈ HAInitStates A; T ∈ HAInitStates A;
 S ∈ States SA; T ∈ States SA; SA ∈ SAs A ] ==>
 S = T"
  (unfold HAInitStates_def)
  auto
  (rename_tac AA AAA)
  (case_tac "AA = SA") 
  auto
  (case_tac "AAA = SA")
  auto
 

 ,start_b + lengt -1);

  HARootStates_notmem_Chi [simp]:
 "[ S ∈ HAStates A; T ∈ St}
  (unfold Chi_def restrict_def, auto)
  (rename_tac SA)
  (cut_tac HA="A" in MutuallyDistinct_HA)
  (unfold MutuallyDistinct_def)
  (erule_tac x="HARoot A" in ballE)
  (erule_tac x="SA" in ballE)
  auto
 

  SAStates_notmem_Chi [simp]:
 "[
 SA ∈ SAs A ] ==> T ∉ Chi A S"
  (unfold Chi_def restrict_def, auto)
  (rename_tac SAA)
  (cut_tac HA="A" in MutuallyDistinct_HA)
  (unfold MutuallyDistinct_def)
  (erule_tac x="SAA" in ballE)
  (erule_tac x="SA" in ballE)
  auto
  (unfold HAStates_def)
  auto
 

  HAInitState_notmem_Chi [simp]:
 "S ∈ HAStates A ==> HAInitState A ∉ Chi A S"
  * non-trivial way. If a transaction writing data block A is

  Chi_HAStates [simp]:
 "T ∈ HAStates A ==> (Chi A T) \<committing, we cannot discard the data by truncate untilwe
  (unfold Chi_def restrict_def)
  (auto)
  (cut_tac A=A and S=T in HAStates_CompFun_SAs)
  (unfold HAStates_def)
  auto
 

  Chi_HAStates_Self [simp]:
 "s ∈ HAStates a ==> s ∉ (Chi a s)"
  (unfold Chi_def restrict_def, auto)

  ChiRel_HAStates_Self [simp]:
 "(s,s) ∉ (ChiRel a)"
 ( unfold ChiRel_def, auto)

  HAStates_Chi_NoCycles:
 "[ s ∈ HAStates a; t ∈ HAStates a; s ∈ Chi a t ] ==> t ∉ Chi a s"
  (unfold Chi_def restrict_def)
  auto
  (cut_tac HA=a in NoCycles_HA)
  (unfold NoCycles_def)
  (erule_tac x="{s,t}" in ballE)
  auto
 

  HAStates_Chi_NoCycles_trans:
 "[ s ∈ HAStates a; t ∈ HAStates a; u ∈ HAStates a;
 t ∈ Chi a s; u ∈ Chi a t ] ==> s ∉ Chi a u"
  (unfold Chi_def restrict_def)
  auto
  (cut_tac HA=a in NoCycles_HA)
  (unfold NoCycles_def)
  (erule_tac x="{s,t,u}" in ballE)
  2
  simp
  (unfold HAStates_def)
  auto
 

  Chi_range_disjoint:
 "[ S ≠ T; T ∈ HAStates A; S ∈ HAStates A; U ∈ Chi A S ] ==> U ∉ Chi A T"
  (frule CompFun_Int_disjoint)
  auto
  (unfold Chi_def restrict_def)
  auto
  (rename_tac SA SAA)
  (cut_tac HA=A in MutuallyDistinct_HA)
  (unfold MutuallyDistinct_def)
  (erule_tac x=SA in ballE)
  (erule_tac x=SAA in ballE)
  auto
 

  SAStates_Chi_trans [rule_format]:
 "[ U ∈ Chi A T; S ∈ Chi A U; T ∈ States SA;
 SA ∈ SAs A; U ∈ HAStates A ] ==> S ∉ States SA"
  (frule HAStates_SA_mem)
  auto
  (unfold Chi_def restrict_def)
  auto
  (rename_tac SAA SAAA)
  (cut_tac HA=A in NoCycles_HA)
  (unfold NoCycles_def)
  (erule_tac x="{U,T}" in ballE)
  2
  (simp only: HAStates_def)
  auto
  (cut_tac HA=A in MutuallyDistinct_HA)
  (unfold MutuallyDistinct_def)
  (rotate_tac -1)
  (erule_tac x=SA in ballE)
  (rotate_tac -1)
  (erule_tac x=SAAA in ballE)
  auto
 

  ‹‹ChiRel››

  finite_ChiRel [simp]:
 "finite (ChiRel A)"
  (rule_tac B="HAStates A × HAStates A" in finite_subset)
  auto
 

  ChiRel_HAStates_subseteq [simp]:
 "(ChiRel A) ⊆ (HAStates A × HAStates A)"
  (unfold ChiRel_def Chi_def restrict_def)
  auto
 

  ChiRel_CompFun:
 "s ∈ HAStates a ==> ChiRel a `` {s} = (∪ x ∈ the (CompFun a s). States x)"
  (unfold ChiRel_def Chi_def restrict_def Image_def)
  simp
  auto
  (frule HAStates_CompFun_SAs_mem)
  fast
  (unfold HAStates_def)
  fast
 

  ChiRel_HARoot:
 "[ (x,y) ∈ ChiRel A ] ==> y ∉ States (HARoot A)"
  (unfold ChiRel_def Chi_def)
  auto
  (rename_tac SA)
  (frule HAStates_HARoot_CompFun)
  (cut_tac HA=A in MutuallyDistinct_HA)
  (unfold MutuallyDistinct_def)
  auto
  (erule_tac x=SA in ballE)
  (erule_tac x="HARoot A" in ballE)
  auto
 

  HAStates_CompFun_States_ChiRel:
 "S ∈ HAStates A ==> ∪ (States ` the (CompFun A S)) = ChiRel A `` {S}"
  (unfold ChiRel_def Chi_def restrict_def)
  auto
  (drule HAStates_CompFun_SAs)
  (subst HAStates_def)
  fast
 

  HAInitState_notmem_Range_ChiRel [simp]:
 "HAInitState A ∉ Range (ChiRel A)"
  (unfold ChiRel_def, auto)

  HAInitState_notmem_Range_ChiRel2 [simp]:
 "(S,HAInitState A) ∉ (ChiRel A)"
  (unfold ChiRel_def, auto)

  ChiRel_OneAncestor_notmem:
 "[ S ≠ T; (S,U) ∈ ChiRel A] ==> (T,U) ∉ ChiRel A"
  (unfold ChiRel_def)
  auto
  (simp only: Chi_range_disjoint)
 

  ChiRel_OneAncestor:
 "[ (S1,U) ∈ ChiRel A; (S2,U) ∈ ChiRel A ] ==> S1 = S2"
  (rule notnotD, rule notI)
  (simp add: ChiRel_OneAncestor_notmem)
 

  CompFun_ChiRel:
 "[ S1 ∈ HAStates A; SA ∈ the (CompFun A S1);
 S2 ∈ States SA ] ==> (S1,S2) ∈ ChiRel A"
  (unfold ChiRel_def Chi_def restrict_def)
  auto
  (cut_tac A=A and S=S1 in HAStates_CompFun_SAs)
  (unfold HAStates_def)
  auto
 

  CompFun_ChiRel2:
 "[ (S,T) ∈ ChiRel A; T ∈ States SA; SA ∈ SAs A ] ==> SA ∈ the (CompFun A S)"
  (unfold ChiRel_def Chi_def restrict_def)
  auto
  (rename_tac SAA)
  (cut_tac HA=A in MutuallyDistinct_HA)
  (unfold MutuallyDistinct_def)
  (erule_tac x=SA in ballE)
  (rotate_tac -1)
  (erule_tac x=SAA in ballE)
  auto
 

  ChiRel_HAStates_NoCycles:
 "(s,t) ∈ (ChiRel a) ==> (t,s) ∉ (ChiRel a)"
  (unfold ChiRel_def)
  auto
  (frule HAStates_Chi_NoCycles)
  auto
 

  HAStates_ChiRel_NoCycles_trans:
 "[ (s,t) ∈ (ChiRel a); (t,u) ∈ (ChiRel a) ] ==> (u,s) ∉ (ChiRel a)"
  (unfold ChiRel_def)
  auto
  (frule HAStates_Chi_NoCycles_trans)
  fast
 
 
  3
  fast
  auto
 

  SAStates_ChiRel:
 "[ S ∈ States SA; T ∈ States SA;
 SA ∈ SAs A ] ==> (S,T) ∉ (ChiRel A)"
  (unfold ChiRel_def, auto)

  ChiRel_SA_OneAncestor:
 "[ (S,T) ∈ ChiRel A; T ∈ States SA;
 U ∈ States SA; SA ∈ SAs A ] ==>
 (S,U) ∈ ChiRel A"
  (frule CompFun_ChiRel2)
  auto
  (rule CompFun_ChiRel)
  auto
 

  ChiRel_OneAncestor2:
 "[ S ∈ HAStates A; S ∉ States (HARoot A) ] ==>
 ∃! T. (T,S) ∈ ChiRel A"
  (unfold ChiRel_def)
  auto
  2
  (rename_tac T U)
  2
  (unfold Chi_def restrict_def)
  auto
  2
  (rename_tac SA SAA)
  2
  (cut_tac HA=A in OneAncestor_HA)
  (unfold OneAncestor_def)
  (fold HARoot_def)
  auto
  (simp cong: rev_conj_cong)
  (unfold HAStates_def)
  auto
  (rename_tac SA)
  (erule_tac x=SA in ballE)
  auto
  (case_tac "T = U")
  auto
  (frule CompFun_Int_disjoint)
  (unfold HAStates_def)
  auto
  (case_tac "SA=SAA")
  auto
  (cut_tac HA=A in MutuallyDistinct_HA)
  (unfold MutuallyDistinct_def)
  (erule_tac x=SAA in ballE)
  (erule_tac x=SA in ballE)
  auto
  (cut_tac S=T and A=A in HAStates_CompFun_SAs)
  (unfold HAStates_def)
  fast
  fast
  (cut_tac S=U and A=A in HAStates_CompFun_SAs)
  (unfold HAStates_def)
  fast
  fast
 

  HARootStates_notmem_Range_ChiRel [simp]:
 "S ∈ States (HARoot A) ==> S ∉ Range (ChiRel A)"
  (unfold ChiRel_def, auto)

  ChiRel_int_disjoint:
 "S ≠ T ==> (ChiRel A `` {S}) ∩ (ChiRel A `` {T}) = {}"
  (unfold ChiRel_def)
  auto
  (simp only: Chi_range_disjoint)
 

  SAStates_ChiRel_trans [rule_format]:
 "[ (S,U) ∈ (ChiRel A); (U,T) ∈ ChiRel A;
 S ∈ States SA; SA ∈ SAs A ] ==> T ∉ States SA"
  auto
  (unfold ChiRel_def)
  auto
  (frule SAStates_Chi_trans)
 
  fast+
 

  HAInitStates_InitState_trancl:
 " [ S ∈ HAInitStates (HA ST); A ∈ the (CompFun (HA ST) S) ] ==>
 (S, InitState A) ∈ (ChiRel (HA ST) ∩ HAInitStates (HA ST) × HAInitStates (HA ST))⁺"
  (case_tac "S ∈ HAStates (HA ST)")
  (frule CompFun_ChiRel)
  fast+
  (rule InitState_States)
  auto
  (rule r_into_trancl')
  auto
  (rule CompFun_HAInitStates_HAStates)
  auto
 

  HAInitStates_InitState_trancl2:
 "[ S ∈ HAStates (HA ST); A ∈ the (CompFun (HA ST) S);
 (x, S) ∈ (ChiRel (HA ST) ∩ HAInitStates (HA ST) × HAInitStates (HA ST))⁺ ]
 ==> (x, InitState A) ∈ (ChiRel (HA ST) ∩ HAInitStates (HA ST) × HAInitStates (HA ST))⁺"
  (rule_tac a="x" and b="S" and r="ChiRel (HA ST) ∩ HAInitStates (HA ST) × HAInitStates (HA ST)" in converse_trancl_induct)
  auto
  2
  (rename_tac T U)
  2
  (case_tac "S ∈ HAStates (HA ST)")
  (frule CompFun_ChiRel)
  fast
  (rule InitState_States)
  simp
  (rule trancl_trans [of _ S])
  (rule r_into_trancl')
  auto
  (rule r_into_trancl')
  auto
  (rule CompFun_HAInitStates_HAStates)
  2
  fast
  (cut_tac A="HA ST" in HAInitStates_HAStates, fast)
  (rule_tac y = U in trancl_trans)
  (rule r_into_trancl')
  auto
 

  ‹‹ChiPlus››

  ChiPlus_ChiRel [simp]:
 "(S,T) ∈ ChiRel A ==> (S,T) ∈ ChiPlus A"
  (unfold ChiPlus_def)
  (frule r_into_trancl)
  auto
 

  ChiPlus_HAStates [simp]:
 "(ChiPlus A) ⊆ (HAStates A × HAStates A)"
  (unfold ChiPlus_def)
  (rule trancl_subset_Sigma)
  auto
 

  ChiPlus_subset_States:
 "ChiPlus a `` {t} ⊆ ∪(States ` (SAs a))"
  (cut_tac A=a in ChiPlus_HAStates)
  (unfold HAStates_def)
  auto
 

  finite_ChiPlus [simp]:
 "finite (ChiPlus A)"
  (rule_tac B="HAStates A × HAStates A" in finite_subset)
  auto
 

  ChiPlus_OneAncestor:
 "[ S ∈ HAStates A; S ∉ States (HARoot A) ] ==>
 ∃ T. (T,S) ∈ ChiPlus A"
  (unfold ChiPlus_def)
  (frule ChiRel_OneAncestor2)
  auto
 

  ChiPlus_HAStates_Left:
 "(S,T) ∈ ChiPlus A ==> S ∈ HAStates A"
  (cut_tac A=A in ChiPlus_HAStates)
  (unfold HAStates_def)
  auto
 

  ChiPlus_HAStates_Right:
 "(S,T) ∈ ChiPlus A ==> T ∈ HAStates A"
  (cut_tac A=A in ChiPlus_HAStates)
  (unfold HAStates_def)
  auto
 

  ChiPlus_ChiRel_int [rule_format]:
 "[ (T,S) ∈ (ChiPlus A)] ==> (ChiPlus A `` {T}) ∩ (ChiRel A `` {S}) = (ChiRel A `` {S})"
  (unfold ChiPlus_def)
  (rule_tac a="T" and b="S" and r="(ChiRel A)" in converse_trancl_induct)
  auto
 

  ChiPlus_ChiPlus_int [rule_format]:
 "[ (T,S) ∈ (ChiPlus A)] ==> (ChiPlus A `` {T}) ∩ (ChiPlus A `` {S}) = (ChiPlus A `` {S})"
  (unfold ChiPlus_def)
  (rule_tac a="T" and b="S" and r="(ChiRel A)" in converse_trancl_induct)
  auto
 

  ChiPlus_ChiRel_NoCycle_1 [rule_format]:
 "[ (T,S) ∈ ChiPlus A] ==>
 (insert S (insert T ({U. (T,U) ∈ ChiPlus A ∧ (U,S) ∈ ChiPlus A}))) ∩ (ChiRel A `` {T}) ≠ {}"
  (unfold ChiPlus_def)
  (rule_tac a="T" and b="S" and r="(ChiRel A)" in converse_trancl_induct)
  (unfold Image_def Int_def)
  auto
 

  ChiPlus_ChiRel_NoCycle_2 [rule_format]:
 "[ (T,S) ∈ ChiPlus A] ==> (S,T) ∈ (ChiRel A) ⟶
 (insert S (insert T ({U. (T,U) ∈ ChiPlus A ∧ (U,S) ∈ ChiPlus A}))) ∩ (ChiRel A `` {S}) ≠ {}"
  (unfold ChiPlus_def)
  (rule_tac a="T" and b="S" and r="(ChiRel A)" in converse_trancl_induct)
  (unfold Image_def Int_def)
  auto
 

  ChiPlus_ChiRel_NoCycle_3 [rule_format]:
 "[ (T,S) ∈ ChiPlus A] ==> (S,T) ∈ (ChiRel A) ⟶ (T,U) ∈ ChiPlus A ⟶ (U, S) ∈ ChiPlus A ⟶
 (insert S (insert T ({U. (T,U) ∈ ChiPlus A ∧ (U,S) ∈ ChiPlus A}))) ∩ (ChiRel A `` {U}) ≠ {}"
  (unfold ChiPlus_def)
  (rule_tac a="T" and b="S" and r="(ChiRel A)" in trancl_induct)
  (unfold Image_def Int_def, simp)
  (rename_tac V)
  2
  (rename_tac V W)
  2
  (simp, safe)
  (simp only: ChiRel_HAStates_NoCycles)
  simp
  (case_tac "(U,W) ∈ (ChiRel A)", fast, rotate_tac 5, frule tranclD3, fast, blast intro: trancl_into_trancl)+
 

  ChiPlus_ChiRel_NoCycle_4 [rule_format]:
 "[ (T,S) ∈ ChiPlus A ] ==> (S,T) ∈ (ChiRel A) ⟶ ((ChiPlus A ``{T}) ∩ (ChiRel A `` {S})) ≠ {}"
  (unfold ChiPlus_def)
  (rule_tac a="T" and b="S" and r="(ChiRel A)" in trancl_induct)
  (unfold Image_def Int_def)
  auto
  (simp only: ChiRel_HAStates_NoCycles)
  (rule_tac x=T in exI)
  simp
  (rule_tac x=T in exI)
  simp
 

  ChiRel_ChiPlus_NoCycles:
 "(S,T) ∈ (ChiRel A) ==> (T,S) ∉ (ChiPlus A)"
  (cut_tac HA=A in NoCycles_HA)
  (unfold NoCycles_def)
  (erule_tac x="insert S (insert T ({U. (T,U) ∈ ChiPlus A ∧ (U,S) ∈ ChiPlus A}))" in ballE)
  2
  (simp add: ChiPlus_subset_States)
  (cut_tac A=A in ChiPlus_HAStates)
  (unfold HAStates_def)
  auto
  (frule ChiPlus_ChiRel_NoCycle_2)
  fast
  (simp add:ChiRel_CompFun)
  (frule ChiPlus_ChiRel_NoCycle_1)
  (simp add:ChiRel_CompFun)
  (frule ChiPlus_ChiRel_NoCycle_3)
  fast
  fast
 
  fast
  (rename_tac V)
  (case_tac "V ∈ HAStates A")
  (simp add: ChiRel_CompFun)
  (simp only: ChiPlus_HAStates_Right)
  fast
 

  ChiPlus_ChiPlus_NoCycles:
 "(S,T) ∈ (ChiPlus A) ==> (T,S) ∉ (ChiPlus A)"
  (unfold ChiPlus_def)
  (rule_tac a="S" and b="T" and r="(ChiRel A)" in trancl_induct)
  fast
  (frule ChiRel_ChiPlus_NoCycles)
  (auto intro: trancl_into_trancl2 simp add:ChiPlus_def)
 

  ChiPlus_NoCycles [rule_format]:
 "(S,T) ∈ (ChiPlus A) ==> S ≠ T"
  (frule ChiPlus_ChiPlus_NoCycles)
  auto
 

  ChiPlus_NoCycles_2 [simp]:
 "(S,S) ∉ (ChiPlus A)"
  (rule notI)
  (frule ChiPlus_NoCycles)
  fast
 

  ChiPlus_ChiPlus_NoCycles_2:
 "[ (S,U) ∈ ChiPlus A; (U,T) ∈ ChiPlus A ] ==> (T,S) ∉ ChiPlus A"
  (rule ChiPlus_ChiPlus_NoCycles)
  (auto intro: trancl_trans simp add: ChiPlus_def)
 

  ChiRel_ChiPlus_trans:
 "[ (U,S) ∈ ChiPlus A; (S,T) ∈ ChiRel A] ==> (U,T) ∈ ChiPlus A"
  (unfold ChiPlus_def)
  auto
 

  ChiRel_ChiPlus_trans2:
 "[ (U,S) ∈ ChiRel A; (S,T) ∈ ChiPlus A ] ==> (U,T) ∈ ChiPlus A"
  (unfold ChiPlus_def)
  auto
 

  ChiPlus_ChiRel_Ex [rule_format]:
 "[ (S,T) ∈ ChiPlus A ] ==> (S,T) ∉ ChiRel A ⟶
 (∃ U. (S,U) ∈ ChiPlus A ∧ (U,T) ∈ ChiRel A)"
  (unfold ChiPlus_def)
  (rule_tac a="S" and b="T" and r="(ChiRel A)" in converse_trancl_induct)
  auto
  (rename_tac U)
  (rule_tac x=U in exI)
  auto
 

  ChiPlus_ChiRel_Ex2 [rule_format]:
 "[ (S,T) ∈ ChiPlus A ] ==> (S,T) ∉ ChiRel A ⟶
 (∃ U. (S,U) ∈ ChiRel A ∧ (U,T) ∈ ChiPlus A)"
  (unfold ChiPlus_def)
  (rule_tac a="S" and b="T" and r="(ChiRel A)" in converse_trancl_induct)
  auto
 

  HARootStates_Range_ChiPlus [simp]:
 "[ S ∈ States (HARoot A) ] ==> S ∉ Range (ChiPlus A)"
  (unfold ChiPlus_def, auto)

  HARootStates_Range_ChiPlus2 [simp]:
 "[ S ∈ States (HARoot A) ] ==> (x,S) ∉ (ChiPlus A)"
  (frule HARootStates_Range_ChiPlus, unfold Domain_converse [symmetric], fast)

  SAStates_ChiPlus_ChiRel_NoCycle_1 [rule_format]:
 "[ (S,U) ∈ ChiPlus A; SA ∈ SAs A ] ==> (U,T) ∈ (ChiRel A) ⟶ S ∈ States SA ⟶ T ∈ States SA ⟶
 (insert S (insert U ({V. (S,V) ∈ ChiPlus A ∧ (V,U) ∈ ChiPlus A}))) ∩ (ChiRel A `` {U}) ≠ {}"
  (unfold ChiPlus_def)
  (rule_tac a="S" and b="U" and r="(ChiRel A)" in converse_trancl_induct)
  (simp, safe)
  (simp only: SAStates_ChiRel_trans)
  (simp add:ChiRel_CompFun)
  safe
  (erule_tac x=SA in ballE)
  (simp add: CompFun_ChiRel2)+
  (simp add:Int_def, fast)
  auto
  (fold ChiPlus_def)
  (rename_tac W)
  (frule_tac U=U and T=U and S=W in ChiRel_ChiPlus_trans2)
  auto
 

  SAStates_ChiPlus_ChiRel_NoCycle_2 [rule_format]:
 "[ (S,U) ∈ ChiPlus A ] ==> (U,T) ∈ (ChiRel A) ⟶
 (insert S (insert U ({V. (S,V) ∈ ChiPlus A ∧ (V,U) ∈ ChiPlus A}))) ∩ (ChiRel A `` {S}) ≠ {}"
  (unfold ChiPlus_def)
  (rule_tac a="S" and b="U" and r="(ChiRel A)" in converse_trancl_induct)
  (unfold Image_def Int_def)
  auto
 

(* TO DO *)

lemma SAStates_ChiPlus_ChiRel_NoCycle_3 [rule_format]:
 "[ (S,U) ∈ ChiPlus A ] ==> (U,T) ∈ (ChiRel A) ⟶ (S,s) ∈ ChiPlus A ⟶ (s,U) ∈ ChiPlus A ⟶
   (insert S (insert U ({V. (S,V) ∈ ChiPlus A ∧ (V,U) ∈ ChiPlus A}))) ∩ (ChiRel A `` {s}) ≠ {}"
apply (unfold ChiPlus_def)
apply (rule_tac a="S" and b="U" and r="(ChiRel A)" in trancl_induct)
apply fast
apply (rename_tac W)
prefer 2
apply (rename_tac W X)
prefer 2
apply (unfold Image_def Int_def)
apply (simp, safe)
apply (fold ChiPlus_def)
apply (case_tac "(s,W) ∈ ChiRel A")
apply fast
apply (frule_tac S=s and T=W in ChiPlus_ChiRel_Ex2)
apply simp
apply safe
apply (rename_tac X)
apply (rule_tac x=X in exI)
apply (fast intro: ChiRel_ChiPlus_trans)
apply simp
apply (case_tac "(s,X) ∈ ChiRel A")
apply force
apply (frule_tac S=s and T=X in ChiPlus_ChiRel_Ex2)
apply simp
apply safe
apply (rename_tac Y)
apply (erule_tac x=Y in allE)
apply simp
apply (fast intro: ChiRel_ChiPlus_trans)
apply simp
apply (case_tac "(s,X) ∈ ChiRel A")
apply force
apply (frule_tac S=s and T=X in ChiPlus_ChiRel_Ex2)
apply simp
apply safe
apply (rename_tac Y)
apply (erule_tac x=Y in allE)
apply simp
apply (fast intro: ChiRel_ChiPlus_trans)
apply fastforce
apply simp
apply (erule_tac x=W in allE)
apply simp
apply simp
apply (rename_tac Y)
apply (erule_tac x=Y in allE)
apply simp
apply (fast intro: ChiRel_ChiPlus_trans)
done

lemma SAStates_ChiPlus_ChiRel_trans [rule_format]:
  "[ (S,U) ∈ (ChiPlus A); (U,T) ∈ (ChiRel A); S ∈ States SA; SA ∈ SAs A ] ==> T ∉ States SA"
apply (cut_tac HA=A in NoCycles_HA)
apply (unfold NoCycles_def)
apply (erule_tac x="insert S (insert U ({V. (S,V) ∈ ChiPlus A ∧ (V,U) ∈ ChiPlus A}))" in ballE)
prefer 2
apply (simp add: ChiPlus_subset_States)
apply (cut_tac A=A in ChiPlus_HAStates) 
apply (unfold HAStates_def)
apply auto[1]
apply safe
apply fast
apply (frule SAStates_ChiPlus_ChiRel_NoCycle_2)
apply fast
apply (frule HAStates_SA_mem)
apply fast
apply (simp only:ChiRel_CompFun)
apply (frule SAStates_ChiPlus_ChiRel_NoCycle_1)
apply auto[3]
apply fast
apply (simp add:ChiRel_CompFun)
apply (frule SAStates_ChiPlus_ChiRel_NoCycle_3)
apply fast
apply fast
back
apply fast
apply (simp only:ChiPlus_HAStates_Left ChiRel_CompFun)
done

lemma SAStates_ChiPlus2 [rule_format]:
  "[ (S,T) ∈ ChiPlus A; SA ∈ SAs A ] ==> S ∈ States SA ⟶ T ∉ States SA"
apply (unfold ChiPlus_def)
apply (rule_tac a="S" and b="T" and r="(ChiRel A)" in trancl_induct)
apply auto
apply (rename_tac U)
apply (frule_tac S=S and T=U in SAStates_ChiRel) 
apply auto
apply (fold ChiPlus_def)
apply (simp only: SAStates_ChiPlus_ChiRel_trans)
done

lemma SAStates_ChiPlus [rule_format]:
 "[ S ∈ States SA; T ∈ States SA; SA ∈ SAs A ] ==> (S,T) ∉ ChiPlus A"
apply auto
apply (simp only: SAStates_ChiPlus2)
done

lemma SAStates_ChiPlus_ChiRel_OneAncestor [rule_format]:
  "[ T ∈ States SA; SA ∈ SAs A; (S,U) ∈ ChiPlus A] ==> S ≠ T ⟶ S ∈ States SA ⟶ (T,U) ∉ ChiRel A"
apply (unfold ChiPlus_def)
apply (rule_tac a="S" and b="U" and r="(ChiRel A)" in trancl_induct)
apply auto
apply (simp add: ChiRel_OneAncestor_notmem)
apply (rename_tac V W)
apply (fold ChiPlus_def)
apply (case_tac "V=T")
apply (simp add: ChiRel_OneAncestor_notmem SAStates_ChiPlus)+
done

lemma SAStates_ChiPlus_OneAncestor [rule_format]:
  "[ T ∈ States SA; SA ∈ SAs A; (S,U) ∈ ChiPlus A ] ==> S ≠ T ⟶
     S ∈ States SA ⟶ (T,U) ∉ ChiPlus A"
apply (unfold ChiPlus_def)
apply (rule_tac a="S" and b="U" and r="(ChiRel A)" in trancl_induct)
apply auto
apply (fold ChiPlus_def)
apply (rename_tac V)
apply (frule_tac T=S and S=T and U=V in SAStates_ChiPlus_ChiRel_OneAncestor)
apply auto
apply (rename_tac V W)
apply (frule_tac S=T and T=W in ChiPlus_ChiRel_Ex)
apply auto
apply (frule_tac T=T and S=S and U=W in SAStates_ChiPlus_ChiRel_OneAncestor)
apply auto
apply (rule ChiRel_ChiPlus_trans)
apply auto
apply (rename_tac X)
apply (case_tac "V=X")
apply simp
apply (simp add: ChiRel_OneAncestor_notmem)
done

lemma ChiRel_ChiPlus_OneAncestor [rule_format]:
  "[ (T,U) ∈ ChiPlus A ] ==> T ≠ S ⟶ (S,U) ∈ ChiRel A ⟶ (T,S) ∈ ChiPlus A"
apply (unfold ChiPlus_def)
apply (rule_tac a="T" and b="U" and r="(ChiRel A)" in trancl_induct)
apply auto
apply (fast intro:ChiRel_OneAncestor)
apply (rename_tac V W)
apply (case_tac "S=V")
apply auto
apply (fast intro:ChiRel_OneAncestor)
done

lemma ChiPlus_SA_OneAncestor [rule_format]: 
   "[ (S,T) ∈ ChiPlus A;
      U ∈ States SA; SA ∈ SAs A ] ==> T ∈ States SA ⟶
      (S,U) ∈ ChiPlus A"
apply (unfold ChiPlus_def)
apply (rule_tac a="S" and b="T" and r="(ChiRel A)" in converse_trancl_induct)
apply auto
apply (frule ChiRel_SA_OneAncestor)
apply fast+
done

subsubsection ‹‹ChiStar››

lemma ChiPlus_ChiStar [simp]:
  "[ (S,T) ∈ ChiPlus A ] ==> (S,T) ∈ ChiStar A"
by (unfold ChiPlus_def ChiStar_def, auto)

lemma HARootState_Range_ChiStar [simp]:
  "[ x ≠ S; S ∈ States (HARoot A) ] ==> (x,S) ∉ (ChiStar A)" 
apply (unfold ChiStar_def)
apply (subst rtrancl_eq_or_trancl)
apply (fold ChiPlus_def)
apply auto
done

lemma ChiStar_Self [simp]:
 "(S,S) ∈ ChiStar A"
apply (unfold ChiStar_def)
apply simp
done

lemma ChiStar_Image [simp]:  
  "S ∈ M ==> S ∈ (ChiStar A `` M)"
apply (unfold Image_def)
apply (auto intro: ChiStar_Self)
done

lemma ChiStar_ChiPlus_noteq: 
  "[ S ≠ T; (S,T) ∈ ChiStar A ] ==> (S,T) ∈ ChiPlus A"
apply (unfold ChiPlus_def ChiStar_def)
apply (simp add: rtrancl_eq_or_trancl)
done

lemma ChiRel_ChiStar_trans:
  "[ (S,U) ∈ ChiStar A; (U,T) ∈ ChiRel A ] ==> (S,T) ∈ ChiStar A"
apply (unfold ChiStar_def)
apply auto
done

subsubsection ‹‹InitConf››

lemma InitConf_HAStates [simp]:
  "InitConf A ⊆ HAStates A"
apply (unfold InitConf_def HAStates_def)
apply auto
apply (rule rtrancl_induct)
back
apply auto
apply (rule_tac x="HARoot A" in bexI)
apply auto
apply (unfold HAStates_def ChiRel_def)
apply auto
done

lemma InitConf_HAStates2 [simp]:
 "S ∈ InitConf A ==> S ∈ HAStates A"
apply (cut_tac A=A in InitConf_HAStates)
apply fast
done

lemma HAInitState_InitConf [simp]:
  "HAInitState A ∈ InitConf A"
by (unfold HAInitState_def InitConf_def, auto)

lemma InitConf_HAInitState_HARoot:
 "[| S ∈ InitConf A; S ≠ HAInitState A |] ==> S ∉ States (HARoot A)"
apply (unfold InitConf_def)
apply auto
apply (rule mp)
prefer 2 
apply fast
back
apply (rule mp)
prefer 2
apply fast
back
back
apply (rule_tac b=S in rtrancl_induct)
apply auto
apply (simp add: ChiRel_HARoot)+
done

lemma InitConf_HARoot_HAInitState [simp]:
 "[ S ∈ InitConf A; S ∈ States (HARoot A) ] ==> S = HAInitState A"
apply (subst not_not [THEN sym])
apply (rule notI)
apply (simp add:InitConf_HAInitState_HARoot)
done

lemma HAInitState_CompFun_InitConf [simp]:
 "[|SA ∈ the (CompFun A (HAInitState A)) |] ==> (InitState SA) ∈ InitConf A"
apply (unfold InitConf_def HAStates_def)
apply auto
apply (rule rtrancl_Int)
apply auto
apply (cut_tac A=A and S="HAInitState A" in HAStates_CompFun_States_ChiRel)
apply auto
apply (rule Image_singleton_iff [THEN subst])
apply (rotate_tac -1)
apply (drule sym)
apply simp
apply (rule_tac x=SA in bexI)
apply auto
done

lemma InitState_CompFun_InitConf:
 "[| S ∈ HAStates A; SA ∈ the (CompFun A S); S ∈ InitConf A |] ==> (InitState SA) ∈ InitConf A"
apply (unfold InitConf_def)
apply auto
apply (rule_tac b=S in rtrancl_into_rtrancl)
apply fast
apply (frule rtrancl_Int1)
apply auto
apply (case_tac "S = HAInitState A")
apply simp
apply (rule rtrancl_mem_Sigma)
apply auto
apply (cut_tac A=A and S=S in HAStates_CompFun_States_ChiRel)
apply auto
apply (rule Image_singleton_iff [THEN subst])
apply (rotate_tac -1)
apply (drule sym)
apply simp 
apply (rule_tac x=SA in bexI)
apply auto
done

lemma InitConf_HAInitStates:
  "InitConf A ⊆ HAInitStates A"
apply (unfold InitConf_def)
apply (rule subsetI)
apply auto
apply (frule rtrancl_Int1)
apply (case_tac "x = HAInitState A")
apply simp
apply (rule rtrancl_mem_Sigma)
apply auto
done

lemma InitState_notmem_InitConf:
 "[| SA ∈ the (CompFun A S); S ∈ InitConf A; T ∈ States SA;
     T ≠ InitState SA |] ==> T ∉ InitConf A"
apply (frule InitConf_HAStates2)
apply (unfold InitConf_def)
apply auto
apply (rule mp)
prefer 2
apply fast
apply (rule mp)
prefer 2
apply fast
back
apply (rule mp)
prefer 2
apply fast
back
back
apply (rule mp)
prefer 2
apply fast
back
back 
back
apply (rule mp)
prefer 2
apply fast
back
back 
back
back
apply (rule mp)
prefer 2
apply fast
back
back 
back
back
back
apply (rule_tac b=T in rtrancl_induct)
apply auto
done

lemma InitConf_CompFun_InitState [simp]:
 "[ SA ∈ the (CompFun A S); S ∈ InitConf A; T ∈ States SA;
    T ∈ InitConf A ] ==> T = InitState SA"
apply (subst not_not [THEN sym])
apply (rule notI)
apply (frule InitState_notmem_InitConf)
apply auto
done

lemma InitConf_ChiRel_Ancestor:
  "[ T ∈ InitConf A; (S,T) ∈ ChiRel A ] ==> S ∈ InitConf A"
apply (unfold InitConf_def)
apply auto
apply (erule rtranclE)
apply auto
apply (rename_tac U)
apply (cut_tac A=A  in HAInitState_notmem_Range_ChiRel)
apply auto
apply (case_tac "U = S")
apply (auto simp add: ChiRel_OneAncestor)
done

lemma InitConf_CompFun_Ancestor:
  "[ S ∈ HAStates A; SA ∈ the (CompFun A S); T ∈ InitConf A; T ∈ States SA ]
    ==> S ∈ InitConf A"
apply (rule InitConf_ChiRel_Ancestor)
apply auto
apply (rule CompFun_ChiRel)
apply auto
done

subsubsection ‹‹StepConf››

lemma StepConf_EmptySet [simp]:
  "StepConf A C {} = C"
by (unfold StepConf_def, auto)

end