hash hmac

name sk : index -> message
name msgA : index * index -> message
name msgB : index * index -> message

abstract SIGN : message
abstract myZero : message
abstract ok : message

mutable cellA(i:index) : message = myZero
mutable cellB(i:index) : message = myZero

channel cR
channel cS

(* mySucc function for counter *)
abstract mySucc : message -> message

(* order relation for counter *)
abstract (~<) : message -> message -> bool

(* PROCESSES *)

process ReceiverA(i,j:index) =
in(cR,x);
if fst(snd(fst(x))) = SIGN
&& cellA(i) ~< snd(snd(fst(x)))
&& snd(x) = hmac(<snd(snd(fst(x))),fst(fst(x))>,sk(i))
then
cellA(i) := mySucc(cellA(i));
out(cS,ok)

process ReceiverB(i,j:index) =
in(cR,x);
if fst(snd(fst(x))) = SIGN
&& cellB(i) ~< snd(snd(fst(x)))
&& snd(x) = hmac(<snd(snd(fst(x))),fst(fst(x))>,sk(i))
then
cellB(i) := mySucc(cellB(i));
out(cS,ok)

process SenderA(i,j:index) =
cellA(i) := mySucc(cellA(i));
out(cR,<<msgA(i,j),<SIGN,cellA(i)>>,hmac(<cellA(i),msgA(i,j)>,sk(i))>)

process SenderB(i,j:index) =
cellB(i) := mySucc(cellB(i));
out(cR,<<msgB(i,j),<SIGN,cellB(i)>>,hmac(<cellB(i),msgB(i,j)>,sk(i))>)

system ((!_i !_j ReceiverA(i,j)) | (!_i !_j SenderA(i,j)) |
(!_i !_j ReceiverB(i,j)) | (!_i !_j SenderB(i,j))).
Typed-check process:

null

Added action dependencies lemmas:


System after processing:

null

System Empty registered with actions (init).
[warning>Loaded "Prelude.sp".
<]global axiom namelength_sk {'P:system} @system:(set:'P; equiv:None) :
[forall (i:index), len (sk i) = namelength_message]
global axiom namelength_msgA {'P:system} @system:(set:'P; equiv:None) :
[forall (i:index * index), len (msgA i) = namelength_message]
global axiom namelength_msgB {'P:system} @system:(set:'P; equiv:None) :
[forall (i:index * index), len (msgB i) = namelength_message]
process ReceiverA (i,j:index) =
in(cR,x);
if fst (snd (fst x)) = SIGN &&
cellA i@τ ~< snd (snd (fst x)) &&
snd x = hmac (<snd (snd (fst x)),fst (fst x)>, sk i) then
cellA(i) := mySucc (cellA i@τ); out(cS,ok); null
process ReceiverB (i,j:index) =
in(cR,x);
if fst (snd (fst x)) = SIGN &&
cellB i@τ ~< snd (snd (fst x)) &&
snd x = hmac (<snd (snd (fst x)),fst (fst x)>, sk i) then
cellB(i) := mySucc (cellB i@τ); out(cS,ok); null
process SenderA (i,j:index) =
cellA(i) := mySucc (cellA i@τ);
out(cR,
<<msgA (i, j),<SIGN,cellA i@τ>>,hmac (<cellA i@τ,msgA (i, j)>, sk i)>);
null
process SenderB (i,j:index) =
cellB(i) := mySucc (cellB i@τ);
out(cR,
<<msgB (i, j),<SIGN,cellB i@τ>>,hmac (<cellB i@τ,msgB (i, j)>, sk i)>);
null
Typed-check process:

( !_i( !_j( ReceiverA i j)) ) |
( !_i( !_j( SenderA i j)) ) |
( !_i( !_j( ReceiverB i j)) ) |
!_i( !_j( SenderB i j))

Added action dependencies lemmas:

axiom mutex_ReceiverB1_ReceiverB {'P:system[like default]}
@system:(set:'P; equiv:None) :
forall (i,j:index),
not happens(ReceiverB1(i, j)) || not happens(ReceiverB(i, j))
axiom mutex_ReceiverB_ReceiverB1 {'P:system[like default]}
@system:(set:'P; equiv:None) :
forall (i,j:index),
not happens(ReceiverB(i, j)) || not happens(ReceiverB1(i, j))
axiom mutex_ReceiverA1_ReceiverA {'P:system[like default]}
@system:(set:'P; equiv:None) :
forall (i,j:index),
not happens(ReceiverA1(i, j)) || not happens(ReceiverA(i, j))
axiom mutex_ReceiverA_ReceiverA1 {'P:system[like default]}
@system:(set:'P; equiv:None) :
forall (i,j:index),
not happens(ReceiverA(i, j)) || not happens(ReceiverA1(i, j))
axiom depends_init_SenderB {'P:system[like default]}
@system:(set:'P; equiv:None) :
forall (i,j:index), happens(SenderB(i, j)) => init < SenderB(i, j)
axiom depends_init_ReceiverB1 {'P:system[like default]}
@system:(set:'P; equiv:None) :
forall (i,j:index), happens(ReceiverB1(i, j)) => init < ReceiverB1(i, j)
axiom depends_init_ReceiverB {'P:system[like default]}
@system:(set:'P; equiv:None) :
forall (i,j:index), happens(ReceiverB(i, j)) => init < ReceiverB(i, j)
axiom depends_init_SenderA {'P:system[like default]}
@system:(set:'P; equiv:None) :
forall (i,j:index), happens(SenderA(i, j)) => init < SenderA(i, j)
axiom depends_init_ReceiverA1 {'P:system[like default]}
@system:(set:'P; equiv:None) :
forall (i,j:index), happens(ReceiverA1(i, j)) => init < ReceiverA1(i, j)
axiom depends_init_ReceiverA {'P:system[like default]}
@system:(set:'P; equiv:None) :
forall (i,j:index), happens(ReceiverA(i, j)) => init < ReceiverA(i, j)

System after processing:

( !_i(
!_j(
in(cR,x);
if fst (snd (fst x)) = SIGN &&
cellA i@τ ~< snd (snd (fst x)) &&
snd x = hmac (<snd (snd (fst x)),fst (fst x)>, sk i) then
cellA(i) := mySucc (cellA i@τ); ReceiverA: out(cS,ok); null
else
ReceiverA1: null)) ) |
( !_i(
!_j(
cellA(i) := mySucc (cellA i@τ);
SenderA: out(cR,
<<msgA (i, j),<SIGN,cellA i@τ>>,
hmac (<cellA i@τ,msgA (i, j)>, sk i)>);
null)) ) |
( !_i(
!_j(
in(cR,x);
if fst (snd (fst x)) = SIGN &&
cellB i@τ ~< snd (snd (fst x)) &&
snd x = hmac (<snd (snd (fst x)),fst (fst x)>, sk i) then
cellB(i) := mySucc (cellB i@τ); ReceiverB: out(cS,ok); null
else
ReceiverB1: null)) ) |
!_i(
!_j(
cellB(i) := mySucc (cellB i@τ);
SenderB: out(cR,
<<msgB (i, j),<SIGN,cellB i@τ>>,
hmac (<cellB i@τ,msgB (i, j)>, sk i)>);
null))

System Empty registered with actions (init).
System default registered with actions
(init,ReceiverA,ReceiverA1,SenderA,ReceiverB,ReceiverB1,SenderB).

CANAUTH

Vincent Cheval, Véronique Cortier, and Mathieu Turuani. “A Little More Conversation, a Little Less Action, a Lot More Satisfaction: Global States in ProVerif”. CSF 2018.

Sender -> Receiver : <<msg,<SIGN,ctr>>,hmac(<ctr,msg>,sk)> ctr := ctr+1 Receiver -> Sender : input x, check x ctr := ctr+1

An agent has a cell which is used to store a counter. This counter is incremented at each action (receive or send).

HELPING LEMMAS - counter increase

SECURITY PROPERTIES - authentication - injectivity ******************************************************************************




(* LIBRARIES *)

include Core.
op assoc ['a] (f:'a -> 'a -> 'a) : bool =
forall (x,y,z:'a), f (f x y) z = f x (f y z)
axiom eq_iff {'P:system} @system:(set:'P; equiv:None) :
forall (x,y:bool), (x = y) = (x <=> y)
axiom eq_not {'P:system} @system:(set:'P; equiv:None) :
forall (x,y:bool), (not x = not y) = (x = y)
Goal eq_sym :
(x = y) = (y = x)
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: x,y:'a
----------------------------------------
(x = y) = (y = x)

[> Line 12: by (rewrite) [goal> lemma eq_sym is proved

lemma eq_sym {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (x,y:'a), (x = y) = (y = x)
Exiting proof mode.

Goal neq_sym :
(x <> y) = (y <> x)
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: x,y:'a
----------------------------------------
(x <> y) = (y <> x)

[> Line 15: by (rewrite) [goal> lemma neq_sym is proved

lemma neq_sym {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (x,y:'a), (x <> y) = (y <> x)
Exiting proof mode.

Goal eq_refl_e :
(x = x) = true
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: x:'a
----------------------------------------
(x = x) = true

[> Line 20: by (rewrite) [goal> lemma eq_refl_e is proved

lemma eq_refl_e {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (x:'a), (x = x) = true
Exiting proof mode.

Goal eq_refl :
x = x
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: x:'a
----------------------------------------
x = x

[> Line 26: by (rewrite) [goal> lemma eq_refl is proved

lemma eq_refl {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (x:'a), x = x
Exiting proof mode.

Goal neq_irrefl :
x <> x <=> false
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: x:'a
----------------------------------------
x <> x <=> false

[> Line 29: by (split) [goal> lemma neq_irrefl is proved

lemma neq_irrefl {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (x:'a), x <> x <=> false
Exiting proof mode.

Goal eq_assoc :
((b0 = b1) = b2) = (b0 = (b1 = b2))
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b0,b1,b2:bool
----------------------------------------
((b0 = b1) = b2) = (b0 = (b1 = b2))

[> Line 37: ((have); 1: by (rewrite)) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b0,b1,b2:bool[const]
true_false: (true = false) = false
----------------------------------------
((b0 = b1) = b2) = (b0 = (b1 = b2))

[> Line 38: ((have); 1: by (rewrite)) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b0,b1,b2:bool[const]
false_true: (false = true) = false
true_false: (true = false) = false
----------------------------------------
((b0 = b1) = b2) = (b0 = (b1 = b2))

[> Line 38: ((case);((case);((case);(try (auto))))) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b0,b1,b2:bool[const]
false_true: (false = true) = false
true_false: (true = false) = false
----------------------------------------
not b2 => not b1 => b0 => ((true = false) = false) = (true = (false = false))

[> Line 38: by (rewrite) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b0,b1,b2:bool[const]
false_true: (false = true) = false
true_false: (true = false) = false
----------------------------------------
b2 => not b1 => not b0 => ((false = false) = true) = (false = (false = true))

[> Line 38: by (rewrite) [goal> lemma eq_assoc is proved

lemma eq_assoc {'P:system} @system:(set:'P; equiv:None) :
forall (b0,b1,b2:bool), ((b0 = b1) = b2) = (b0 = (b1 = b2))
Exiting proof mode.

axiom fun_ext {'P:system} @system:(set:'P; equiv:None) ['a 'b] :
forall (f,g:'a -> 'b), (forall (x:'a), f x = g x) => f = g
Goal true_false :
(true = false) = false
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
----------------------------------------
(true = false) = false

[> Line 51: by (rewrite) [goal> lemma true_false is proved

lemma true_false {'P:system} @system:(set:'P; equiv:None) :
(true = false) = false
Exiting proof mode.

Goal false_true :
(false = true) = false
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
----------------------------------------
(false = true) = false

[> Line 57: by (rewrite) [goal> lemma false_true is proved

lemma false_true {'P:system} @system:(set:'P; equiv:None) :
(false = true) = false
Exiting proof mode.

Goal eq_true :
(b = true) = b
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b:bool
----------------------------------------
(b = true) = b

[> Line 61: by (case) [goal> lemma eq_true is proved

lemma eq_true {'P:system} @system:(set:'P; equiv:None) :
forall (b:bool), (b = true) = b
Exiting proof mode.

Goal eq_true2 :
(true = b) = b
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b:bool
----------------------------------------
(true = b) = b

[> Line 65: by (case) [goal> lemma eq_true2 is proved

lemma eq_true2 {'P:system} @system:(set:'P; equiv:None) :
forall (b:bool), (true = b) = b
Exiting proof mode.

axiom not_true {'P:system} @system:(set:'P; equiv:None) : not true = false
axiom not_false {'P:system} @system:(set:'P; equiv:None) : not false = true
Goal not_not :
not (not b) = b
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b:bool
----------------------------------------
not (not b) = b

[> Line 81: by (case) [goal> lemma not_not is proved

lemma not_not {'P:system} @system:(set:'P; equiv:None) :
forall (b:bool), not (not b) = b
Exiting proof mode.

Goal not_eq :
not (x = y) = (x <> y)
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: x,y:'a
----------------------------------------
not (x = y) = (x <> y)

[> Line 86: by (rewrite) [goal> lemma not_eq is proved

lemma not_eq {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (x,y:'a), not (x = y) = (x <> y)
Exiting proof mode.

Goal not_neq :
not (x <> y) = (x = y)
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: x,y:'a
----------------------------------------
not (x <> y) = (x = y)

[> Line 92: by (rewrite) [goal> lemma not_neq is proved

lemma not_neq {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (x,y:'a), not (x <> y) = (x = y)
Exiting proof mode.

Goal not_eqfalse :
(b = false) = not b
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b:bool
----------------------------------------
(b = false) = not b

[> Line 99: by (case) [goal> lemma not_eqfalse is proved

lemma not_eqfalse {'P:system} @system:(set:'P; equiv:None) :
forall (b:bool), (b = false) = not b
Exiting proof mode.

Goal not_impl :
not (a => b) = (a && not b)
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: a,b:bool
----------------------------------------
not (a => b) = (a && not b)

[> Line 104: ((rewrite);((split);(intro))) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Variables: a,b:bool[const]
H: not (a => b)
----------------------------------------
a && not b

[> Line 104: (split) [goal> Focused goal (1/3):
System variables: 'P
System: (set:'P; equiv:None)
Variables: a,b:bool[const]
H: not (a => b)
----------------------------------------
a

[> Line 106: (rewrite) [goal> Focused goal (1/3):
System variables: 'P
System: (set:'P; equiv:None)
Variables: a,b:bool[const]
H: not (a => b)
----------------------------------------
not (not a)

[> Line 107: (intro) [goal> Focused goal (1/3):
System variables: 'P
System: (set:'P; equiv:None)
Variables: a,b:bool[const]
H: not (a => b)
Hna: not a
----------------------------------------
false

[> Line 108: by (apply) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Variables: a,b:bool[const]
H: not (a => b)
----------------------------------------
not b

[> Line 109: (intro) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Variables: a,b:bool[const]
H: not (a => b)
Hb: b
----------------------------------------
false

[> Line 110: by (apply) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: a,b:bool[const]
H: a && not b
----------------------------------------
not (a => b)

[> Line 111: (intro) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: a,b:bool[const]
H: a && not b
Hi: a => b
----------------------------------------
false

[> Line 112: (destruct) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: a,b:bool[const]
Ha: a
Hi: a => b
Hnb: not b
----------------------------------------
false

[> Line 113: (apply) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: a,b:bool[const]
Ha: a
Hi: a => b
Hnb: not b
----------------------------------------
b

[> Line 114: by (apply) [goal> lemma not_impl is proved

lemma not_impl {'P:system} @system:(set:'P; equiv:None) :
forall (a,b:bool), not (a => b) = (a && not b)
Exiting proof mode.

Goal eq_false :
((x = y) = false) = (x <> y)
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: x,y:'a
----------------------------------------
((x = y) = false) = (x <> y)

[> Line 121: (rewrite) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: x,y:'a
----------------------------------------
((x = y) = false) = not (x = y)

[> Line 121: ((case);(intro)) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: x,y:'a
_: x = y
----------------------------------------
(true = false) = not true

[> Line 121: (simpl) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: x,y:'a
_: x = y
----------------------------------------
true

[> Line 122: (auto) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: x,y:'a
_: not (x = y)
----------------------------------------
(false = false) = not false

[> Line 122: by (rewrite) [goal> lemma eq_false is proved

lemma eq_false {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (x,y:'a), ((x = y) = false) = (x <> y)
Exiting proof mode.

axiom and_comm {'P:system} @system:(set:'P; equiv:None) :
forall (b,b':bool), (b && b') = (b' && b)
Goal and_dist :
((b0 || b1) && b2) = (b0 && b2 || b1 && b2)
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b0,b1,b2:bool
----------------------------------------
((b0 || b1) && b2) = (b0 && b2 || b1 && b2)

[> Line 132: (rewrite) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b0,b1,b2:bool[const]
----------------------------------------
(b0 || b1) && b2 <=> b0 && b2 || b1 && b2

[> Line 132: by (split) [goal> lemma and_dist is proved

lemma and_dist {'P:system} @system:(set:'P; equiv:None) :
forall (b0,b1,b2:bool), ((b0 || b1) && b2) = (b0 && b2 || b1 && b2)
Exiting proof mode.

axiom and_true_l {'P:system} @system:(set:'P; equiv:None) :
forall (b:bool), (true && b) = b
Goal and_true_r :
(b && true) = b
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b:bool
----------------------------------------
(b && true) = b

[> Line 138: by (rewrite) [goal> lemma and_true_r is proved

lemma and_true_r {'P:system} @system:(set:'P; equiv:None) :
forall (b:bool), (b && true) = b
Exiting proof mode.

axiom and_false_l {'P:system} @system:(set:'P; equiv:None) :
forall (b:bool), (false && b) = false
Goal and_false_r :
(b && false) = false
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b:bool
----------------------------------------
(b && false) = false

[> Line 145: by (rewrite) [goal> lemma and_false_r is proved

lemma and_false_r {'P:system} @system:(set:'P; equiv:None) :
forall (b:bool), (b && false) = false
Exiting proof mode.

Goal and_double :
(b && b) = b
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b:bool
----------------------------------------
(b && b) = b

[> Line 150: by (case) [goal> lemma and_double is proved

lemma and_double {'P:system} @system:(set:'P; equiv:None) :
forall (b:bool), (b && b) = b
Exiting proof mode.

axiom or_comm {'P:system} @system:(set:'P; equiv:None) :
forall (b,b':bool), (b || b') = (b' || b)
Goal or_dist :
((b0 || b2) && (b1 || b2)) = (b0 && b1 || b2)
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b0,b1,b2:bool
----------------------------------------
((b0 || b2) && (b1 || b2)) = (b0 && b1 || b2)

[> Line 158: (rewrite) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b0,b1,b2:bool[const]
----------------------------------------
(b0 || b2) && (b1 || b2) <=> b0 && b1 || b2

[> Line 158: by (split) [goal> lemma or_dist is proved

lemma or_dist {'P:system} @system:(set:'P; equiv:None) :
forall (b0,b1,b2:bool), ((b0 || b2) && (b1 || b2)) = (b0 && b1 || b2)
Exiting proof mode.

axiom or_false_l {'P:system} @system:(set:'P; equiv:None) :
forall (b:bool), (false || b) = b
Goal or_false_r :
(b || false) = b
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b:bool
----------------------------------------
(b || false) = b

[> Line 164: by (rewrite) [goal> lemma or_false_r is proved

lemma or_false_r {'P:system} @system:(set:'P; equiv:None) :
forall (b:bool), (b || false) = b
Exiting proof mode.

axiom or_true_l {'P:system} @system:(set:'P; equiv:None) :
forall (b:bool), (true || b) = true
Goal or_true_r :
(b || true) = true
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b:bool
----------------------------------------
(b || true) = true

[> Line 171: by (rewrite) [goal> lemma or_true_r is proved

lemma or_true_r {'P:system} @system:(set:'P; equiv:None) :
forall (b:bool), (b || true) = true
Exiting proof mode.

Goal or_double :
(b || b) = b
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b:bool
----------------------------------------
(b || b) = b

[> Line 175: by (case) [goal> lemma or_double is proved

lemma or_double {'P:system} @system:(set:'P; equiv:None) :
forall (b:bool), (b || b) = b
Exiting proof mode.

Goal impl_charac :
(b => b') = (not b || b')
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b,b':bool
----------------------------------------
(b => b') = (not b || b')

[> Line 182: (((rewrite);((split);((case);(case))));(intro)) [goal> lemma impl_charac is proved

lemma impl_charac {'P:system} @system:(set:'P; equiv:None) :
forall (b,b':bool), (b => b') = (not b || b')
Exiting proof mode.

Goal impl_false_l :
(false => b) = true
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b:bool
----------------------------------------
(false => b) = true

[> Line 186: by ((rewrite);(case)) [goal> lemma impl_false_l is proved

lemma impl_false_l {'P:system} @system:(set:'P; equiv:None) :
forall (b:bool), (false => b) = true
Exiting proof mode.

Goal impl_true_r :
(b => true) = true
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b:bool
----------------------------------------
(b => true) = true

[> Line 190: (auto) [goal> lemma impl_true_r is proved

lemma impl_true_r {'P:system} @system:(set:'P; equiv:None) :
forall (b:bool), (b => true) = true
Exiting proof mode.

Goal impl_true_l :
(true => b) = b
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b:bool
----------------------------------------
(true => b) = b

[> Line 194: by (rewrite) [goal> lemma impl_true_l is proved

lemma impl_true_l {'P:system} @system:(set:'P; equiv:None) :
forall (b:bool), (true => b) = b
Exiting proof mode.

Goal impl_contra :
(b => c) = (not c => not b)
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b,c:bool
----------------------------------------
(b => c) = (not c => not b)

[> Line 200: (rewrite) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b,c:bool[const]
----------------------------------------
(not b || c) = (c || not b)

[> Line 201: by (rewrite) [goal> lemma impl_contra is proved

lemma impl_contra {'P:system} @system:(set:'P; equiv:None) :
forall (b,c:bool), (b => c) = (not c => not b)
Exiting proof mode.

Goal not_and :
not (a && b) = (not a || not b)
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: a,b:bool
----------------------------------------
not (a && b) = (not a || not b)

[> Line 208: (rewrite) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: a,b:bool[const]
----------------------------------------
not (a && b) <=> not a || not b

[> Line 210: (((case);(case));(intro)) [goal> lemma not_and is proved

lemma not_and {'P:system} @system:(set:'P; equiv:None) :
forall (a,b:bool), not (a && b) = (not a || not b)
Exiting proof mode.

Goal not_or :
not (a || b) = (not a && not b)
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: a,b:bool
----------------------------------------
not (a || b) = (not a && not b)

[> Line 214: (rewrite) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: a,b:bool[const]
----------------------------------------
not (a || b) <=> not a && not b

[> Line 216: (((case);(case));(intro)) [goal> lemma not_or is proved

lemma not_or {'P:system} @system:(set:'P; equiv:None) :
forall (a,b:bool), not (a || b) = (not a && not b)
Exiting proof mode.

Goal if_true :
b => if b then x else y = x
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: b:bool,x,y:'a
----------------------------------------
b => if b then x else y = x

[> Line 225: (intro) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: b:bool[const],x,y:'a
H: b
----------------------------------------
if b then x else y = x

[> Line 226: (case) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: b:bool[const],x,y:'a
H: b
----------------------------------------
b && if b then x else y = x => x = x

[> Line 227: (auto) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: b:bool[const],x,y:'a
H: b
----------------------------------------
not b && if b then x else y = y => y = x

[> Line 227: (intro) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: b:bool[const],x,y:'a
H: b
HH: not b
_: if b then x else y = y
----------------------------------------
y = x

[> Line 228: by (have) [goal> lemma if_true is proved

lemma if_true {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (b:bool,x,y:'a), b => if b then x else y = x
Exiting proof mode.

Goal if_true0 :
if true then x else y = x
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: x,y:'a
----------------------------------------
if true then x else y = x

[> Line 233: by (rewrite) [goal> lemma if_true0 is proved

lemma if_true0 {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (x,y:'a), if true then x else y = x
Exiting proof mode.

Goal if_false :
not b => if b then x else y = y
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: b:bool,x,y:'a
----------------------------------------
not b => if b then x else y = y

[> Line 241: ((intro);(case)) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: b:bool[const],x,y:'a
H: not b
----------------------------------------
b && if b then x else y = x => x = y

[> Line 241: (intro) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: b:bool[const],x,y:'a
H: not b
H1: b
H2: if b then x else y = x
----------------------------------------
x = y

[> Line 242: by (rewrite) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: b:bool[const],x,y:'a
H: not b
----------------------------------------
not b && if b then x else y = y => y = y

[> Line 244: (auto) [goal> lemma if_false is proved

lemma if_false {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (b:bool,x,y:'a), not b => if b then x else y = y
Exiting proof mode.

Goal if_false0 :
if false then x else y = y
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: x,y:'a
----------------------------------------
if false then x else y = y

[> Line 250: by (rewrite) [goal> lemma if_false0 is proved

lemma if_false0 {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (x,y:'a), if false then x else y = y
Exiting proof mode.

Goal if_then_then :
if b then (if b' then x else y) else y = if (b && b') then x else y
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: b,b':bool,x,y:'a
----------------------------------------
if b then (if b' then x else y) else y = if (b && b') then x else y

[> Line 257: by ((case);(case)) [goal> lemma if_then_then is proved

lemma if_then_then {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (b,b':bool,x,y:'a),
if b then (if b' then x else y) else y = if (b && b') then x else y
Exiting proof mode.

Goal if_then_or :
if b0 then m0 else if b1 then m0 else m1 = if (b0 || b1) then m0 else m1
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b0,b1:bool,m0,m1:message
----------------------------------------
if b0 then m0 else if b1 then m0 else m1 = if (b0 || b1) then m0 else m1

[> Line 264: ((have); 1: by (auto)) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b0,b1:bool[const],m0,m1:message
_: b0
----------------------------------------
if b0 then m0 else if b1 then m0 else m1 = if (b0 || b1) then m0 else m1

[> Line 264: ((rewrite);(intro)) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b0,b1:bool[const],m0,m1:message
_: b0
----------------------------------------
m0 = if (b0 || b1) then m0 else m1

[> Line 264: ((rewrite);(intro)) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b0,b1:bool[const],m0,m1:message
_: not b0
----------------------------------------
if b0 then m0 else if b1 then m0 else m1 = if (b0 || b1) then m0 else m1

[> Line 265: ((have); 1: by (auto)) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b0,b1:bool[const],m0,m1:message
_: b1
_: not b0
----------------------------------------
if b0 then m0 else if b1 then m0 else m1 = if (b0 || b1) then m0 else m1

[> Line 265: ((rewrite);(intro)) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b0,b1:bool[const],m0,m1:message
_: b1
_: not b0
----------------------------------------
if b1 then m0 else m1 = if (b0 || b1) then m0 else m1

[> Line 265: ((rewrite);(intro)) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b0,b1:bool[const],m0,m1:message
_: not b1
_: not b0
----------------------------------------
if b0 then m0 else if b1 then m0 else m1 = if (b0 || b1) then m0 else m1

[> Line 267: ((rewrite);(intro)) [goal> lemma if_then_or is proved

lemma if_then_or {'P:system} @system:(set:'P; equiv:None) :
forall (b0,b1:bool,m0,m1:message),
if b0 then m0 else if b1 then m0 else m1 = if (b0 || b1) then m0 else m1
Exiting proof mode.

Goal if_then_implies :
if b then (if b' then x else y) else z =
if b then (if (b => b') then x else y) else z
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: b,b':bool,x,y,z:'a
----------------------------------------
if b then (if b' then x else y) else z =
if b then (if (b => b') then x else y) else z

[> Line 273: ((case);((intro);((case);((intro);((simpl);(try (auto))))))) [goal> lemma if_then_implies is proved

lemma if_then_implies {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (b,b':bool,x,y,z:'a),
if b then (if b' then x else y) else z =
if b then (if (b => b') then x else y) else z
Exiting proof mode.

Goal if_same :
if b then x else x = x
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: b:bool,x:'a
----------------------------------------
if b then x else x = x

[> Line 280: by (case) [goal> lemma if_same is proved

lemma if_same {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (b:bool,x:'a), if b then x else x = x
Exiting proof mode.

Goal if_then :
b = b' => if b then (if b' then x else y) else z = if b then x else z
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: b,b':bool,x,y,z:'a
----------------------------------------
b = b' => if b then (if b' then x else y) else z = if b then x else z

[> Line 289: by ((intro);(case)) [goal> lemma if_then is proved

lemma if_then {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (b,b':bool,x,y,z:'a),
b = b' => if b then (if b' then x else y) else z = if b then x else z
Exiting proof mode.

Goal if_then_inv :
if b then m0 else m1 = if b then (if b then m0) else m1
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b:bool,m0,m1:message
----------------------------------------
if b then m0 else m1 = if b then (if b then m0) else m1

[> Line 295: (auto) [goal> lemma if_then_inv is proved

lemma if_then_inv {'P:system} @system:(set:'P; equiv:None) :
forall (b:bool,m0,m1:message),
if b then m0 else m1 = if b then (if b then m0) else m1
Exiting proof mode.

Goal if_else :
b = b' => if b then x else if b' then y else z = if b then x else z
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: b,b':bool,x,y,z:'a
----------------------------------------
b = b' => if b then x else if b' then y else z = if b then x else z

[> Line 303: by ((intro);(case)) [goal> lemma if_else is proved

lemma if_else {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (b,b':bool,x,y,z:'a),
b = b' => if b then x else if b' then y else z = if b then x else z
Exiting proof mode.

Goal if_else_inv :
if b then m0 else m1 = if b then m0 else if not b then m1
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b:bool,m0,m1:message
----------------------------------------
if b then m0 else m1 = if b then m0 else if not b then m1

[> Line 308: by (case) [goal> lemma if_else_inv is proved

lemma if_else_inv {'P:system} @system:(set:'P; equiv:None) :
forall (b:bool,m0,m1:message),
if b then m0 else m1 = if b then m0 else if not b then m1
Exiting proof mode.

Goal if_push :
if b then m0 else m1 = if b then (if b then m0) else if not b then m1
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: b:bool,m0,m1:message
----------------------------------------
if b then m0 else m1 = if b then (if b then m0) else if not b then m1

[> Line 312: by (rewrite) [goal> lemma if_push is proved

lemma if_push {'P:system} @system:(set:'P; equiv:None) :
forall (b:bool,m0,m1:message),
if b then m0 else m1 = if b then (if b then m0) else if not b then m1
Exiting proof mode.

Goal if_then_not :
b = not b' => if b then (if b' then x else y) else z = if b then y else z
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: b,b':bool,x,y,z:'a
----------------------------------------
b = not b' => if b then (if b' then x else y) else z = if b then y else z

[> Line 320: by ((intro);(case)) [goal> lemma if_then_not is proved

lemma if_then_not {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (b,b':bool,x,y,z:'a),
b = not b' => if b then (if b' then x else y) else z = if b then y else z
Exiting proof mode.

Goal if_else_not :
b = not b' => if b then x else if b' then y else z = if b then x else y
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: b,b':bool,x,y,z:'a
----------------------------------------
b = not b' => if b then x else if b' then y else z = if b then x else y

[> Line 329: by ((intro);(case)) [goal> lemma if_else_not is proved

lemma if_else_not {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (b,b':bool,x,y,z:'a),
b = not b' => if b then x else if b' then y else z = if b then x else y
Exiting proof mode.

Goal if_app :
f (if c then x else y) = if c then f x else f y
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: c:bool,f:'a -> 'b,x,y:'a
----------------------------------------
f (if c then x else y) = if c then f x else f y

[> Line 334: by (case) [goal> lemma if_app is proved

lemma if_app {'P:system} @system:(set:'P; equiv:None) ['a 'b] :
forall (f:'a -> 'b,c:bool,x,y:'a),
f (if c then x else y) = if c then f x else f y
Exiting proof mode.

Goal fst_pair :
fst <x,y> = x
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: x,y:message
----------------------------------------
fst <x,y> = x

[> Line 340: (auto) [goal> lemma fst_pair is proved

lemma fst_pair {'P:system} @system:(set:'P; equiv:None) :
forall (x,y:message), fst <x,y> = x
Exiting proof mode.

Goal snd_pair :
snd <x,y> = y
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: x,y:message
----------------------------------------
snd <x,y> = y

[> Line 344: (auto) [goal> lemma snd_pair is proved

lemma snd_pair {'P:system} @system:(set:'P; equiv:None) :
forall (x,y:message), snd <x,y> = y
Exiting proof mode.

Goal iff_def :
(x <=> y) = ((x => y) && (y => x))
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: x,y:bool
----------------------------------------
(x <=> y) = ((x => y) && (y => x))

[> Line 353: ((rewrite);(split)) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Variables: x,y:bool[const]
----------------------------------------
x <=> y => (x => y) && (y => x)

[> Line 353: by (intro) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: x,y:bool[const]
----------------------------------------
(x => y) && (y => x) => x <=> y

[> Line 355: (auto) [goal> lemma iff_def is proved

lemma iff_def {'P:system} @system:(set:'P; equiv:None) :
forall (x,y:bool), (x <=> y) = ((x => y) && (y => x))
Exiting proof mode.

Goal iff_refl :
(x <=> x) = true
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: x:bool
----------------------------------------
(x <=> x) = true

[> Line 359: by (rewrite) [goal> lemma iff_refl is proved

lemma iff_refl {'P:system} @system:(set:'P; equiv:None) :
forall (x:bool), (x <=> x) = true
Exiting proof mode.

Goal iff_sym :
(x <=> y) = (y <=> x)
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: x,y:bool
----------------------------------------
(x <=> y) = (y <=> x)

[> Line 366: by (rewrite) [goal> lemma iff_sym is proved

lemma iff_sym {'P:system} @system:(set:'P; equiv:None) :
forall (x,y:bool), (x <=> y) = (y <=> x)
Exiting proof mode.

Goal true_iff_false :
(true <=> false) = false
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
----------------------------------------
(true <=> false) = false

[> Line 370: by (rewrite) [goal> lemma true_iff_false is proved

lemma true_iff_false {'P:system} @system:(set:'P; equiv:None) :
(true <=> false) = false
Exiting proof mode.

Goal false_iff_true :
(false <=> true) = false
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
----------------------------------------
(false <=> true) = false

[> Line 376: by (rewrite) [goal> lemma false_iff_true is proved

lemma false_iff_true {'P:system} @system:(set:'P; equiv:None) :
(false <=> true) = false
Exiting proof mode.

Goal contra_iff :
(not x <=> y) = (x <=> not y)
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: x,y:bool
----------------------------------------
(not x <=> y) = (x <=> not y)

[> Line 384: (rewrite) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: x,y:bool[const]
----------------------------------------
(not x <=> y) <=> (x <=> not y)

[> Line 385: ((split);by (rewrite)) [goal> lemma contra_iff is proved

lemma contra_iff {'P:system} @system:(set:'P; equiv:None) :
forall (x,y:bool), (not x <=> y) = (x <=> not y)
Exiting proof mode.

Goal exists_false1 :
(exists (a:'a), false) = false
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
----------------------------------------
(exists (a:'a), false) = false

[> Line 392: by (rewrite) [goal> lemma exists_false1 is proved

lemma exists_false1 {'P:system} @system:(set:'P; equiv:None) ['a] :
(exists (a:'a), false) = false
Exiting proof mode.

Goal exists_false2 :
(exists (a:'a,b:'b), false) = false
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
----------------------------------------
(exists (a:'a,b:'b), false) = false

[> Line 396: by (rewrite) [goal> lemma exists_false2 is proved

lemma exists_false2 {'P:system} @system:(set:'P; equiv:None) ['a 'b] :
(exists (a:'a,b:'b), false) = false
Exiting proof mode.

Goal exists_false3 :
(exists (a:'a,b:'b,c:'c), false) = false
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b, 'c
----------------------------------------
(exists (a:'a,b:'b,c:'c), false) = false

[> Line 400: by (rewrite) [goal> lemma exists_false3 is proved

lemma exists_false3 {'P:system} @system:(set:'P; equiv:None) ['a 'b 'c] :
(exists (a:'a,b:'b,c:'c), false) = false
Exiting proof mode.

Goal exists_false4 :
(exists (a:'a,b:'b,c:'c,d:'d), false) = false
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b, 'c, 'd
----------------------------------------
(exists (a:'a,b:'b,c:'c,d:'d), false) = false

[> Line 404: by (rewrite) [goal> lemma exists_false4 is proved

lemma exists_false4 {'P:system} @system:(set:'P; equiv:None) ['a 'b 'c 'd] :
(exists (a:'a,b:'b,c:'c,d:'d), false) = false
Exiting proof mode.

Goal exists_false5 :
(exists (a:'a,b:'b,c:'c,d:'d,e:'e), false) = false
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b, 'c, 'd, 'e
----------------------------------------
(exists (a:'a,b:'b,c:'c,d:'d,e:'e), false) = false

[> Line 408: by (rewrite) [goal> lemma exists_false5 is proved

lemma exists_false5 {'P:system} @system:(set:'P; equiv:None)
['a 'b 'c 'd 'e] : (exists (a:'a,b:'b,c:'c,d:'d,e:'e), false) = false
Exiting proof mode.

Goal exists_false6 :
(exists (a:'a,b:'b,c:'c,d:'d,e:'e,f:'f), false) = false
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b, 'c, 'd, 'e, 'f
----------------------------------------
(exists (a:'a,b:'b,c:'c,d:'d,e:'e,f:'f), false) = false

[> Line 412: by (rewrite) [goal> lemma exists_false6 is proved

lemma exists_false6 {'P:system} @system:(set:'P; equiv:None)
['a 'b 'c 'd 'e 'f] :
(exists (a:'a,b:'b,c:'c,d:'d,e:'e,f:'f), false) = false
Exiting proof mode.

Goal forall_true1 :
(forall (a:'a), true) = true
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
----------------------------------------
(forall (a:'a), true) = true

[> Line 422: (auto) [goal> lemma forall_true1 is proved

lemma forall_true1 {'P:system} @system:(set:'P; equiv:None) ['a] :
(forall (a:'a), true) = true
Exiting proof mode.

Goal forall_true2 :
(forall (a:'a,b:'b), true) = true
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
----------------------------------------
(forall (a:'a,b:'b), true) = true

[> Line 426: (auto) [goal> lemma forall_true2 is proved

lemma forall_true2 {'P:system} @system:(set:'P; equiv:None) ['a 'b] :
(forall (a:'a,b:'b), true) = true
Exiting proof mode.

Goal forall_true3 :
(forall (a:'a,b:'b,c:'c), true) = true
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b, 'c
----------------------------------------
(forall (a:'a,b:'b,c:'c), true) = true

[> Line 430: (auto) [goal> lemma forall_true3 is proved

lemma forall_true3 {'P:system} @system:(set:'P; equiv:None) ['a 'b 'c] :
(forall (a:'a,b:'b,c:'c), true) = true
Exiting proof mode.

Goal forall_true4 :
(forall (a:'a,b:'b,c:'c,d:'d), true) = true
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b, 'c, 'd
----------------------------------------
(forall (a:'a,b:'b,c:'c,d:'d), true) = true

[> Line 434: (auto) [goal> lemma forall_true4 is proved

lemma forall_true4 {'P:system} @system:(set:'P; equiv:None) ['a 'b 'c 'd] :
(forall (a:'a,b:'b,c:'c,d:'d), true) = true
Exiting proof mode.

Goal forall_true5 :
(forall (a:'a,b:'b,c:'c,d:'d,e:'e), true) = true
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b, 'c, 'd, 'e
----------------------------------------
(forall (a:'a,b:'b,c:'c,d:'d,e:'e), true) = true

[> Line 438: (auto) [goal> lemma forall_true5 is proved

lemma forall_true5 {'P:system} @system:(set:'P; equiv:None)
['a 'b 'c 'd 'e] : (forall (a:'a,b:'b,c:'c,d:'d,e:'e), true) = true
Exiting proof mode.

Goal forall_true6 :
(forall (a:'a,b:'b,c:'c,d:'d,e:'e,f:'f), true) = true
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b, 'c, 'd, 'e, 'f
----------------------------------------
(forall (a:'a,b:'b,c:'c,d:'d,e:'e,f:'f), true) = true

[> Line 442: (auto) [goal> lemma forall_true6 is proved

lemma forall_true6 {'P:system} @system:(set:'P; equiv:None)
['a 'b 'c 'd 'e 'f] : (forall (a:'a,b:'b,c:'c,d:'d,e:'e,f:'f), true) = true
Exiting proof mode.

axiom len_zeroes {'P:system} @system:(set:'P; equiv:None) :
forall (x:message), len (zeroes x) = len x
Goal f_apply :
x = y => f x = f y
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: f:'a -> 'b,x,y:'a
----------------------------------------
x = y => f x = f y

[> Line 455: by (intro) [goal> lemma f_apply is proved

lemma f_apply {'P:system} @system:(set:'P; equiv:None) ['a 'b] :
forall (f:'a -> 'b,x,y:'a), x = y => f x = f y
Exiting proof mode.

Goal not_exists_1 :
not exists (a:'a), phi a = forall (a:'a), not (phi a)
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:'a -> bool
----------------------------------------
not exists (a:'a), phi a = forall (a:'a), not (phi a)

[> Line 461: (rewrite) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:'a -> bool
----------------------------------------
not exists (a:'a), phi a <=> forall (a:'a), not (phi a)

[> Line 462: (split) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:'a -> bool
----------------------------------------
not exists (a:'a), phi a => forall (a:'a), not (phi a)

[> Line 463: (intro) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: a:'a,phi:'a -> bool
H: not exists (a:'a), phi a
Hp: phi a
----------------------------------------
false

[> Line 463: (apply) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: a:'a,phi:'a -> bool
H: not exists (a:'a), phi a
Hp: phi a
----------------------------------------
exists (a:'a), phi a

[> Line 465: by (exists) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:'a -> bool
----------------------------------------
(forall (a:'a), not (phi a)) => not exists (a:'a), phi a

[> Line 465: (intro) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: a:'a,phi:'a -> bool
H: forall (a:'a), not (phi a)
Hp: phi a
----------------------------------------
false

[> Line 467: by (have) [goal> lemma not_exists_1 is proved

lemma not_exists_1 {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (phi:'a -> bool),
not exists (a:'a), phi a = forall (a:'a), not (phi a)
Exiting proof mode.

Goal not_exists_2 :
not exists (a:'a,b:'b), phi a b = forall (a:'a,b:'b), not (phi a b)
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
----------------------------------------
not exists (a:'a,b:'b), phi a b = forall (a:'a,b:'b), not (phi a b)

[> Line 473: (rewrite) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
----------------------------------------
not exists (a:'a,b:'b), phi a b <=> forall (a:'a,b:'b), not (phi a b)

[> Line 474: (split) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
----------------------------------------
not exists (a:'a,b:'b), phi a b => forall (a:'a,b:'b), not (phi a b)

[> Line 475: (intro) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: a:'a,b:'b,phi:'a -> 'b -> bool
H: not exists (a:'a,b:'b), phi a b
Hp: phi a b
----------------------------------------
false

[> Line 475: (apply) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: a:'a,b:'b,phi:'a -> 'b -> bool
H: not exists (a:'a,b:'b), phi a b
Hp: phi a b
----------------------------------------
exists (a:'a,b:'b), phi a b

[> Line 477: by (exists) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
----------------------------------------
(forall (a:'a,b:'b), not (phi a b)) => not exists (a:'a,b:'b), phi a b

[> Line 477: (intro) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: a:'a,b:'b,phi:'a -> 'b -> bool
H: forall (a:'a,b:'b), not (phi a b)
Hp: phi a b
----------------------------------------
false

[> Line 479: by (have) [goal> lemma not_exists_2 is proved

lemma not_exists_2 {'P:system} @system:(set:'P; equiv:None) ['a 'b] :
forall (phi:'a -> 'b -> bool),
not exists (a:'a,b:'b), phi a b = forall (a:'a,b:'b), not (phi a b)
Exiting proof mode.

axiom not_forall_1 {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (phi:'a -> bool),
not forall (a:'a), phi a = exists (a:'a), not (phi a)
axiom not_forall_2 {'P:system} @system:(set:'P; equiv:None) ['a 'b] :
forall (phi:'a -> 'b -> bool),
not forall (a:'a,b:'b), phi a b = exists (a:'a,b:'b), not (phi a b)
axiom try_carac_1 {'P:system} @system:(set:'P; equiv:None) ['a 'b] :
forall (phi:'a -> bool,f:'a -> 'b,g:'b),
try find x:'a such that phi x in f x else g =
if (exists (x:'a), phi x) then f (choose phi) else g
Goal choose_spec :
phi x => phi (choose phi)
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:'a -> bool,x:'a
----------------------------------------
phi x => phi (choose phi)

[> Line 505: (intro) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
phi (choose phi)

[> Line 508: (have) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
phi (choose phi) = if (exists (x:'a), phi x) then phi (choose phi) else false

[> Line 509: ?? [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
phi (choose phi) = if (exists (x:'a), phi x) then phi (choose phi) else false

[> Line 509: ((rewrite);(intro)) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
exists (x:'a), phi x

[> Line 510: by (exists) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
if (exists (x:'a), phi x) then phi (choose phi) else false

[> Line 511: ?? [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
if (exists (x:'a), phi x) then phi (choose phi) else false

[> Line 512: (rewrite) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
try find x:'a such that phi x in phi x else false

[> Line 513: (case) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
(exists (x:'a),
phi x && try find x:'a such that phi x in phi x else false = phi x)
=> try find x:'a such that phi x in phi x else false

[> Line 514: (auto) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
(forall (x:'a), not (phi x)) &&
try find x:'a such that phi x in phi x else false = false =>
try find x:'a such that phi x in phi x else false

[> Line 515: ((intro);by (have)) [goal> lemma choose_spec is proved

lemma choose_spec {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (phi:'a -> bool,x:'a), phi x => phi (choose phi)
Exiting proof mode.

Goal try_choose :
phi x => try find x:'a such that phi x in f x else g = f (choose phi)
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: f:'a -> 'b,g:'b,phi:'a -> bool,x:'a
----------------------------------------
phi x => try find x:'a such that phi x in f x else g = f (choose phi)

[> Line 524: (intro) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: f:'a -> 'b,g:'b,phi:'a -> bool,x:'a
H: phi x
----------------------------------------
try find x:'a such that phi x in f x else g = f (choose phi)

[> Line 525: (rewrite) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: f:'a -> 'b,g:'b,phi:'a -> bool,x:'a
H: phi x
----------------------------------------
if (exists (x:'a), phi x) then f (choose phi) else g = f (choose phi)

[> Line 526: ((rewrite);(intro)) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: f:'a -> 'b,g:'b,phi:'a -> bool,x:'a
H: phi x
----------------------------------------
exists (x:'a), phi x

[> Line 527: by (exists) [goal> lemma try_choose is proved

lemma try_choose {'P:system} @system:(set:'P; equiv:None) ['a 'b] :
forall (phi:'a -> bool,f:'a -> 'b,g:'b,x:'a),
phi x => try find x:'a such that phi x in f x else g = f (choose phi)
Exiting proof mode.

Goal forall_exists :
(forall (x:'a), exists (y:'b), phi x y) =
exists (y':'a -> 'b), forall (x:'a), phi x (y' x)
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
----------------------------------------
(forall (x:'a), exists (y:'b), phi x y) =
exists (y':'a -> 'b), forall (x:'a), phi x (y' x)

[> Line 536: ((rewrite);(split)) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
----------------------------------------
(forall (x:'a), exists (y:'b), phi x y) =>
exists (y':'a -> 'b), forall (x:'a), phi x (y' x)

[> Line 537: (intro) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
H: forall (x:'a), exists (y:'b), phi x y
----------------------------------------
exists (y':'a -> 'b), forall (x:'a), phi x (y' x)

[> Line 538: (exists) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
H: forall (x:'a), exists (y:'b), phi x y
----------------------------------------
forall (x:'a), phi x ((fun (x:'a) => choose (fun (y:'b) => phi x y)) x)

[> Line 539: ((intro);(simpl)) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool,x:'a
H: forall (x:'a), exists (y:'b), phi x y
----------------------------------------
phi x (choose (fun (y:'b) => phi x y))

[> Line 540: (have) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool,x:'a,y:'b
H: forall (x:'a), exists (y:'b), phi x y
Hy: phi x y
----------------------------------------
phi x (choose (fun (y:'b) => phi x y))

[> Line 544: ((have); 1: by (auto)) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool,x:'a,y:'b
H: forall (x:'a), exists (y:'b), phi x y
Hy: phi x y
----------------------------------------
(fun (y:'b) => phi x y) (choose (fun (y:'b) => phi x y))

[> Line 545: (apply) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool,x:'a,y:'b
H: forall (x:'a), exists (y:'b), phi x y
Hy: phi x y
----------------------------------------
(fun (y:'b) => phi x y) y

[> Line 546: ((simpl);(assumption)) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
----------------------------------------
(exists (y':'a -> 'b), forall (x:'a), phi x (y' x)) =>
forall (x:'a), exists (y:'b), phi x y

[> Line 547: (intro) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool,x:'a,y':'a -> 'b
H: forall (x:'a), phi x (y' x)
----------------------------------------
exists (y:'b), phi x y

[> Line 548: (exists) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool,x:'a,y':'a -> 'b
H: forall (x:'a), phi x (y' x)
----------------------------------------
phi x (y' x)

[> Line 549: by (apply) [goal> lemma forall_exists is proved

lemma forall_exists {'P:system} @system:(set:'P; equiv:None) ['a 'b] :
forall (phi:'a -> 'b -> bool),
(forall (x:'a), exists (y:'b), phi x y) =
exists (y':'a -> 'b), forall (x:'a), phi x (y' x)
Exiting proof mode.

Goal implies_exists :
(phi => exists (j:'a), psi j) = exists (x:'a), phi => psi x
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:bool,psi:'a -> bool
----------------------------------------
(phi => exists (j:'a), psi j) = exists (x:'a), phi => psi x

[> Line 556: ((rewrite);(split)) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool
----------------------------------------
(phi => exists (j:'a), psi j) => exists (x:'a), phi => psi x

[> Line 557: (intro) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool
H: phi => exists (j:'a), psi j
----------------------------------------
exists (x:'a), phi => psi x

[> Line 558: (case) [goal> Focused goal (1/3):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool
H: phi => exists (j:'a), psi j
----------------------------------------
phi => exists (x:'a), true => psi x

[> Line 559: (intro) [goal> Focused goal (1/3):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool
H: phi => exists (j:'a), psi j
phi: phi
----------------------------------------
exists (x:'a), true => psi x

[> Line 560: ((have); 1: by (apply)) [goal> Focused goal (1/3):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool,x:'a
H: phi => exists (j:'a), psi j
_: psi x
phi: phi
----------------------------------------
exists (x:'a), true => psi x

[> Line 561: by (exists) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool
H: phi => exists (j:'a), psi j
----------------------------------------
not phi => exists (x:'a), false => psi x

[> Line 562: (intro) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool
H: phi => exists (j:'a), psi j
_: not phi
----------------------------------------
exists (x:'a), false => psi x

[> Line 563: by (exists) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool
----------------------------------------
(exists (x:'a), phi => psi x) => phi => exists (j:'a), psi j

[> Line 564: (intro) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool,x:'a
H: phi => psi x
H': phi
----------------------------------------
exists (j:'a), psi j

[> Line 565: by (exists) [goal> lemma implies_exists is proved

lemma implies_exists {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (phi:bool,psi:'a -> bool),
(phi => exists (j:'a), psi j) = exists (x:'a), phi => psi x
Exiting proof mode.

axiom le_trans {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (x,y,z:'a), x <= y => y <= z => x <= z
axiom lt_trans {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (x,y,z:'a), x < y => y < z => x < z
axiom lt_le_trans {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (x,y,z:'a), x < y => y <= z => x < z
axiom le_lt_trans {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (x,y,z:'a), x <= y => y < z => x < z
axiom lt_charac {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (x,y:'a), x < y <=> x <> y && x <= y
axiom le_not_lt_impl_eq {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (x,y:'a), x <= y => not (x < y) => x = y
Goal lt_impl_le :
x < y => x <= y
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: x,y:'a
----------------------------------------
x < y => x <= y

[> Line 580: by (rewrite) [goal> lemma lt_impl_le is proved

lemma lt_impl_le {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (x,y:'a), x < y => x <= y
Exiting proof mode.

Goal not_lt_refl :
not (x < x)
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: x:'a
----------------------------------------
not (x < x)

[> Line 583: (auto) [goal> lemma not_lt_refl is proved

lemma not_lt_refl {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (x:'a), not (x < x)
Exiting proof mode.

Goal lt_irrefl :
x < x <=> false
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Type variables: 'a
Variables: x:'a
----------------------------------------
x < x <=> false

[> Line 586: (auto) [goal> lemma lt_irrefl is proved

lemma lt_irrefl {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (x:'a), x < x <=> false
Exiting proof mode.

axiom le_impl_eq_lt {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (x,y:'a), x <= y => x = y || x < y
axiom le_refl_index {'P:system} @system:(set:'P; equiv:None) :
forall (x:index), x <= x
Goal le_refl_index_eq :
x <= x = true
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: x:index
----------------------------------------
x <= x = true

[> Line 599: by (rewrite) [goal> lemma le_refl_index_eq is proved

lemma le_refl_index_eq {'P:system} @system:(set:'P; equiv:None) :
forall (x:index), x <= x = true
Exiting proof mode.

Goal le_pred_lt :
t <= pred t' = t < t'
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: t,t':timestamp
----------------------------------------
t <= pred t' = t < t'

[> Line 603: by (rewrite) [goal> lemma le_pred_lt is proved

lemma le_pred_lt {'P:system} @system:(set:'P; equiv:None) :
forall (t,t':timestamp), t <= pred t' = t < t'
Exiting proof mode.

Goal neq_le_pred_le :
t <> t' => t <= t' = t <= pred t'
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: t,t':timestamp
----------------------------------------
t <> t' => t <= t' = t <= pred t'

[> Line 607: by (rewrite) [goal> lemma neq_le_pred_le is proved

lemma neq_le_pred_le {'P:system} @system:(set:'P; equiv:None) :
forall (t,t':timestamp), t <> t' => t <= t' = t <= pred t'
Exiting proof mode.

axiom le_lt {'P:system} @system:(set:'P; equiv:None) ['a] :
forall (x,x':'a), x <> x' => x <= x' = x < x'
[warning>Loaded "Logic.sp".
<]axiom empty_set_is_empty {'P:system} @system:(set:'P; equiv:None) :
forall (x:message), not (mem x empty_set)
[warning>Loaded "Set.sp".
<]new predicate:
predicate (|>) {set:system} ['a 'b] {set: u:'a,m:'b} =
Exists (f:'a -> 'b[adv, glob]), [f u = m]
new predicate:
predicate (|1>) {set:system} ['a 'b 'c] {set: u:'a -> 'b,m:'a -> 'c} =
Exists (f:'b -> 'c[adv, glob]), [forall (x:'a), f (u x) = m x]
[warning>Loaded "DeductionSyntax.sp".
<]Goal unnamed1 :
forall u:'b[glob],v:'a -> 'c[glob],
Let u0 = fun (_x:'a) => u in
$(u0 |1>{Empty} fun (x:'a) => v x) -> $(u |>{Empty} fun (x:'a) => v x)
[goal> Focused goal (1/1):
Systems: Empty
Type variables: 'a, 'b, 'c
Variables: u:'b[glob],v:'a -> 'c[glob]
----------------------------------------
Let u0 = fun (_x:'a) => u in
$(u0 |1> fun (x:'a) => v x) -> $(u |> fun (x:'a) => v x)

[> Line 11: (intro) [goal> Focused goal (1/1):
Systems: Empty
Type variables: 'a, 'b, 'c
Variables: u:'b[glob],v:'a -> 'c[glob]
H: $(u0 |1> fun (x:'a) => v x)
u0 := fun (_x:'a) => u
----------------------------------------
$(u |> fun (x:'a) => v x)

[> Line 12: (rewrite) [goal> Focused goal (1/1):
Systems: Empty
Type variables: 'a, 'b, 'c
Variables: u:'b[glob],v:'a -> 'c[glob]
H: $(u0 |1> fun (x:'a) => v x)
u0 := fun (_x:'a) => u
----------------------------------------
Exists (f:'b -> 'a -> 'c[adv, glob]), [f u = (fun (x:'a) => v x)]

[> Line 13: (rewrite) [goal> Focused goal (1/1):
Systems: Empty
Type variables: 'a, 'b, 'c
Variables: u:'b[glob],v:'a -> 'c[glob]
H: Exists (f:'b -> 'c[adv, glob]),
[forall (x:'a), f (u0 x) = (fun (x:'a) => v x) x]
u0 := fun (_x:'a) => u
----------------------------------------
Exists (f:'b -> 'a -> 'c[adv, glob]), [f u = (fun (x:'a) => v x)]

[> Line 14: (destruct) [goal> Focused goal (1/1):
Systems: Empty
Type variables: 'a, 'b, 'c
Variables: f:'b -> 'c[adv, glob],u:'b[glob],v:'a -> 'c[glob]
H: [forall (x:'a), f (u0 x) = (fun (x:'a) => v x) x]
u0 := fun (_x:'a) => u
----------------------------------------
Exists (f:'b -> 'a -> 'c[adv, glob]), [f u = (fun (x:'a) => v x)]

[> Line 14: ((exists);(intro)) [goal> Focused goal (1/1):
System: Empty
Type variables: 'a, 'b, 'c
Variables: f:'b -> 'c[adv, glob],u:'b[glob],v:'a -> 'c[glob]
H: [forall (x:'a), f (u0 x) = v x]
u0 := fun (_x:'a) => u
----------------------------------------
(fun (x:'a) => f u) = (fun (x:'a) => v x)

[> Line 16: ((apply);(intro)) [goal> Focused goal (1/1):
System: Empty
Type variables: 'a, 'b, 'c
Variables: f:'b -> 'c[adv, glob],u:'b[glob],v:'a -> 'c[glob],x:'a
H: [forall (x:'a), f (u0 x) = v x]
u0 := fun (_x:'a) => u
----------------------------------------
f u = v x

[> Line 17: (rewrite) [goal> Focused goal (1/1):
System: Empty
Type variables: 'a, 'b, 'c
Variables: f:'b -> 'c[adv, glob],u:'b[glob],v:'a -> 'c[glob],x:'a
H: [forall (x:'a), f u = v x]
u0 := fun (_x:'a) => u
----------------------------------------
f u = v x

[> Line 18: (apply) [goal> lemma unnamed1 is proved

global lemma unnamed1 @system:Empty ['a 'b 'c] :
Forall (u:'b[glob],v:'a -> 'c[glob]),
Let u0 = fun (_x:'a) => u in
$(u0 |1>{Empty} fun (x:'a) => v x) -> $(u |>{Empty} fun (x:'a) => v x)
Exiting proof mode.

global axiom frame_from_frame {P:system} @system:(set:P; equiv:None) :
$(fun (t:timestamp) => frame@t |1>{P}
fun (t,t':timestamp) => if (t' <= t) then frame@t')
New deduction hint frame_from_frame :
∀{P:system} , @system:(P), ∀ x ⊢ frame@x ▷ λ t' ⇒ (frame@t' |
t' <= x)
global axiom exec_from_frame {P:system} @system:(set:P; equiv:None) :
$(fun (t:timestamp) => frame@t |1>{P}
fun (t,t':timestamp) => if (t' <= t) then exec@t' else witness)
New deduction hint exec_from_frame :
∀{P:system} , @system:(P), ∀ x ⊢ frame@x ▷ λ t' ⇒ (exec@t' |
t' <= x)
global axiom output_from_frame {P:system} @system:(set:P; equiv:None) :
$(fun (t:timestamp) => frame@t |1>{P}
fun (t,t':timestamp) => if (t' <= t && exec@t') then output@t')
New deduction hint output_from_frame :
∀{P:system} , @system:(P), ∀ x ⊢ frame@x ▷ λ t' ⇒ (output@t' |
t' <= x && exec@t')
global axiom input_from_frame {P:system} @system:(set:P; equiv:None) :
$(fun (t:timestamp) => frame@t |1>{P}
fun (t,t':timestamp) => if (pred t' <= t) then input@t')
New deduction hint input_from_frame :
∀{P:system} , @system:(P), ∀ x ⊢ frame@x ▷ λ t' ⇒ (input@t' |
pred t' <= x)
global axiom exec_from_frame {P:system} @system:(set:P; equiv:None) :
$(fun (t:timestamp) => frame@t |1>{P}
fun (t,t':timestamp) => if (t' <= t) then exec@t' else witness)
New deduction hint exec_from_frame :
∀{P:system} , @system:(P), ∀ x ⊢ frame@x ▷ λ t' ⇒ (exec@t' |
t' <= x)
global axiom output_from_frame {P:system} @system:(set:P; equiv:None) :
$(fun (t:timestamp) => frame@t |1>{P}
fun (t,t':timestamp) => if (t' <= t && exec@t') then output@t')
New deduction hint output_from_frame :
∀{P:system} , @system:(P), ∀ x ⊢ frame@x ▷ λ t' ⇒ (output@t' |
t' <= x && exec@t')
global axiom input_from_frame {P:system} @system:(set:P; equiv:None) :
$(fun (t:timestamp) => frame@t |1>{P}
fun (t,t':timestamp) => if (pred t' <= t) then input@t')
New deduction hint input_from_frame :
∀{P:system} , @system:(P), ∀ x ⊢ frame@x ▷ λ t' ⇒ (input@t' |
pred t' <= x)
global axiom transcript_from_frame {P:system} @system:(set:P; equiv:None) :
$(fun (t:timestamp) => frame@t |1>{P}
fun (t,t':timestamp) => if (t' <= t) then transcript@t')
New deduction hint transcript_from_frame :
∀{P:system} , @system:(P), ∀ x ⊢ frame@x ▷ λ t' ⇒ (transcript@t' |
t' <= x)
global axiom transcript_from_transcript {P:system}
@system:(set:P; equiv:None) :
$(fun (t:timestamp) => transcript@t |1>{P}
fun (t,t':timestamp) => if (t' <= t) then transcript@t')
New deduction hint transcript_from_transcript :
∀{P:system} , @system:(P), ∀ x ⊢ transcript@x ▷ λ t' ⇒ (
transcript@t' |
t' <= x)
global axiom exec_from_transcript {P:system} @system:(set:P; equiv:None) :
$(fun (t:timestamp) => transcript@t |1>{P}
fun (t,t':timestamp) => if (t' <= t) then exec@t' else witness)
New deduction hint exec_from_transcript :
∀{P:system} , @system:(P), ∀ x ⊢ transcript@x ▷ λ t' ⇒ (
exec@t' | t' <= x)
global axiom output_from_transcript {P:system} @system:(set:P; equiv:None) :
$(fun (t:timestamp) => transcript@t |1>{P}
fun (t,t':timestamp) => if (t' <= t && exec@t') then output@t')
New deduction hint output_from_transcript :
∀{P:system} , @system:(P), ∀ x ⊢ transcript@x ▷ λ t' ⇒ (
output@t' |
t' <= x && exec@t')
global axiom input_from_transcript {P:system} @system:(set:P; equiv:None) :
$(fun (t:timestamp) => transcript@t |1>{P}
fun (t,t':timestamp) => if (pred t' <= t) then input@t')
New deduction hint input_from_transcript :
∀{P:system} , @system:(P), ∀ x ⊢ transcript@x ▷ λ t' ⇒ (
input@t' |
pred t' <= x)
[warning>Loaded "Deduction.sp".
<]axiom exec_not_init {'P:system} @system:(set:'P; equiv:None) :
forall (tau:timestamp),
init < tau => exec@tau = (exec@pred tau && cond@tau)
axiom exec_init {'P:system} @system:(set:'P; equiv:None) :
forall (tau:timestamp), tau = init => exec@tau = true
axiom cond_init {'P:system} @system:(set:'P; equiv:None) :
forall (tau:timestamp), tau = init => cond@tau = true
Goal exec_le :
tau' <= tau => exec@tau => exec@tau'
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: tau,tau':timestamp
----------------------------------------
tau' <= tau => exec@tau => exec@tau'

[> Line 17: ((induction);(intro)) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: tau,tau':timestamp[const]
Hexec: exec@tau
Hle: tau' <= tau
IH: forall (tau0:timestamp),
tau0 < tau => tau' <= tau0 => exec@tau0 => exec@tau'
----------------------------------------
exec@tau'

[> Line 18: (case) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Variables: tau,tau':timestamp[const]
Hexec: exec@tau
Hle: tau' <= tau
IH: forall (tau0:timestamp),
tau0 < tau => tau' <= tau0 => exec@tau0 => exec@tau'
----------------------------------------
tau = tau' => exec@tau'

[> Line 19: (auto) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: tau,tau':timestamp[const]
Hexec: exec@tau
Hle: tau' <= tau
IH: forall (tau0:timestamp),
tau0 < tau => tau' <= tau0 => exec@tau0 => exec@tau'
----------------------------------------
not (tau = tau') => exec@tau'

[> Line 20: (intro) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: tau,tau':timestamp[const]
Hexec: exec@tau
Hle: tau' <= tau
Hneq: not (tau = tau')
IH: forall (tau0:timestamp),
tau0 < tau => tau' <= tau0 => exec@tau0 => exec@tau'
----------------------------------------
exec@tau'

[> Line 21: (rewrite) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: tau,tau':timestamp[const]
Hexec: exec@pred tau && cond@tau
Hle: tau' <= tau
Hneq: not (tau = tau')
IH: forall (tau0:timestamp),
tau0 < tau => tau' <= tau0 => exec@tau0 => exec@tau'
----------------------------------------
exec@tau'

[> Line 22: by (apply) [goal> lemma exec_le is proved

lemma exec_le {'P:system} @system:(set:'P; equiv:None) :
forall (tau,tau':timestamp), tau' <= tau => exec@tau => exec@tau'
Exiting proof mode.

Goal exec_cond :
happens(tau) => exec@tau => cond@tau
[goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: tau:timestamp
----------------------------------------
happens(tau) => exec@tau => cond@tau

[> Line 27: (intro) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: tau:timestamp[const]
Hap: happens(tau)
Hexec: exec@tau
----------------------------------------
cond@tau

[> Line 28: ((case);(intro)) [goal> Focused goal (1/2):
System variables: 'P
System: (set:'P; equiv:None)
Variables: tau:timestamp[const]
Hap: happens(tau)
Hexec: exec@tau
_: init < tau
----------------------------------------
cond@tau

[> Line 29: by (rewrite) [goal> Focused goal (1/1):
System variables: 'P
System: (set:'P; equiv:None)
Variables: tau:timestamp[const]
Hap: happens(tau)
Hexec: exec@tau
_: not (init < tau)
----------------------------------------
cond@tau

[> Line 30: by (rewrite) [goal> lemma exec_cond is proved

lemma exec_cond {'P:system} @system:(set:'P; equiv:None) :
forall (tau:timestamp), happens(tau) => exec@tau => cond@tau
Exiting proof mode.

axiom executability {'P:system} @system:(set:'P; equiv:None) :
forall (t:timestamp),
happens(t) => exec@t => forall (t0:timestamp), t0 <= t => exec@t0
[warning>Loaded "Classic.sp".
<][warning>Loaded "Core.sp".
<]


(* f_apply *)

lemma fst_apply (x,y : message) : x = y => fst(x) = fst(y).
Goal fst_apply :
x = y => fst x = fst y

Proof.
[goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: x,y:message
----------------------------------------
x = y => fst x = fst y

auto. [> Line 86: (auto) [goal> lemma fst_apply is proved

Qed. lemma fst_apply @system:(set:default; equiv:None) :
forall (x,y:message), x = y => fst x = fst y
Exiting proof mode.



lemma snd_apply (x,y : message) : x = y => snd(x) = snd(y).
Goal snd_apply :
x = y => snd x = snd y

Proof.
[goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: x,y:message
----------------------------------------
x = y => snd x = snd y

auto. [> Line 89: (auto) [goal> lemma snd_apply is proved

Qed. lemma snd_apply @system:(set:default; equiv:None) :
forall (x,y:message), x = y => snd x = snd y
Exiting proof mode.



(* AXIOMS *)

axiom orderSucc (n,n':message): n = n' => n ~< mySucc(n').
axiom orderSucc @system:(set:default; equiv:None) :
forall (n,n':message), n = n' => n ~< mySucc n'


axiom orderTrans (n1,n2,n3:message): (n1 ~< n2 && n2 ~< n3) => n1 ~< n3.
axiom orderTrans @system:(set:default; equiv:None) :
forall (n1,n2,n3:message), n1 ~< n2 && n2 ~< n3 => n1 ~< n3


axiom orderStrict (n1,n2:message): n1 = n2 => n1 ~< n2 => false.
axiom orderStrict @system:(set:default; equiv:None) :
forall (n1,n2:message), n1 = n2 => n1 ~< n2 => false


axiom orderEqSucc (n1,n2:message):
(n1 ~< mySucc(n2)) => ((n1 = n2) || n1 ~< n2).
axiom orderEqSucc @system:(set:default; equiv:None) :
forall (n1,n2:message), n1 ~< mySucc n2 => n1 = n2 || n1 ~< n2



(* HELPING LEMMAS *)

lemma orderBetween (n1,n2:message) :
(n1 ~< n2) => (n2 ~< mySucc(n1)) => false.
Goal orderBetween :
n1 ~< n2 => n2 ~< mySucc n1 => false

Proof.
[goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: n1,n2:message
----------------------------------------
n1 ~< n2 => n2 ~< mySucc n1 => false


intro Ord1 Ord2.
[> Line 108: (intro) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: n1,n2:message
Ord1: n1 ~< n2
Ord2: n2 ~< mySucc n1
----------------------------------------
false


use orderEqSucc with n2, n1 => //.
[> Line 110: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: n1,n2:message
H: n2 = n1 || n2 ~< n1
Ord1: n1 ~< n2
Ord2: n2 ~< mySucc n1
----------------------------------------
false


case H.
[> Line 110: (case) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: n1,n2:message
H: n2 = n1
Ord1: n1 ~< n2
Ord2: n2 ~< mySucc n1
----------------------------------------
false


+ by apply orderStrict in Ord1.
[> Line 111: by (apply) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: n1,n2:message
H: n2 ~< n1
Ord1: n1 ~< n2
Ord2: n2 ~< mySucc n1
----------------------------------------
false


+ use orderTrans with n1, n2, n1 => //.
[> Line 112: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: n1,n2:message
H: n2 ~< n1
H0: n1 ~< n1
Ord1: n1 ~< n2
Ord2: n2 ~< mySucc n1
----------------------------------------
false


by apply orderStrict in H0.
[> Line 113: by (apply) [goal> lemma orderBetween is proved


Qed.
lemma orderBetween @system:(set:default; equiv:None) :
forall (n1,n2:message), n1 ~< n2 => n2 ~< mySucc n1 => false
Exiting proof mode.




(* The counter cellA(i) strictly increases
at each action SenderA(i,j) / ReceiverA(i,j). *)

lemma counterIncreaseUpdateSA(i,j:index):
happens(SenderA(i,j)) =>
cond@SenderA(i,j) =>
cellA(i)@pred(SenderA(i,j)) ~< cellA(i)@SenderA(i,j).
Goal counterIncreaseUpdateSA :
happens(SenderA(i, j)) =>
cond@SenderA(i, j) => cellA i@pred (SenderA(i, j)) ~< cellA i@SenderA(i, j)

Proof.
[goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j:index
----------------------------------------
happens(SenderA(i, j)) =>
cond@SenderA(i, j) => cellA i@pred (SenderA(i, j)) ~< cellA i@SenderA(i, j)


intro Hap Hcond @/cellA.
[> Line 126: (intro) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j:index[const]
Hap: happens(SenderA(i, j))
Hcond: cond@SenderA(i, j)
----------------------------------------
cellA i@pred (SenderA(i, j)) ~< mySucc (cellA i@pred (SenderA(i, j)))


by apply orderSucc.
[> Line 127: by (apply) [goal> lemma counterIncreaseUpdateSA is proved


Qed.
lemma counterIncreaseUpdateSA @system:(set:default; equiv:None) :
forall (i,j:index),
happens(SenderA(i, j)) =>
cond@SenderA(i, j) =>
cellA i@pred (SenderA(i, j)) ~< cellA i@SenderA(i, j)
Exiting proof mode.



lemma counterIncreaseUpdateRA(i,j:index):
happens(ReceiverA(i,j)) =>
cond@ReceiverA(i,j) =>
cellA(i)@pred(ReceiverA(i,j)) ~< cellA(i)@ReceiverA(i,j).
Goal counterIncreaseUpdateRA :
happens(ReceiverA(i, j)) =>
cond@ReceiverA(i, j) =>
cellA i@pred (ReceiverA(i, j)) ~< cellA i@ReceiverA(i, j)

Proof.
[goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j:index
----------------------------------------
happens(ReceiverA(i, j)) =>
cond@ReceiverA(i, j) =>
cellA i@pred (ReceiverA(i, j)) ~< cellA i@ReceiverA(i, j)


intro Hap Hcond @/cellA.
[> Line 135: (intro) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j:index[const]
Hap: happens(ReceiverA(i, j))
Hcond: cond@ReceiverA(i, j)
----------------------------------------
cellA i@pred (ReceiverA(i, j)) ~< mySucc (cellA i@pred (ReceiverA(i, j)))


by apply orderSucc.
[> Line 136: by (apply) [goal> lemma counterIncreaseUpdateRA is proved


Qed.
lemma counterIncreaseUpdateRA @system:(set:default; equiv:None) :
forall (i,j:index),
happens(ReceiverA(i, j)) =>
cond@ReceiverA(i, j) =>
cellA i@pred (ReceiverA(i, j)) ~< cellA i@ReceiverA(i, j)
Exiting proof mode.




(* The counter cellB(i) strictly increases
at each action SenderB(i,j) / ReceiveB(i,j). *)

lemma counterIncreaseUpdateSB(i,j:index):
happens(SenderB(i,j)) =>
cond@SenderB(i,j) =>
cellB(i)@pred(SenderB(i,j)) ~< cellB(i)@SenderB(i,j).
Goal counterIncreaseUpdateSB :
happens(SenderB(i, j)) =>
cond@SenderB(i, j) => cellB i@pred (SenderB(i, j)) ~< cellB i@SenderB(i, j)

Proof.
[goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j:index
----------------------------------------
happens(SenderB(i, j)) =>
cond@SenderB(i, j) => cellB i@pred (SenderB(i, j)) ~< cellB i@SenderB(i, j)


intro Hap Hcond @/cellB.
[> Line 148: (intro) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j:index[const]
Hap: happens(SenderB(i, j))
Hcond: cond@SenderB(i, j)
----------------------------------------
cellB i@pred (SenderB(i, j)) ~< mySucc (cellB i@pred (SenderB(i, j)))


by apply orderSucc.
[> Line 148: by (apply) [goal> lemma counterIncreaseUpdateSB is proved


Qed.
lemma counterIncreaseUpdateSB @system:(set:default; equiv:None) :
forall (i,j:index),
happens(SenderB(i, j)) =>
cond@SenderB(i, j) =>
cellB i@pred (SenderB(i, j)) ~< cellB i@SenderB(i, j)
Exiting proof mode.



lemma counterIncreaseUpdateRB(i,j:index):
happens(ReceiverB(i,j)) =>
cond@ReceiverB(i,j) =>
cellB(i)@pred(ReceiverB(i,j)) ~< cellB(i)@ReceiverB(i,j).
Goal counterIncreaseUpdateRB :
happens(ReceiverB(i, j)) =>
cond@ReceiverB(i, j) =>
cellB i@pred (ReceiverB(i, j)) ~< cellB i@ReceiverB(i, j)

Proof.
[goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j:index
----------------------------------------
happens(ReceiverB(i, j)) =>
cond@ReceiverB(i, j) =>
cellB i@pred (ReceiverB(i, j)) ~< cellB i@ReceiverB(i, j)


intro Hap Hcond @/cellB.
[> Line 157: (intro) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j:index[const]
Hap: happens(ReceiverB(i, j))
Hcond: cond@ReceiverB(i, j)
----------------------------------------
cellB i@pred (ReceiverB(i, j)) ~< mySucc (cellB i@pred (ReceiverB(i, j)))


by apply orderSucc.
[> Line 157: by (apply) [goal> lemma counterIncreaseUpdateRB is proved


Qed.
lemma counterIncreaseUpdateRB @system:(set:default; equiv:None) :
forall (i,j:index),
happens(ReceiverB(i, j)) =>
cond@ReceiverB(i, j) =>
cellB i@pred (ReceiverB(i, j)) ~< cellB i@ReceiverB(i, j)
Exiting proof mode.




(* The counter cellB(i) at t is either equal to cellB(i)@pred(t) or +1,
and similarly for cellA(i). *)

lemma ScounterIncreasePredB(t:timestamp, i:index):
happens(t) =>
t > init =>
exec@t =>
(cellB(i)@t = mySucc(cellB(i)@pred(t)) || cellB(i)@t= cellB(i)@pred(t)).
Goal ScounterIncreasePredB :
happens(t) =>
t > init =>
exec@t => cellB i@t = mySucc (cellB i@pred t) || cellB i@t = cellB i@pred t

Proof.
[goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index,t:timestamp
----------------------------------------
happens(t) =>
t > init =>
exec@t => cellB i@t = mySucc (cellB i@pred t) || cellB i@t = cellB i@pred t


intro Hap Ht Hexec.
[> Line 171: (intro) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
----------------------------------------
cellB i@t = mySucc (cellB i@pred t) || cellB i@t = cellB i@pred t


case t => // [i0 j _].
[> Line 171: ((case);(intro)) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,i0,j:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
_: t = ReceiverB(i0, j)
----------------------------------------
cellB i@t = mySucc (cellB i@pred t) || cellB i@t = cellB i@pred t


(* Receiver *)
+ case (i = i0) => _.
[> Line 173: ((case);(intro)) [goal> Focused goal (1/3):
System: (set:default; equiv:None)
Variables: i,i0,j:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
_: i = i0
_: t = ReceiverB(i0, j)
----------------------------------------
cellB i@t = mySucc (cellB i@pred t) || cellB i@t = cellB i@pred t


- left.
[> Line 175: (left) [goal> Focused goal (1/3):
System: (set:default; equiv:None)
Variables: i,i0,j:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
_: i = i0
_: t = ReceiverB(i0, j)
----------------------------------------
cellB i@t = mySucc (cellB i@pred t)


by rewrite /cellB if_true.
[> Line 175: by (rewrite) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,i0,j:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
_: not (i = i0)
_: t = ReceiverB(i0, j)
----------------------------------------
cellB i@t = mySucc (cellB i@pred t) || cellB i@t = cellB i@pred t


- right.
[> Line 176: (right) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,i0,j:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
_: not (i = i0)
_: t = ReceiverB(i0, j)
----------------------------------------
cellB i@t = cellB i@pred t


by rewrite /cellB if_false.
[> Line 177: by (rewrite) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,i0,j:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
_: t = SenderB(i0, j)
----------------------------------------
cellB i@t = mySucc (cellB i@pred t) || cellB i@t = cellB i@pred t


(* Sender *)
+ case (i = i0) => _.
[> Line 179: ((case);(intro)) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,i0,j:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
_: i = i0
_: t = SenderB(i0, j)
----------------------------------------
cellB i@t = mySucc (cellB i@pred t) || cellB i@t = cellB i@pred t


- left.
[> Line 180: (left) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,i0,j:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
_: i = i0
_: t = SenderB(i0, j)
----------------------------------------
cellB i@t = mySucc (cellB i@pred t)


by rewrite /cellB if_true.
[> Line 181: by (rewrite) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,i0,j:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
_: not (i = i0)
_: t = SenderB(i0, j)
----------------------------------------
cellB i@t = mySucc (cellB i@pred t) || cellB i@t = cellB i@pred t


- right.
[> Line 182: (right) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,i0,j:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
_: not (i = i0)
_: t = SenderB(i0, j)
----------------------------------------
cellB i@t = cellB i@pred t


by rewrite /cellB if_false.
[> Line 183: by (rewrite) [goal> lemma ScounterIncreasePredB is proved


Qed.
lemma ScounterIncreasePredB @system:(set:default; equiv:None) :
forall (t:timestamp,i:index),
happens(t) =>
t > init =>
exec@t =>
cellB i@t = mySucc (cellB i@pred t) || cellB i@t = cellB i@pred t
Exiting proof mode.




lemma ScounterIncreasePredA(t:timestamp, i:index):
happens(t) =>
t > init =>
exec@t =>
(cellA(i)@t = mySucc(cellA(i)@pred(t)) || cellA(i)@t= cellA(i)@pred(t)).
Goal ScounterIncreasePredA :
happens(t) =>
t > init =>
exec@t => cellA i@t = mySucc (cellA i@pred t) || cellA i@t = cellA i@pred t

Proof.
[goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index,t:timestamp
----------------------------------------
happens(t) =>
t > init =>
exec@t => cellA i@t = mySucc (cellA i@pred t) || cellA i@t = cellA i@pred t


intro Hap Ht Hexec.
[> Line 194: (intro) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
----------------------------------------
cellA i@t = mySucc (cellA i@pred t) || cellA i@t = cellA i@pred t


case t => // [i0 j _].
[> Line 195: ((case);(intro)) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,i0,j:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
_: t = ReceiverA(i0, j)
----------------------------------------
cellA i@t = mySucc (cellA i@pred t) || cellA i@t = cellA i@pred t


(* Receiver *)
+ case (i = i0) => _.
[> Line 197: ((case);(intro)) [goal> Focused goal (1/3):
System: (set:default; equiv:None)
Variables: i,i0,j:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
_: i = i0
_: t = ReceiverA(i0, j)
----------------------------------------
cellA i@t = mySucc (cellA i@pred t) || cellA i@t = cellA i@pred t


- left.
[> Line 198: (left) [goal> Focused goal (1/3):
System: (set:default; equiv:None)
Variables: i,i0,j:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
_: i = i0
_: t = ReceiverA(i0, j)
----------------------------------------
cellA i@t = mySucc (cellA i@pred t)


by rewrite /cellA if_true.
[> Line 198: by (rewrite) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,i0,j:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
_: not (i = i0)
_: t = ReceiverA(i0, j)
----------------------------------------
cellA i@t = mySucc (cellA i@pred t) || cellA i@t = cellA i@pred t


- right.
[> Line 199: (right) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,i0,j:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
_: not (i = i0)
_: t = ReceiverA(i0, j)
----------------------------------------
cellA i@t = cellA i@pred t


by rewrite /cellA if_false.
[> Line 200: by (rewrite) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,i0,j:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
_: t = SenderA(i0, j)
----------------------------------------
cellA i@t = mySucc (cellA i@pred t) || cellA i@t = cellA i@pred t


(* Sender *)
+ case (i = i0) => _.
[> Line 203: ((case);(intro)) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,i0,j:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
_: i = i0
_: t = SenderA(i0, j)
----------------------------------------
cellA i@t = mySucc (cellA i@pred t) || cellA i@t = cellA i@pred t


- left.
[> Line 203: (left) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,i0,j:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
_: i = i0
_: t = SenderA(i0, j)
----------------------------------------
cellA i@t = mySucc (cellA i@pred t)


by rewrite /cellA if_true.
[> Line 204: by (rewrite) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,i0,j:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
_: not (i = i0)
_: t = SenderA(i0, j)
----------------------------------------
cellA i@t = mySucc (cellA i@pred t) || cellA i@t = cellA i@pred t


- right.
[> Line 205: (right) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,i0,j:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
_: not (i = i0)
_: t = SenderA(i0, j)
----------------------------------------
cellA i@t = cellA i@pred t


by rewrite /cellA if_false.
[> Line 206: by (rewrite) [goal> lemma ScounterIncreasePredA is proved


Qed.
lemma ScounterIncreasePredA @system:(set:default; equiv:None) :
forall (t:timestamp,i:index),
happens(t) =>
t > init =>
exec@t =>
cellA i@t = mySucc (cellA i@pred t) || cellA i@t = cellA i@pred t
Exiting proof mode.




(* The counter increases (not strictly) between t and pred(t). *)

lemma counterIncreasePredA(t:timestamp, i:index):
happens(t) => (t > init && exec@t) =>
( cellA(i)@pred(t) ~< cellA(i)@t
|| cellA(i)@pred(t) = cellA(i)@t ).
Goal counterIncreasePredA :
happens(t) =>
t > init && exec@t =>
cellA i@pred t ~< cellA i@t || cellA i@pred t = cellA i@t

Proof.
[goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index,t:timestamp
----------------------------------------
happens(t) =>
t > init && exec@t =>
cellA i@pred t ~< cellA i@t || cellA i@pred t = cellA i@t


intro Hap [Ht Hexec].
[> Line 218: (intro) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
----------------------------------------
cellA i@pred t ~< cellA i@t || cellA i@pred t = cellA i@t


use ScounterIncreasePredA with t, i => //.
[> Line 219: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index[const],t:timestamp[const]
H: cellA i@t = mySucc (cellA i@pred t) || cellA i@t = cellA i@pred t
Hap: happens(t)
Hexec: exec@t
Ht: t > init
----------------------------------------
cellA i@pred t ~< cellA i@t || cellA i@pred t = cellA i@t


case H.
[> Line 220: (case) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i:index[const],t:timestamp[const]
H: cellA i@t = mySucc (cellA i@pred t)
Hap: happens(t)
Hexec: exec@t
Ht: t > init
----------------------------------------
cellA i@pred t ~< cellA i@t || cellA i@pred t = cellA i@t


+ by left; rewrite H; apply orderSucc.
[> Line 221: by ((left);((rewrite);(apply))) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index[const],t:timestamp[const]
H: cellA i@t = cellA i@pred t
Hap: happens(t)
Hexec: exec@t
Ht: t > init
----------------------------------------
cellA i@pred t ~< cellA i@t || cellA i@pred t = cellA i@t


+ by right.
[> Line 222: by (right) [goal> lemma counterIncreasePredA is proved


Qed.
lemma counterIncreasePredA @system:(set:default; equiv:None) :
forall (t:timestamp,i:index),
happens(t) =>
t > init && exec@t =>
cellA i@pred t ~< cellA i@t || cellA i@pred t = cellA i@t
Exiting proof mode.




lemma counterIncreasePredB(t:timestamp, i:index):
happens(t) => (t > init && exec@t) =>
( cellB(i)@pred(t) ~< cellB(i)@t
|| cellB(i)@pred(t) = cellB(i)@t ).
Goal counterIncreasePredB :
happens(t) =>
t > init && exec@t =>
cellB i@pred t ~< cellB i@t || cellB i@pred t = cellB i@t

Proof.
[goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index,t:timestamp
----------------------------------------
happens(t) =>
t > init && exec@t =>
cellB i@pred t ~< cellB i@t || cellB i@pred t = cellB i@t


intro Hap [Ht Hexec].
[> Line 231: (intro) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index[const],t:timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht: t > init
----------------------------------------
cellB i@pred t ~< cellB i@t || cellB i@pred t = cellB i@t


use ScounterIncreasePredB with t, i => //.
[> Line 231: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index[const],t:timestamp[const]
H: cellB i@t = mySucc (cellB i@pred t) || cellB i@t = cellB i@pred t
Hap: happens(t)
Hexec: exec@t
Ht: t > init
----------------------------------------
cellB i@pred t ~< cellB i@t || cellB i@pred t = cellB i@t


case H.
[> Line 232: (case) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i:index[const],t:timestamp[const]
H: cellB i@t = mySucc (cellB i@pred t)
Hap: happens(t)
Hexec: exec@t
Ht: t > init
----------------------------------------
cellB i@pred t ~< cellB i@t || cellB i@pred t = cellB i@t


+ by left; rewrite H; apply orderSucc.
[> Line 234: by ((left);((rewrite);(apply))) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index[const],t:timestamp[const]
H: cellB i@t = cellB i@pred t
Hap: happens(t)
Hexec: exec@t
Ht: t > init
----------------------------------------
cellB i@pred t ~< cellB i@t || cellB i@pred t = cellB i@t


+ by right.
[> Line 234: by (right) [goal> lemma counterIncreasePredB is proved


Qed.
lemma counterIncreasePredB @system:(set:default; equiv:None) :
forall (t:timestamp,i:index),
happens(t) =>
t > init && exec@t =>
cellB i@pred t ~< cellB i@t || cellB i@pred t = cellB i@t
Exiting proof mode.



(* The counter increases (not strictly) between t' and t when t' < t. *)

lemma counterIncreaseA (t, t':timestamp, i:index):
happens(t) =>
exec@t =>
t' < t =>
( cellA(i)@t' ~< cellA(i)@t ||
cellA(i)@t' = cellA(i)@t).
Goal counterIncreaseA :
happens(t) =>
exec@t => t' < t => cellA i@t' ~< cellA i@t || cellA i@t' = cellA i@t

Proof.
[goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index,t,t':timestamp
----------------------------------------
happens(t) =>
exec@t => t' < t => cellA i@t' ~< cellA i@t || cellA i@t' = cellA i@t


induction t => t IH0 Hap Hexec Ht'.
[> Line 247: ((induction);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index[const],t,t':timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht': t' < t
IH0: forall (t0:timestamp),
t0 < t =>
happens(t0) =>
exec@t0 =>
t' < t0 => cellA i@t' ~< cellA i@t0 || cellA i@t' = cellA i@t0
----------------------------------------
cellA i@t' ~< cellA i@t || cellA i@t' = cellA i@t


assert (t' = pred(t) || t' < pred(t)) as H0;
1: case t; constraints.
[> Line 249: ((have); 1: ((case);(constraints))) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index[const],t,t':timestamp[const]
H0: t' = pred t || t' < pred t
Hap: happens(t)
Hexec: exec@t
Ht': t' < t
IH0: forall (t0:timestamp),
t0 < t =>
happens(t0) =>
exec@t0 =>
t' < t0 => cellA i@t' ~< cellA i@t0 || cellA i@t' = cellA i@t0
----------------------------------------
cellA i@t' ~< cellA i@t || cellA i@t' = cellA i@t


case H0.
[> Line 250: (case) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i:index[const],t,t':timestamp[const]
H0: t' = pred t
Hap: happens(t)
Hexec: exec@t
Ht': t' < t
IH0: forall (t0:timestamp),
t0 < t =>
happens(t0) =>
exec@t0 =>
t' < t0 => cellA i@t' ~< cellA i@t0 || cellA i@t' = cellA i@t0
----------------------------------------
cellA i@t' ~< cellA i@t || cellA i@t' = cellA i@t



+ (* case t' = pred(t) *)
rewrite !H0.
[> Line 253: (rewrite) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i:index[const],t,t':timestamp[const]
H0: t' = pred t
Hap: happens(t)
Hexec: exec@t
Ht': t' < t
IH0: forall (t0:timestamp),
t0 < t =>
happens(t0) =>
exec@t0 =>
t' < t0 => cellA i@t' ~< cellA i@t0 || cellA i@t' = cellA i@t0
----------------------------------------
cellA i@pred t ~< cellA i@t || cellA i@pred t = cellA i@t


by apply counterIncreasePredA.
[> Line 254: by (apply) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index[const],t,t':timestamp[const]
H0: t' < pred t
Hap: happens(t)
Hexec: exec@t
Ht': t' < t
IH0: forall (t0:timestamp),
t0 < t =>
happens(t0) =>
exec@t0 =>
t' < t0 => cellA i@t' ~< cellA i@t0 || cellA i@t' = cellA i@t0
----------------------------------------
cellA i@t' ~< cellA i@t || cellA i@t' = cellA i@t



+ (* case t' < pred(t) *)
apply IH0 in H0 => //=.
[> Line 257: ((apply);(intro)) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i:index[const],t,t':timestamp[const]
H0: t' < pred t
Hap: happens(t)
Hexec: exec@t
Ht': t' < t
IH0: forall (t0:timestamp),
t0 < t =>
happens(t0) =>
exec@t0 =>
t' < t0 => cellA i@t' ~< cellA i@t0 || cellA i@t' = cellA i@t0
----------------------------------------
exec@pred t


- executable t => // H1; by apply H1.
[> Line 258: (((executable);(intro));by (apply)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index[const],t,t':timestamp[const]
H0: cellA i@t' ~< cellA i@pred t || cellA i@t' = cellA i@pred t
Hap: happens(t)
Hexec: exec@t
Ht': t' < t
IH0: forall (t0:timestamp),
t0 < t =>
happens(t0) =>
exec@t0 =>
t' < t0 => cellA i@t' ~< cellA i@t0 || cellA i@t' = cellA i@t0
----------------------------------------
cellA i@t' ~< cellA i@t || cellA i@t' = cellA i@t


- use counterIncreasePredA with t,i as H3 => //.
[> Line 259: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index[const],t,t':timestamp[const]
H0: cellA i@t' ~< cellA i@pred t || cellA i@t' = cellA i@pred t
H3: cellA i@pred t ~< cellA i@t || cellA i@pred t = cellA i@t
Hap: happens(t)
Hexec: exec@t
Ht': t' < t
IH0: forall (t0:timestamp),
t0 < t =>
happens(t0) =>
exec@t0 =>
t' < t0 => cellA i@t' ~< cellA i@t0 || cellA i@t' = cellA i@t0
----------------------------------------
cellA i@t' ~< cellA i@t || cellA i@t' = cellA i@t


case H0.
[> Line 260: (case) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i:index[const],t,t':timestamp[const]
H0: cellA i@t' ~< cellA i@pred t
H3: cellA i@pred t ~< cellA i@t || cellA i@pred t = cellA i@t
Hap: happens(t)
Hexec: exec@t
Ht': t' < t
IH0: forall (t0:timestamp),
t0 < t =>
happens(t0) =>
exec@t0 =>
t' < t0 => cellA i@t' ~< cellA i@t0 || cellA i@t' = cellA i@t0
----------------------------------------
cellA i@t' ~< cellA i@t || cellA i@t' = cellA i@t


* by case H3;
[1: left; apply orderTrans _ (cellA(i)@pred(t)) _ |
2: rewrite H3 in H0; left].
[> Line 263: by ((case); [1: ((left);(apply))|2: ((rewrite);(left))]) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index[const],t,t':timestamp[const]
H0: cellA i@t' = cellA i@pred t
H3: cellA i@pred t ~< cellA i@t || cellA i@pred t = cellA i@t
Hap: happens(t)
Hexec: exec@t
Ht': t' < t
IH0: forall (t0:timestamp),
t0 < t =>
happens(t0) =>
exec@t0 =>
t' < t0 => cellA i@t' ~< cellA i@t0 || cellA i@t' = cellA i@t0
----------------------------------------
cellA i@t' ~< cellA i@t || cellA i@t' = cellA i@t



* rewrite H0.
[> Line 265: (rewrite) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index[const],t,t':timestamp[const]
H0: cellA i@t' = cellA i@pred t
H3: cellA i@pred t ~< cellA i@t || cellA i@pred t = cellA i@t
Hap: happens(t)
Hexec: exec@t
Ht': t' < t
IH0: forall (t0:timestamp),
t0 < t =>
happens(t0) =>
exec@t0 =>
t' < t0 => cellA i@t' ~< cellA i@t0 || cellA i@t' = cellA i@t0
----------------------------------------
cellA i@pred t ~< cellA i@t || cellA i@pred t = cellA i@t


by case H3; [1: left | 2 : right].
[> Line 266: by ((case); [1: (left)|2: (right)]) [goal> lemma counterIncreaseA is proved


Qed.
lemma counterIncreaseA @system:(set:default; equiv:None) :
forall (t,t':timestamp,i:index),
happens(t) =>
exec@t => t' < t => cellA i@t' ~< cellA i@t || cellA i@t' = cellA i@t
Exiting proof mode.




lemma counterIncreaseB (t, t':timestamp, i:index):
happens(t) =>
exec@t =>
t' < t =>
( cellB(i)@t' ~< cellB(i)@t ||
cellB(i)@t' = cellB(i)@t).
Goal counterIncreaseB :
happens(t) =>
exec@t => t' < t => cellB i@t' ~< cellB i@t || cellB i@t' = cellB i@t

Proof.
[goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index,t,t':timestamp
----------------------------------------
happens(t) =>
exec@t => t' < t => cellB i@t' ~< cellB i@t || cellB i@t' = cellB i@t


induction t => t IH0 Hap Hexec Ht'.
[> Line 277: ((induction);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index[const],t,t':timestamp[const]
Hap: happens(t)
Hexec: exec@t
Ht': t' < t
IH0: forall (t0:timestamp),
t0 < t =>
happens(t0) =>
exec@t0 =>
t' < t0 => cellB i@t' ~< cellB i@t0 || cellB i@t' = cellB i@t0
----------------------------------------
cellB i@t' ~< cellB i@t || cellB i@t' = cellB i@t


assert (t' = pred(t) || t' < pred(t)) as H0;
1: case t; constraints.
[> Line 279: ((have); 1: ((case);(constraints))) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index[const],t,t':timestamp[const]
H0: t' = pred t || t' < pred t
Hap: happens(t)
Hexec: exec@t
Ht': t' < t
IH0: forall (t0:timestamp),
t0 < t =>
happens(t0) =>
exec@t0 =>
t' < t0 => cellB i@t' ~< cellB i@t0 || cellB i@t' = cellB i@t0
----------------------------------------
cellB i@t' ~< cellB i@t || cellB i@t' = cellB i@t


case H0.
[> Line 280: (case) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i:index[const],t,t':timestamp[const]
H0: t' = pred t
Hap: happens(t)
Hexec: exec@t
Ht': t' < t
IH0: forall (t0:timestamp),
t0 < t =>
happens(t0) =>
exec@t0 =>
t' < t0 => cellB i@t' ~< cellB i@t0 || cellB i@t' = cellB i@t0
----------------------------------------
cellB i@t' ~< cellB i@t || cellB i@t' = cellB i@t


+ (* case t' = pred(t) *)
rewrite !H0.
[> Line 282: (rewrite) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i:index[const],t,t':timestamp[const]
H0: t' = pred t
Hap: happens(t)
Hexec: exec@t
Ht': t' < t
IH0: forall (t0:timestamp),
t0 < t =>
happens(t0) =>
exec@t0 =>
t' < t0 => cellB i@t' ~< cellB i@t0 || cellB i@t' = cellB i@t0
----------------------------------------
cellB i@pred t ~< cellB i@t || cellB i@pred t = cellB i@t


by apply counterIncreasePredB.
[> Line 283: by (apply) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index[const],t,t':timestamp[const]
H0: t' < pred t
Hap: happens(t)
Hexec: exec@t
Ht': t' < t
IH0: forall (t0:timestamp),
t0 < t =>
happens(t0) =>
exec@t0 =>
t' < t0 => cellB i@t' ~< cellB i@t0 || cellB i@t' = cellB i@t0
----------------------------------------
cellB i@t' ~< cellB i@t || cellB i@t' = cellB i@t



+ (* case t' < pred(t) *)
apply IH0 in H0 => //=.
[> Line 286: ((apply);(intro)) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i:index[const],t,t':timestamp[const]
H0: t' < pred t
Hap: happens(t)
Hexec: exec@t
Ht': t' < t
IH0: forall (t0:timestamp),
t0 < t =>
happens(t0) =>
exec@t0 =>
t' < t0 => cellB i@t' ~< cellB i@t0 || cellB i@t' = cellB i@t0
----------------------------------------
exec@pred t


- executable t => // H1; by apply H1.
[> Line 287: (((executable);(intro));by (apply)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index[const],t,t':timestamp[const]
H0: cellB i@t' ~< cellB i@pred t || cellB i@t' = cellB i@pred t
Hap: happens(t)
Hexec: exec@t
Ht': t' < t
IH0: forall (t0:timestamp),
t0 < t =>
happens(t0) =>
exec@t0 =>
t' < t0 => cellB i@t' ~< cellB i@t0 || cellB i@t' = cellB i@t0
----------------------------------------
cellB i@t' ~< cellB i@t || cellB i@t' = cellB i@t


- use counterIncreasePredB with t,i as H3 => //.
[> Line 287: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index[const],t,t':timestamp[const]
H0: cellB i@t' ~< cellB i@pred t || cellB i@t' = cellB i@pred t
H3: cellB i@pred t ~< cellB i@t || cellB i@pred t = cellB i@t
Hap: happens(t)
Hexec: exec@t
Ht': t' < t
IH0: forall (t0:timestamp),
t0 < t =>
happens(t0) =>
exec@t0 =>
t' < t0 => cellB i@t' ~< cellB i@t0 || cellB i@t' = cellB i@t0
----------------------------------------
cellB i@t' ~< cellB i@t || cellB i@t' = cellB i@t

case H0. [> Line 288: (case) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i:index[const],t,t':timestamp[const]
H0: cellB i@t' ~< cellB i@pred t
H3: cellB i@pred t ~< cellB i@t || cellB i@pred t = cellB i@t
Hap: happens(t)
Hexec: exec@t
Ht': t' < t
IH0: forall (t0:timestamp),
t0 < t =>
happens(t0) =>
exec@t0 =>
t' < t0 => cellB i@t' ~< cellB i@t0 || cellB i@t' = cellB i@t0
----------------------------------------
cellB i@t' ~< cellB i@t || cellB i@t' = cellB i@t


* by case H3;
[1: left; apply orderTrans _ (cellB(i)@pred(t)) _ |
2: rewrite H3 in H0; left].
[> Line 291: by ((case); [1: ((left);(apply))|2: ((rewrite);(left))]) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index[const],t,t':timestamp[const]
H0: cellB i@t' = cellB i@pred t
H3: cellB i@pred t ~< cellB i@t || cellB i@pred t = cellB i@t
Hap: happens(t)
Hexec: exec@t
Ht': t' < t
IH0: forall (t0:timestamp),
t0 < t =>
happens(t0) =>
exec@t0 =>
t' < t0 => cellB i@t' ~< cellB i@t0 || cellB i@t' = cellB i@t0
----------------------------------------
cellB i@t' ~< cellB i@t || cellB i@t' = cellB i@t


* rewrite H0.
[> Line 291: (rewrite) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i:index[const],t,t':timestamp[const]
H0: cellB i@t' = cellB i@pred t
H3: cellB i@pred t ~< cellB i@t || cellB i@pred t = cellB i@t
Hap: happens(t)
Hexec: exec@t
Ht': t' < t
IH0: forall (t0:timestamp),
t0 < t =>
happens(t0) =>
exec@t0 =>
t' < t0 => cellB i@t' ~< cellB i@t0 || cellB i@t' = cellB i@t0
----------------------------------------
cellB i@pred t ~< cellB i@t || cellB i@pred t = cellB i@t

by case H3; [1: left | 2 : right]. [> Line 292: by ((case); [1: (left)|2: (right)]) [goal> lemma counterIncreaseB is proved


Qed.
lemma counterIncreaseB @system:(set:default; equiv:None) :
forall (t,t':timestamp,i:index),
happens(t) =>
exec@t => t' < t => cellB i@t' ~< cellB i@t || cellB i@t' = cellB i@t
Exiting proof mode.




(* The counter cellA(i) strictly increases between t and t'
when t < t' and (t' = SenderA(i,j1) or t' = ReceiverA(i,j1)). *)

lemma counterIncreaseStrictSA(i,j1:index, t:timestamp):
happens(SenderA(i,j1)) =>
(t < SenderA(i,j1) && exec@SenderA(i,j1)) =>
cellA(i)@t ~< cellA(i)@SenderA(i,j1).
Goal counterIncreaseStrictSA :
happens(SenderA(i, j1)) =>
t < SenderA(i, j1) && exec@SenderA(i, j1) =>
cellA i@t ~< cellA i@SenderA(i, j1)

Proof.
[goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index,t:timestamp
----------------------------------------
happens(SenderA(i, j1)) =>
t < SenderA(i, j1) && exec@SenderA(i, j1) =>
cellA i@t ~< cellA i@SenderA(i, j1)


intro Hap [Ht Hexec].
[> Line 304: (intro) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
Hap: happens(SenderA(i, j1))
Hexec: exec@SenderA(i, j1)
Ht: t < SenderA(i, j1)
----------------------------------------
cellA i@t ~< cellA i@SenderA(i, j1)


use counterIncreaseUpdateSA with i,j1 as Meq => //.
[> Line 305: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
Hap: happens(SenderA(i, j1))
Hexec: exec@SenderA(i, j1)
Ht: t < SenderA(i, j1)
Meq: cellA i@pred (SenderA(i, j1)) ~< cellA i@SenderA(i, j1)
----------------------------------------
cellA i@t ~< cellA i@SenderA(i, j1)


assert (
t < pred(SenderA(i,j1))
|| t = pred(SenderA(i,j1))) as H => //.
[> Line 308: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
H: t < pred (SenderA(i, j1)) || t = pred (SenderA(i, j1))
Hap: happens(SenderA(i, j1))
Hexec: exec@SenderA(i, j1)
Ht: t < SenderA(i, j1)
Meq: cellA i@pred (SenderA(i, j1)) ~< cellA i@SenderA(i, j1)
----------------------------------------
cellA i@t ~< cellA i@SenderA(i, j1)



case H; 2: by rewrite H.
[> Line 310: ((case); 2: by (rewrite)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
H: t < pred (SenderA(i, j1))
Hap: happens(SenderA(i, j1))
Hexec: exec@SenderA(i, j1)
Ht: t < SenderA(i, j1)
Meq: cellA i@pred (SenderA(i, j1)) ~< cellA i@SenderA(i, j1)
----------------------------------------
cellA i@t ~< cellA i@SenderA(i, j1)


use counterIncreaseA with pred(SenderA(i,j1)),t,i as H0 => //.
[> Line 311: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
H: t < pred (SenderA(i, j1))
H0: cellA i@t ~< cellA i@pred (SenderA(i, j1)) ||
cellA i@t = cellA i@pred (SenderA(i, j1))
Hap: happens(SenderA(i, j1))
Hexec: exec@SenderA(i, j1)
Ht: t < SenderA(i, j1)
Meq: cellA i@pred (SenderA(i, j1)) ~< cellA i@SenderA(i, j1)
----------------------------------------
cellA i@t ~< cellA i@SenderA(i, j1)


case H0; 2: by rewrite H0.
[> Line 312: ((case); 2: by (rewrite)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
H: t < pred (SenderA(i, j1))
H0: cellA i@t ~< cellA i@pred (SenderA(i, j1))
Hap: happens(SenderA(i, j1))
Hexec: exec@SenderA(i, j1)
Ht: t < SenderA(i, j1)
Meq: cellA i@pred (SenderA(i, j1)) ~< cellA i@SenderA(i, j1)
----------------------------------------
cellA i@t ~< cellA i@SenderA(i, j1)


by apply orderTrans _ (cellA(i)@pred(SenderA(i,j1))).
[> Line 313: by (apply) [goal> lemma counterIncreaseStrictSA is proved


Qed.
lemma counterIncreaseStrictSA @system:(set:default; equiv:None) :
forall (i,j1:index,t:timestamp),
happens(SenderA(i, j1)) =>
t < SenderA(i, j1) && exec@SenderA(i, j1) =>
cellA i@t ~< cellA i@SenderA(i, j1)
Exiting proof mode.



lemma counterIncreaseStrictRA (i,j1:index, t:timestamp):
happens(ReceiverA(i,j1)) =>
(t < ReceiverA(i,j1) && exec@ReceiverA(i,j1)) =>
cellA(i)@t ~< cellA(i)@ReceiverA(i,j1).
Goal counterIncreaseStrictRA :
happens(ReceiverA(i, j1)) =>
t < ReceiverA(i, j1) && exec@ReceiverA(i, j1) =>
cellA i@t ~< cellA i@ReceiverA(i, j1)

Proof.
[goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index,t:timestamp
----------------------------------------
happens(ReceiverA(i, j1)) =>
t < ReceiverA(i, j1) && exec@ReceiverA(i, j1) =>
cellA i@t ~< cellA i@ReceiverA(i, j1)


intro Hap [Ht Hexec].
[> Line 321: (intro) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
Hap: happens(ReceiverA(i, j1))
Hexec: exec@ReceiverA(i, j1)
Ht: t < ReceiverA(i, j1)
----------------------------------------
cellA i@t ~< cellA i@ReceiverA(i, j1)


use counterIncreaseUpdateRA with i,j1 as Meq => //.
[> Line 322: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
Hap: happens(ReceiverA(i, j1))
Hexec: exec@ReceiverA(i, j1)
Ht: t < ReceiverA(i, j1)
Meq: cellA i@pred (ReceiverA(i, j1)) ~< cellA i@ReceiverA(i, j1)
----------------------------------------
cellA i@t ~< cellA i@ReceiverA(i, j1)


assert (
t < pred(ReceiverA(i,j1))
|| t = pred(ReceiverA(i,j1))) as H => //.
[> Line 325: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
H: t < pred (ReceiverA(i, j1)) || t = pred (ReceiverA(i, j1))
Hap: happens(ReceiverA(i, j1))
Hexec: exec@ReceiverA(i, j1)
Ht: t < ReceiverA(i, j1)
Meq: cellA i@pred (ReceiverA(i, j1)) ~< cellA i@ReceiverA(i, j1)
----------------------------------------
cellA i@t ~< cellA i@ReceiverA(i, j1)



case H; 2: by rewrite H.
[> Line 327: ((case); 2: by (rewrite)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
H: t < pred (ReceiverA(i, j1))
Hap: happens(ReceiverA(i, j1))
Hexec: exec@ReceiverA(i, j1)
Ht: t < ReceiverA(i, j1)
Meq: cellA i@pred (ReceiverA(i, j1)) ~< cellA i@ReceiverA(i, j1)
----------------------------------------
cellA i@t ~< cellA i@ReceiverA(i, j1)


use counterIncreaseA with pred(ReceiverA(i,j1)),t,i as H0 => //.
[> Line 328: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
H: t < pred (ReceiverA(i, j1))
H0: cellA i@t ~< cellA i@pred (ReceiverA(i, j1)) ||
cellA i@t = cellA i@pred (ReceiverA(i, j1))
Hap: happens(ReceiverA(i, j1))
Hexec: exec@ReceiverA(i, j1)
Ht: t < ReceiverA(i, j1)
Meq: cellA i@pred (ReceiverA(i, j1)) ~< cellA i@ReceiverA(i, j1)
----------------------------------------
cellA i@t ~< cellA i@ReceiverA(i, j1)


case H0; 2: by rewrite H0.
[> Line 329: ((case); 2: by (rewrite)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
H: t < pred (ReceiverA(i, j1))
H0: cellA i@t ~< cellA i@pred (ReceiverA(i, j1))
Hap: happens(ReceiverA(i, j1))
Hexec: exec@ReceiverA(i, j1)
Ht: t < ReceiverA(i, j1)
Meq: cellA i@pred (ReceiverA(i, j1)) ~< cellA i@ReceiverA(i, j1)
----------------------------------------
cellA i@t ~< cellA i@ReceiverA(i, j1)


by apply orderTrans _ (cellA(i)@pred(ReceiverA(i,j1))).
[> Line 330: by (apply) [goal> lemma counterIncreaseStrictRA is proved


Qed.
lemma counterIncreaseStrictRA @system:(set:default; equiv:None) :
forall (i,j1:index,t:timestamp),
happens(ReceiverA(i, j1)) =>
t < ReceiverA(i, j1) && exec@ReceiverA(i, j1) =>
cellA i@t ~< cellA i@ReceiverA(i, j1)
Exiting proof mode.



(* The counter cellB(i) strictly increases between t and t'
when t < t' and (t' = SenderB(i,j1) or t' = ReceiverB(i,j1)). *)

lemma counterIncreaseStrictSB (i,j1:index, t:timestamp):
happens(SenderB(i,j1)) =>
(t < SenderB(i,j1) && exec@SenderB(i,j1)) =>
cellB(i)@t ~< cellB(i)@SenderB(i,j1).
Goal counterIncreaseStrictSB :
happens(SenderB(i, j1)) =>
t < SenderB(i, j1) && exec@SenderB(i, j1) =>
cellB i@t ~< cellB i@SenderB(i, j1)

Proof.
[goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index,t:timestamp
----------------------------------------
happens(SenderB(i, j1)) =>
t < SenderB(i, j1) && exec@SenderB(i, j1) =>
cellB i@t ~< cellB i@SenderB(i, j1)


intro Hap [Ht Hexec].
[> Line 341: (intro) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
Hap: happens(SenderB(i, j1))
Hexec: exec@SenderB(i, j1)
Ht: t < SenderB(i, j1)
----------------------------------------
cellB i@t ~< cellB i@SenderB(i, j1)


use counterIncreaseUpdateSB with i,j1 as Meq => //.
[> Line 342: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
Hap: happens(SenderB(i, j1))
Hexec: exec@SenderB(i, j1)
Ht: t < SenderB(i, j1)
Meq: cellB i@pred (SenderB(i, j1)) ~< cellB i@SenderB(i, j1)
----------------------------------------
cellB i@t ~< cellB i@SenderB(i, j1)


assert (
t < pred(SenderB(i,j1))
|| t = pred(SenderB(i,j1))) as H => //.
[> Line 345: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
H: t < pred (SenderB(i, j1)) || t = pred (SenderB(i, j1))
Hap: happens(SenderB(i, j1))
Hexec: exec@SenderB(i, j1)
Ht: t < SenderB(i, j1)
Meq: cellB i@pred (SenderB(i, j1)) ~< cellB i@SenderB(i, j1)
----------------------------------------
cellB i@t ~< cellB i@SenderB(i, j1)



case H; 2: by rewrite H.
[> Line 347: ((case); 2: by (rewrite)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
H: t < pred (SenderB(i, j1))
Hap: happens(SenderB(i, j1))
Hexec: exec@SenderB(i, j1)
Ht: t < SenderB(i, j1)
Meq: cellB i@pred (SenderB(i, j1)) ~< cellB i@SenderB(i, j1)
----------------------------------------
cellB i@t ~< cellB i@SenderB(i, j1)


use counterIncreaseB with pred(SenderB(i,j1)),t,i as H0 => //.
[> Line 348: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
H: t < pred (SenderB(i, j1))
H0: cellB i@t ~< cellB i@pred (SenderB(i, j1)) ||
cellB i@t = cellB i@pred (SenderB(i, j1))
Hap: happens(SenderB(i, j1))
Hexec: exec@SenderB(i, j1)
Ht: t < SenderB(i, j1)
Meq: cellB i@pred (SenderB(i, j1)) ~< cellB i@SenderB(i, j1)
----------------------------------------
cellB i@t ~< cellB i@SenderB(i, j1)


case H0; 2: by rewrite H0.
[> Line 349: ((case); 2: by (rewrite)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
H: t < pred (SenderB(i, j1))
H0: cellB i@t ~< cellB i@pred (SenderB(i, j1))
Hap: happens(SenderB(i, j1))
Hexec: exec@SenderB(i, j1)
Ht: t < SenderB(i, j1)
Meq: cellB i@pred (SenderB(i, j1)) ~< cellB i@SenderB(i, j1)
----------------------------------------
cellB i@t ~< cellB i@SenderB(i, j1)


by apply orderTrans _ (cellB(i)@pred(SenderB(i,j1))).
[> Line 350: by (apply) [goal> lemma counterIncreaseStrictSB is proved


Qed.
lemma counterIncreaseStrictSB @system:(set:default; equiv:None) :
forall (i,j1:index,t:timestamp),
happens(SenderB(i, j1)) =>
t < SenderB(i, j1) && exec@SenderB(i, j1) =>
cellB i@t ~< cellB i@SenderB(i, j1)
Exiting proof mode.



lemma counterIncreaseStrictRB (i,j1:index, t:timestamp):
happens(ReceiverB(i,j1)) =>
(t < ReceiverB(i,j1) && exec@ReceiverB(i,j1)) =>
cellB(i)@t ~< cellB(i)@ReceiverB(i,j1).
Goal counterIncreaseStrictRB :
happens(ReceiverB(i, j1)) =>
t < ReceiverB(i, j1) && exec@ReceiverB(i, j1) =>
cellB i@t ~< cellB i@ReceiverB(i, j1)

Proof.
[goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index,t:timestamp
----------------------------------------
happens(ReceiverB(i, j1)) =>
t < ReceiverB(i, j1) && exec@ReceiverB(i, j1) =>
cellB i@t ~< cellB i@ReceiverB(i, j1)


intro Hap [Ht Hexec].
[> Line 358: (intro) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
Hap: happens(ReceiverB(i, j1))
Hexec: exec@ReceiverB(i, j1)
Ht: t < ReceiverB(i, j1)
----------------------------------------
cellB i@t ~< cellB i@ReceiverB(i, j1)


use counterIncreaseUpdateRB with i,j1 as Meq => //.
[> Line 359: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
Hap: happens(ReceiverB(i, j1))
Hexec: exec@ReceiverB(i, j1)
Ht: t < ReceiverB(i, j1)
Meq: cellB i@pred (ReceiverB(i, j1)) ~< cellB i@ReceiverB(i, j1)
----------------------------------------
cellB i@t ~< cellB i@ReceiverB(i, j1)


assert (
t < pred(ReceiverB(i,j1))
|| t = pred(ReceiverB(i,j1))) as H => //.
[> Line 362: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
H: t < pred (ReceiverB(i, j1)) || t = pred (ReceiverB(i, j1))
Hap: happens(ReceiverB(i, j1))
Hexec: exec@ReceiverB(i, j1)
Ht: t < ReceiverB(i, j1)
Meq: cellB i@pred (ReceiverB(i, j1)) ~< cellB i@ReceiverB(i, j1)
----------------------------------------
cellB i@t ~< cellB i@ReceiverB(i, j1)



case H; 2: by rewrite H.
[> Line 364: ((case); 2: by (rewrite)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
H: t < pred (ReceiverB(i, j1))
Hap: happens(ReceiverB(i, j1))
Hexec: exec@ReceiverB(i, j1)
Ht: t < ReceiverB(i, j1)
Meq: cellB i@pred (ReceiverB(i, j1)) ~< cellB i@ReceiverB(i, j1)
----------------------------------------
cellB i@t ~< cellB i@ReceiverB(i, j1)


use counterIncreaseB with pred(ReceiverB(i,j1)),t,i as H0 => //.
[> Line 365: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
H: t < pred (ReceiverB(i, j1))
H0: cellB i@t ~< cellB i@pred (ReceiverB(i, j1)) ||
cellB i@t = cellB i@pred (ReceiverB(i, j1))
Hap: happens(ReceiverB(i, j1))
Hexec: exec@ReceiverB(i, j1)
Ht: t < ReceiverB(i, j1)
Meq: cellB i@pred (ReceiverB(i, j1)) ~< cellB i@ReceiverB(i, j1)
----------------------------------------
cellB i@t ~< cellB i@ReceiverB(i, j1)


case H0; 2: by rewrite H0.
[> Line 366: ((case); 2: by (rewrite)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j1:index[const],t:timestamp[const]
H: t < pred (ReceiverB(i, j1))
H0: cellB i@t ~< cellB i@pred (ReceiverB(i, j1))
Hap: happens(ReceiverB(i, j1))
Hexec: exec@ReceiverB(i, j1)
Ht: t < ReceiverB(i, j1)
Meq: cellB i@pred (ReceiverB(i, j1)) ~< cellB i@ReceiverB(i, j1)
----------------------------------------
cellB i@t ~< cellB i@ReceiverB(i, j1)


by apply orderTrans _ (cellB(i)@pred(ReceiverB(i,j1))).
[> Line 367: by (apply) [goal> lemma counterIncreaseStrictRB is proved


Qed.
lemma counterIncreaseStrictRB @system:(set:default; equiv:None) :
forall (i,j1:index,t:timestamp),
happens(ReceiverB(i, j1)) =>
t < ReceiverB(i, j1) && exec@ReceiverB(i, j1) =>
cellB i@t ~< cellB i@ReceiverB(i, j1)
Exiting proof mode.






(* SECURITY PROPERTIES *)

(* 1st property w.r.t. A *)
(* This security property is actually stronger than the one stated in
the GSVerif paper. The send action has been done by agent B, and we
also proved a lemma regarding counters.
Moreover, we use this 1st property (authentication) to prove the
2nd property (injectivity). *)


lemma authA (i,j:index) :
happens(ReceiverA(i,j)) => exec@ReceiverA(i,j) =>
(exists (j':index),
SenderB(i,j') < ReceiverA(i,j)
&& snd(output@SenderB(i,j')) = snd(input@ReceiverA(i,j))
&& fst(fst(output@SenderB(i,j'))) = fst(fst(input@ReceiverA(i,j)))
&& snd(snd(fst(output@SenderB(i,j')))) = snd(snd(fst(input@ReceiverA(i,j))))
&& cellA(i)@pred(ReceiverA(i,j)) ~< cellB(i)@SenderB(i,j')).
Goal authA :
happens(ReceiverA(i, j)) =>
exec@ReceiverA(i, j) =>
exists (j':index),
SenderB(i, j') < ReceiverA(i, j) &&
snd (output@SenderB(i, j')) = snd (input@ReceiverA(i, j)) &&
fst (fst (output@SenderB(i, j'))) = fst (fst (input@ReceiverA(i, j)))
&&
snd (snd (fst (output@SenderB(i, j')))) =
snd (snd (fst (input@ReceiverA(i, j)))) &&
cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j')

Proof.
[goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j:index
----------------------------------------
happens(ReceiverA(i, j)) =>
exec@ReceiverA(i, j) =>
exists (j':index),
SenderB(i, j') < ReceiverA(i, j) &&
snd (output@SenderB(i, j')) = snd (input@ReceiverA(i, j)) &&
fst (fst (output@SenderB(i, j'))) = fst (fst (input@ReceiverA(i, j)))
&&
snd (snd (fst (output@SenderB(i, j')))) =
snd (snd (fst (input@ReceiverA(i, j)))) &&
cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j')



intro Hap @/exec @/cond [Hexecpred [H1 H2 H3]].
[> Line 392: (intro) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j:index[const]
H1: fst (snd (fst (input@ReceiverA(i, j)))) = SIGN
H2: cellA i@pred (ReceiverA(i, j)) ~< snd (snd (fst (input@ReceiverA(i, j))))
H3: snd (input@ReceiverA(i, j)) =
hmac
(<snd (snd (fst (input@ReceiverA(i, j)))),
fst (fst (input@ReceiverA(i, j)))>,
sk i)
Hap: happens(ReceiverA(i, j))
Hexecpred: exec@pred (ReceiverA(i, j))
----------------------------------------
exists (j':index),
SenderB(i, j') < ReceiverA(i, j) &&
snd (output@SenderB(i, j')) = snd (input@ReceiverA(i, j)) &&
fst (fst (output@SenderB(i, j'))) = fst (fst (input@ReceiverA(i, j)))
&&
snd (snd (fst (output@SenderB(i, j')))) =
snd (snd (fst (input@ReceiverA(i, j)))) &&
cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j')



euf H3.
[> Line 393: (euf) Indirect bad occurrences of key sk(i), and messages authenticated by it
in other actions:
<cellA i@SenderA(i, j),msgA (i, j)> auth. by sk(i)
(collision with <snd (snd (fst (input@ReceiverA(i, j)))),
fst (fst (input@ReceiverA(i, j)))> auth. by sk(i))
in action SenderA(i, j)
in term
(happens(SenderA(i, j)),
<<msgA (i, j),<SIGN,cellA i@SenderA(i, j)>>,
hmac (<cellA i@SenderA(i, j),msgA (i, j)>, sk i)>)

<cellB i@SenderB(i, j),msgB (i, j)> auth. by sk(i)
(collision with <snd (snd (fst (input@ReceiverA(i, j)))),
fst (fst (input@ReceiverA(i, j)))> auth. by sk(i))
in action SenderB(i, j)
in term
(happens(SenderB(i, j)),
<<msgB (i, j),<SIGN,cellB i@SenderB(i, j)>>,
hmac (<cellB i@SenderB(i, j),msgB (i, j)>, sk i)>)

Total: 2 occurrences
0 of them are subsumed by another
2 occurrences remaining

[goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j:index[const]
H1: fst (snd (fst (input@ReceiverA(i, j)))) = SIGN
H2: cellA i@pred (ReceiverA(i, j)) ~< snd (snd (fst (input@ReceiverA(i, j))))
H3: snd (input@ReceiverA(i, j)) =
hmac
(<snd (snd (fst (input@ReceiverA(i, j)))),
fst (fst (input@ReceiverA(i, j)))>,
sk i)
Hap: happens(ReceiverA(i, j))
Hexecpred: exec@pred (ReceiverA(i, j))
----------------------------------------
(exists (j0:index),
SenderA(i, j0) < ReceiverA(i, j) &&
<snd (snd (fst (input@ReceiverA(i, j)))),fst (fst (input@ReceiverA(i, j)))>
= <cellA i@SenderA(i, j0),msgA (i, j0)>) =>
exists (j':index),
SenderB(i, j') < ReceiverA(i, j) &&
snd (output@SenderB(i, j')) = snd (input@ReceiverA(i, j)) &&
fst (fst (output@SenderB(i, j'))) = fst (fst (input@ReceiverA(i, j)))
&&
snd (snd (fst (output@SenderB(i, j')))) =
snd (snd (fst (input@ReceiverA(i, j)))) &&
cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j')



+ intro [j0 [H4 [H5 _]]].
[> Line 394: (intro) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j0:index[const]
H1: fst (snd (fst (input@ReceiverA(i, j)))) = SIGN
H2: cellA i@pred (ReceiverA(i, j)) ~< snd (snd (fst (input@ReceiverA(i, j))))
H3: snd (input@ReceiverA(i, j)) =
hmac
(<snd (snd (fst (input@ReceiverA(i, j)))),
fst (fst (input@ReceiverA(i, j)))>,
sk i)
H4: SenderA(i, j0) < ReceiverA(i, j)
H5: snd (snd (fst (input@ReceiverA(i, j)))) = cellA i@SenderA(i, j0)
Hap: happens(ReceiverA(i, j))
Hexecpred: exec@pred (ReceiverA(i, j))
_: fst (fst (input@ReceiverA(i, j))) = msgA (i, j0)
----------------------------------------
exists (j':index),
SenderB(i, j') < ReceiverA(i, j) &&
snd (output@SenderB(i, j')) = snd (input@ReceiverA(i, j)) &&
fst (fst (output@SenderB(i, j'))) = fst (fst (input@ReceiverA(i, j)))
&&
snd (snd (fst (output@SenderB(i, j')))) =
snd (snd (fst (input@ReceiverA(i, j)))) &&
cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j')



rewrite H5 in H2.
[> Line 395: (rewrite) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j0:index[const]
H1: fst (snd (fst (input@ReceiverA(i, j)))) = SIGN
H2: cellA i@pred (ReceiverA(i, j)) ~< cellA i@SenderA(i, j0)
H3: snd (input@ReceiverA(i, j)) =
hmac
(<snd (snd (fst (input@ReceiverA(i, j)))),
fst (fst (input@ReceiverA(i, j)))>,
sk i)
H4: SenderA(i, j0) < ReceiverA(i, j)
H5: snd (snd (fst (input@ReceiverA(i, j)))) = cellA i@SenderA(i, j0)
Hap: happens(ReceiverA(i, j))
Hexecpred: exec@pred (ReceiverA(i, j))
_: fst (fst (input@ReceiverA(i, j))) = msgA (i, j0)
----------------------------------------
exists (j':index),
SenderB(i, j') < ReceiverA(i, j) &&
snd (output@SenderB(i, j')) = snd (input@ReceiverA(i, j)) &&
fst (fst (output@SenderB(i, j'))) = fst (fst (input@ReceiverA(i, j)))
&&
snd (snd (fst (output@SenderB(i, j')))) =
snd (snd (fst (input@ReceiverA(i, j)))) &&
cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j')



use counterIncreaseStrictRA with i,j, SenderA(i,j0) as Hyp => //.
[> Line 396: ((have);(intro)) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j0:index[const]
H1: fst (snd (fst (input@ReceiverA(i, j)))) = SIGN
H2: cellA i@pred (ReceiverA(i, j)) ~< cellA i@SenderA(i, j0)
H3: snd (input@ReceiverA(i, j)) =
hmac
(<snd (snd (fst (input@ReceiverA(i, j)))),
fst (fst (input@ReceiverA(i, j)))>,
sk i)
H4: SenderA(i, j0) < ReceiverA(i, j)
H5: snd (snd (fst (input@ReceiverA(i, j)))) = cellA i@SenderA(i, j0)
Hap: happens(ReceiverA(i, j))
Hexecpred: exec@pred (ReceiverA(i, j))
Hyp: cellA i@SenderA(i, j0) ~< cellA i@ReceiverA(i, j)
_: fst (fst (input@ReceiverA(i, j))) = msgA (i, j0)
----------------------------------------
exists (j':index),
SenderB(i, j') < ReceiverA(i, j) &&
snd (output@SenderB(i, j')) = snd (input@ReceiverA(i, j)) &&
fst (fst (output@SenderB(i, j'))) = fst (fst (input@ReceiverA(i, j)))
&&
snd (snd (fst (output@SenderB(i, j')))) =
snd (snd (fst (input@ReceiverA(i, j)))) &&
cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j')



expand cellA(i)@ReceiverA(i,j).
[> Line 397: (expand) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j0:index[const]
H1: fst (snd (fst (input@ReceiverA(i, j)))) = SIGN
H2: cellA i@pred (ReceiverA(i, j)) ~< cellA i@SenderA(i, j0)
H3: snd (input@ReceiverA(i, j)) =
hmac
(<snd (snd (fst (input@ReceiverA(i, j)))),
fst (fst (input@ReceiverA(i, j)))>,
sk i)
H4: SenderA(i, j0) < ReceiverA(i, j)
H5: snd (snd (fst (input@ReceiverA(i, j)))) = cellA i@SenderA(i, j0)
Hap: happens(ReceiverA(i, j))
Hexecpred: exec@pred (ReceiverA(i, j))
Hyp: cellA i@SenderA(i, j0) ~< mySucc (cellA i@pred (ReceiverA(i, j)))
_: fst (fst (input@ReceiverA(i, j))) = msgA (i, j0)
----------------------------------------
exists (j':index),
SenderB(i, j') < ReceiverA(i, j) &&
snd (output@SenderB(i, j')) = snd (input@ReceiverA(i, j)) &&
fst (fst (output@SenderB(i, j'))) = fst (fst (input@ReceiverA(i, j)))
&&
snd (snd (fst (output@SenderB(i, j')))) =
snd (snd (fst (input@ReceiverA(i, j)))) &&
cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j')



by apply orderBetween in H2.
[> Line 398: by (apply) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j:index[const]
H1: fst (snd (fst (input@ReceiverA(i, j)))) = SIGN
H2: cellA i@pred (ReceiverA(i, j)) ~< snd (snd (fst (input@ReceiverA(i, j))))
H3: snd (input@ReceiverA(i, j)) =
hmac
(<snd (snd (fst (input@ReceiverA(i, j)))),
fst (fst (input@ReceiverA(i, j)))>,
sk i)
Hap: happens(ReceiverA(i, j))
Hexecpred: exec@pred (ReceiverA(i, j))
----------------------------------------
(exists (j0:index),
SenderB(i, j0) < ReceiverA(i, j) &&
<snd (snd (fst (input@ReceiverA(i, j)))),fst (fst (input@ReceiverA(i, j)))>
= <cellB i@SenderB(i, j0),msgB (i, j0)>) =>
exists (j':index),
SenderB(i, j') < ReceiverA(i, j) &&
snd (output@SenderB(i, j')) = snd (input@ReceiverA(i, j)) &&
fst (fst (output@SenderB(i, j'))) = fst (fst (input@ReceiverA(i, j)))
&&
snd (snd (fst (output@SenderB(i, j')))) =
snd (snd (fst (input@ReceiverA(i, j)))) &&
cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j')




+ intro [j0 [H4 [H5 _]]].
[> Line 400: (intro) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j0:index[const]
H1: fst (snd (fst (input@ReceiverA(i, j)))) = SIGN
H2: cellA i@pred (ReceiverA(i, j)) ~< snd (snd (fst (input@ReceiverA(i, j))))
H3: snd (input@ReceiverA(i, j)) =
hmac
(<snd (snd (fst (input@ReceiverA(i, j)))),
fst (fst (input@ReceiverA(i, j)))>,
sk i)
H4: SenderB(i, j0) < ReceiverA(i, j)
H5: snd (snd (fst (input@ReceiverA(i, j)))) = cellB i@SenderB(i, j0)
Hap: happens(ReceiverA(i, j))
Hexecpred: exec@pred (ReceiverA(i, j))
_: fst (fst (input@ReceiverA(i, j))) = msgB (i, j0)
----------------------------------------
exists (j':index),
SenderB(i, j') < ReceiverA(i, j) &&
snd (output@SenderB(i, j')) = snd (input@ReceiverA(i, j)) &&
fst (fst (output@SenderB(i, j'))) = fst (fst (input@ReceiverA(i, j)))
&&
snd (snd (fst (output@SenderB(i, j')))) =
snd (snd (fst (input@ReceiverA(i, j)))) &&
cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j')



exists j0.
[> Line 401: (exists) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j0:index[const]
H1: fst (snd (fst (input@ReceiverA(i, j)))) = SIGN
H2: cellA i@pred (ReceiverA(i, j)) ~< snd (snd (fst (input@ReceiverA(i, j))))
H3: snd (input@ReceiverA(i, j)) =
hmac
(<snd (snd (fst (input@ReceiverA(i, j)))),
fst (fst (input@ReceiverA(i, j)))>,
sk i)
H4: SenderB(i, j0) < ReceiverA(i, j)
H5: snd (snd (fst (input@ReceiverA(i, j)))) = cellB i@SenderB(i, j0)
Hap: happens(ReceiverA(i, j))
Hexecpred: exec@pred (ReceiverA(i, j))
_: fst (fst (input@ReceiverA(i, j))) = msgB (i, j0)
----------------------------------------
SenderB(i, j0) < ReceiverA(i, j) &&
snd (output@SenderB(i, j0)) = snd (input@ReceiverA(i, j)) &&
fst (fst (output@SenderB(i, j0))) = fst (fst (input@ReceiverA(i, j)))
&&
snd (snd (fst (output@SenderB(i, j0)))) =
snd (snd (fst (input@ReceiverA(i, j)))) &&
cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j0)


rewrite H5 in H2.
[> Line 402: (rewrite) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j0:index[const]
H1: fst (snd (fst (input@ReceiverA(i, j)))) = SIGN
H2: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j0)
H3: snd (input@ReceiverA(i, j)) =
hmac
(<snd (snd (fst (input@ReceiverA(i, j)))),
fst (fst (input@ReceiverA(i, j)))>,
sk i)
H4: SenderB(i, j0) < ReceiverA(i, j)
H5: snd (snd (fst (input@ReceiverA(i, j)))) = cellB i@SenderB(i, j0)
Hap: happens(ReceiverA(i, j))
Hexecpred: exec@pred (ReceiverA(i, j))
_: fst (fst (input@ReceiverA(i, j))) = msgB (i, j0)
----------------------------------------
SenderB(i, j0) < ReceiverA(i, j) &&
snd (output@SenderB(i, j0)) = snd (input@ReceiverA(i, j)) &&
fst (fst (output@SenderB(i, j0))) = fst (fst (input@ReceiverA(i, j)))
&&
snd (snd (fst (output@SenderB(i, j0)))) =
snd (snd (fst (input@ReceiverA(i, j)))) &&
cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j0)


auto.
[> Line 403: (auto) [goal> lemma authA is proved


Qed.
lemma authA @system:(set:default; equiv:None) :
forall (i,j:index),
happens(ReceiverA(i, j)) =>
exec@ReceiverA(i, j) =>
exists (j':index),
SenderB(i, j') < ReceiverA(i, j) &&
snd (output@SenderB(i, j')) = snd (input@ReceiverA(i, j)) &&
fst (fst (output@SenderB(i, j'))) = fst (fst (input@ReceiverA(i, j)))
&&
snd (snd (fst (output@SenderB(i, j')))) =
snd (snd (fst (input@ReceiverA(i, j)))) &&
cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j')
Exiting proof mode.




(* 1st property w.r.t. B *)
lemma authB(i,j:index) :
happens(ReceiverB(i,j)) => exec@ReceiverB(i,j) =>
(exists (j':index),
SenderA(i,j') < ReceiverB(i,j)
&& snd(output@SenderA(i,j')) = snd(input@ReceiverB(i,j))
&& fst(fst(output@SenderA(i,j'))) = fst(fst(input@ReceiverB(i,j)))
&& snd(snd(fst(output@SenderA(i,j')))) = snd(snd(fst(input@ReceiverB(i,j))))
&& cellB(i)@pred(ReceiverB(i,j)) ~< cellA(i)@SenderA(i,j')).
Goal authB :
happens(ReceiverB(i, j)) =>
exec@ReceiverB(i, j) =>
exists (j':index),
SenderA(i, j') < ReceiverB(i, j) &&
snd (output@SenderA(i, j')) = snd (input@ReceiverB(i, j)) &&
fst (fst (output@SenderA(i, j'))) = fst (fst (input@ReceiverB(i, j)))
&&
snd (snd (fst (output@SenderA(i, j')))) =
snd (snd (fst (input@ReceiverB(i, j)))) &&
cellB i@pred (ReceiverB(i, j)) ~< cellA i@SenderA(i, j')

Proof.
[goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j:index
----------------------------------------
happens(ReceiverB(i, j)) =>
exec@ReceiverB(i, j) =>
exists (j':index),
SenderA(i, j') < ReceiverB(i, j) &&
snd (output@SenderA(i, j')) = snd (input@ReceiverB(i, j)) &&
fst (fst (output@SenderA(i, j'))) = fst (fst (input@ReceiverB(i, j)))
&&
snd (snd (fst (output@SenderA(i, j')))) =
snd (snd (fst (input@ReceiverB(i, j)))) &&
cellB i@pred (ReceiverB(i, j)) ~< cellA i@SenderA(i, j')



intro Hap @/exec @/cond [Hexecpred [H1 H2 H3]].
[> Line 417: (intro) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j:index[const]
H1: fst (snd (fst (input@ReceiverB(i, j)))) = SIGN
H2: cellB i@pred (ReceiverB(i, j)) ~< snd (snd (fst (input@ReceiverB(i, j))))
H3: snd (input@ReceiverB(i, j)) =
hmac
(<snd (snd (fst (input@ReceiverB(i, j)))),
fst (fst (input@ReceiverB(i, j)))>,
sk i)
Hap: happens(ReceiverB(i, j))
Hexecpred: exec@pred (ReceiverB(i, j))
----------------------------------------
exists (j':index),
SenderA(i, j') < ReceiverB(i, j) &&
snd (output@SenderA(i, j')) = snd (input@ReceiverB(i, j)) &&
fst (fst (output@SenderA(i, j'))) = fst (fst (input@ReceiverB(i, j)))
&&
snd (snd (fst (output@SenderA(i, j')))) =
snd (snd (fst (input@ReceiverB(i, j)))) &&
cellB i@pred (ReceiverB(i, j)) ~< cellA i@SenderA(i, j')



euf H3.
[> Line 418: (euf) Indirect bad occurrences of key sk(i), and messages authenticated by it
in other actions:
<cellA i@SenderA(i, j),msgA (i, j)> auth. by sk(i)
(collision with <snd (snd (fst (input@ReceiverB(i, j)))),
fst (fst (input@ReceiverB(i, j)))> auth. by sk(i))
in action SenderA(i, j)
in term
(happens(SenderA(i, j)),
<<msgA (i, j),<SIGN,cellA i@SenderA(i, j)>>,
hmac (<cellA i@SenderA(i, j),msgA (i, j)>, sk i)>)

<cellB i@SenderB(i, j),msgB (i, j)> auth. by sk(i)
(collision with <snd (snd (fst (input@ReceiverB(i, j)))),
fst (fst (input@ReceiverB(i, j)))> auth. by sk(i))
in action SenderB(i, j)
in term
(happens(SenderB(i, j)),
<<msgB (i, j),<SIGN,cellB i@SenderB(i, j)>>,
hmac (<cellB i@SenderB(i, j),msgB (i, j)>, sk i)>)

Total: 2 occurrences
0 of them are subsumed by another
2 occurrences remaining

[goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j:index[const]
H1: fst (snd (fst (input@ReceiverB(i, j)))) = SIGN
H2: cellB i@pred (ReceiverB(i, j)) ~< snd (snd (fst (input@ReceiverB(i, j))))
H3: snd (input@ReceiverB(i, j)) =
hmac
(<snd (snd (fst (input@ReceiverB(i, j)))),
fst (fst (input@ReceiverB(i, j)))>,
sk i)
Hap: happens(ReceiverB(i, j))
Hexecpred: exec@pred (ReceiverB(i, j))
----------------------------------------
(exists (j0:index),
SenderA(i, j0) < ReceiverB(i, j) &&
<snd (snd (fst (input@ReceiverB(i, j)))),fst (fst (input@ReceiverB(i, j)))>
= <cellA i@SenderA(i, j0),msgA (i, j0)>) =>
exists (j':index),
SenderA(i, j') < ReceiverB(i, j) &&
snd (output@SenderA(i, j')) = snd (input@ReceiverB(i, j)) &&
fst (fst (output@SenderA(i, j'))) = fst (fst (input@ReceiverB(i, j)))
&&
snd (snd (fst (output@SenderA(i, j')))) =
snd (snd (fst (input@ReceiverB(i, j)))) &&
cellB i@pred (ReceiverB(i, j)) ~< cellA i@SenderA(i, j')



+ intro [j0 [H4 [H5 _]]].
[> Line 419: (intro) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j0:index[const]
H1: fst (snd (fst (input@ReceiverB(i, j)))) = SIGN
H2: cellB i@pred (ReceiverB(i, j)) ~< snd (snd (fst (input@ReceiverB(i, j))))
H3: snd (input@ReceiverB(i, j)) =
hmac
(<snd (snd (fst (input@ReceiverB(i, j)))),
fst (fst (input@ReceiverB(i, j)))>,
sk i)
H4: SenderA(i, j0) < ReceiverB(i, j)
H5: snd (snd (fst (input@ReceiverB(i, j)))) = cellA i@SenderA(i, j0)
Hap: happens(ReceiverB(i, j))
Hexecpred: exec@pred (ReceiverB(i, j))
_: fst (fst (input@ReceiverB(i, j))) = msgA (i, j0)
----------------------------------------
exists (j':index),
SenderA(i, j') < ReceiverB(i, j) &&
snd (output@SenderA(i, j')) = snd (input@ReceiverB(i, j)) &&
fst (fst (output@SenderA(i, j'))) = fst (fst (input@ReceiverB(i, j)))
&&
snd (snd (fst (output@SenderA(i, j')))) =
snd (snd (fst (input@ReceiverB(i, j)))) &&
cellB i@pred (ReceiverB(i, j)) ~< cellA i@SenderA(i, j')



exists j0.
[> Line 420: (exists) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j0:index[const]
H1: fst (snd (fst (input@ReceiverB(i, j)))) = SIGN
H2: cellB i@pred (ReceiverB(i, j)) ~< snd (snd (fst (input@ReceiverB(i, j))))
H3: snd (input@ReceiverB(i, j)) =
hmac
(<snd (snd (fst (input@ReceiverB(i, j)))),
fst (fst (input@ReceiverB(i, j)))>,
sk i)
H4: SenderA(i, j0) < ReceiverB(i, j)
H5: snd (snd (fst (input@ReceiverB(i, j)))) = cellA i@SenderA(i, j0)
Hap: happens(ReceiverB(i, j))
Hexecpred: exec@pred (ReceiverB(i, j))
_: fst (fst (input@ReceiverB(i, j))) = msgA (i, j0)
----------------------------------------
SenderA(i, j0) < ReceiverB(i, j) &&
snd (output@SenderA(i, j0)) = snd (input@ReceiverB(i, j)) &&
fst (fst (output@SenderA(i, j0))) = fst (fst (input@ReceiverB(i, j)))
&&
snd (snd (fst (output@SenderA(i, j0)))) =
snd (snd (fst (input@ReceiverB(i, j)))) &&
cellB i@pred (ReceiverB(i, j)) ~< cellA i@SenderA(i, j0)


rewrite H5 in H2.
[> Line 421: (rewrite) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j0:index[const]
H1: fst (snd (fst (input@ReceiverB(i, j)))) = SIGN
H2: cellB i@pred (ReceiverB(i, j)) ~< cellA i@SenderA(i, j0)
H3: snd (input@ReceiverB(i, j)) =
hmac
(<snd (snd (fst (input@ReceiverB(i, j)))),
fst (fst (input@ReceiverB(i, j)))>,
sk i)
H4: SenderA(i, j0) < ReceiverB(i, j)
H5: snd (snd (fst (input@ReceiverB(i, j)))) = cellA i@SenderA(i, j0)
Hap: happens(ReceiverB(i, j))
Hexecpred: exec@pred (ReceiverB(i, j))
_: fst (fst (input@ReceiverB(i, j))) = msgA (i, j0)
----------------------------------------
SenderA(i, j0) < ReceiverB(i, j) &&
snd (output@SenderA(i, j0)) = snd (input@ReceiverB(i, j)) &&
fst (fst (output@SenderA(i, j0))) = fst (fst (input@ReceiverB(i, j)))
&&
snd (snd (fst (output@SenderA(i, j0)))) =
snd (snd (fst (input@ReceiverB(i, j)))) &&
cellB i@pred (ReceiverB(i, j)) ~< cellA i@SenderA(i, j0)


auto.
[> Line 422: (auto) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j:index[const]
H1: fst (snd (fst (input@ReceiverB(i, j)))) = SIGN
H2: cellB i@pred (ReceiverB(i, j)) ~< snd (snd (fst (input@ReceiverB(i, j))))
H3: snd (input@ReceiverB(i, j)) =
hmac
(<snd (snd (fst (input@ReceiverB(i, j)))),
fst (fst (input@ReceiverB(i, j)))>,
sk i)
Hap: happens(ReceiverB(i, j))
Hexecpred: exec@pred (ReceiverB(i, j))
----------------------------------------
(exists (j0:index),
SenderB(i, j0) < ReceiverB(i, j) &&
<snd (snd (fst (input@ReceiverB(i, j)))),fst (fst (input@ReceiverB(i, j)))>
= <cellB i@SenderB(i, j0),msgB (i, j0)>) =>
exists (j':index),
SenderA(i, j') < ReceiverB(i, j) &&
snd (output@SenderA(i, j')) = snd (input@ReceiverB(i, j)) &&
fst (fst (output@SenderA(i, j'))) = fst (fst (input@ReceiverB(i, j)))
&&
snd (snd (fst (output@SenderA(i, j')))) =
snd (snd (fst (input@ReceiverB(i, j)))) &&
cellB i@pred (ReceiverB(i, j)) ~< cellA i@SenderA(i, j')




+ intro [j0 [H4 [H5 _]]].
[> Line 424: (intro) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j0:index[const]
H1: fst (snd (fst (input@ReceiverB(i, j)))) = SIGN
H2: cellB i@pred (ReceiverB(i, j)) ~< snd (snd (fst (input@ReceiverB(i, j))))
H3: snd (input@ReceiverB(i, j)) =
hmac
(<snd (snd (fst (input@ReceiverB(i, j)))),
fst (fst (input@ReceiverB(i, j)))>,
sk i)
H4: SenderB(i, j0) < ReceiverB(i, j)
H5: snd (snd (fst (input@ReceiverB(i, j)))) = cellB i@SenderB(i, j0)
Hap: happens(ReceiverB(i, j))
Hexecpred: exec@pred (ReceiverB(i, j))
_: fst (fst (input@ReceiverB(i, j))) = msgB (i, j0)
----------------------------------------
exists (j':index),
SenderA(i, j') < ReceiverB(i, j) &&
snd (output@SenderA(i, j')) = snd (input@ReceiverB(i, j)) &&
fst (fst (output@SenderA(i, j'))) = fst (fst (input@ReceiverB(i, j)))
&&
snd (snd (fst (output@SenderA(i, j')))) =
snd (snd (fst (input@ReceiverB(i, j)))) &&
cellB i@pred (ReceiverB(i, j)) ~< cellA i@SenderA(i, j')



rewrite H5 in H2.
[> Line 425: (rewrite) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j0:index[const]
H1: fst (snd (fst (input@ReceiverB(i, j)))) = SIGN
H2: cellB i@pred (ReceiverB(i, j)) ~< cellB i@SenderB(i, j0)
H3: snd (input@ReceiverB(i, j)) =
hmac
(<snd (snd (fst (input@ReceiverB(i, j)))),
fst (fst (input@ReceiverB(i, j)))>,
sk i)
H4: SenderB(i, j0) < ReceiverB(i, j)
H5: snd (snd (fst (input@ReceiverB(i, j)))) = cellB i@SenderB(i, j0)
Hap: happens(ReceiverB(i, j))
Hexecpred: exec@pred (ReceiverB(i, j))
_: fst (fst (input@ReceiverB(i, j))) = msgB (i, j0)
----------------------------------------
exists (j':index),
SenderA(i, j') < ReceiverB(i, j) &&
snd (output@SenderA(i, j')) = snd (input@ReceiverB(i, j)) &&
fst (fst (output@SenderA(i, j'))) = fst (fst (input@ReceiverB(i, j)))
&&
snd (snd (fst (output@SenderA(i, j')))) =
snd (snd (fst (input@ReceiverB(i, j)))) &&
cellB i@pred (ReceiverB(i, j)) ~< cellA i@SenderA(i, j')



use counterIncreaseStrictRB with i,j, SenderB(i,j0) as Hyp => //.
[> Line 426: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j0:index[const]
H1: fst (snd (fst (input@ReceiverB(i, j)))) = SIGN
H2: cellB i@pred (ReceiverB(i, j)) ~< cellB i@SenderB(i, j0)
H3: snd (input@ReceiverB(i, j)) =
hmac
(<snd (snd (fst (input@ReceiverB(i, j)))),
fst (fst (input@ReceiverB(i, j)))>,
sk i)
H4: SenderB(i, j0) < ReceiverB(i, j)
H5: snd (snd (fst (input@ReceiverB(i, j)))) = cellB i@SenderB(i, j0)
Hap: happens(ReceiverB(i, j))
Hexecpred: exec@pred (ReceiverB(i, j))
Hyp: cellB i@SenderB(i, j0) ~< cellB i@ReceiverB(i, j)
_: fst (fst (input@ReceiverB(i, j))) = msgB (i, j0)
----------------------------------------
exists (j':index),
SenderA(i, j') < ReceiverB(i, j) &&
snd (output@SenderA(i, j')) = snd (input@ReceiverB(i, j)) &&
fst (fst (output@SenderA(i, j'))) = fst (fst (input@ReceiverB(i, j)))
&&
snd (snd (fst (output@SenderA(i, j')))) =
snd (snd (fst (input@ReceiverB(i, j)))) &&
cellB i@pred (ReceiverB(i, j)) ~< cellA i@SenderA(i, j')



expand cellB(i)@ReceiverB(i,j).
[> Line 427: (expand) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j0:index[const]
H1: fst (snd (fst (input@ReceiverB(i, j)))) = SIGN
H2: cellB i@pred (ReceiverB(i, j)) ~< cellB i@SenderB(i, j0)
H3: snd (input@ReceiverB(i, j)) =
hmac
(<snd (snd (fst (input@ReceiverB(i, j)))),
fst (fst (input@ReceiverB(i, j)))>,
sk i)
H4: SenderB(i, j0) < ReceiverB(i, j)
H5: snd (snd (fst (input@ReceiverB(i, j)))) = cellB i@SenderB(i, j0)
Hap: happens(ReceiverB(i, j))
Hexecpred: exec@pred (ReceiverB(i, j))
Hyp: cellB i@SenderB(i, j0) ~< mySucc (cellB i@pred (ReceiverB(i, j)))
_: fst (fst (input@ReceiverB(i, j))) = msgB (i, j0)
----------------------------------------
exists (j':index),
SenderA(i, j') < ReceiverB(i, j) &&
snd (output@SenderA(i, j')) = snd (input@ReceiverB(i, j)) &&
fst (fst (output@SenderA(i, j'))) = fst (fst (input@ReceiverB(i, j)))
&&
snd (snd (fst (output@SenderA(i, j')))) =
snd (snd (fst (input@ReceiverB(i, j)))) &&
cellB i@pred (ReceiverB(i, j)) ~< cellA i@SenderA(i, j')



by apply orderBetween in H2.
[> Line 428: by (apply) [goal> lemma authB is proved


Qed.
lemma authB @system:(set:default; equiv:None) :
forall (i,j:index),
happens(ReceiverB(i, j)) =>
exec@ReceiverB(i, j) =>
exists (j':index),
SenderA(i, j') < ReceiverB(i, j) &&
snd (output@SenderA(i, j')) = snd (input@ReceiverB(i, j)) &&
fst (fst (output@SenderA(i, j'))) = fst (fst (input@ReceiverB(i, j)))
&&
snd (snd (fst (output@SenderA(i, j')))) =
snd (snd (fst (input@ReceiverB(i, j)))) &&
cellB i@pred (ReceiverB(i, j)) ~< cellA i@SenderA(i, j')
Exiting proof mode.




(* 2nd property w.r.t A and A *)
lemma injectivity(i,j,j':index) :
happens(ReceiverA(i,j)) && happens(ReceiverA(i,j')) =>
exec@ReceiverA(i,j) && exec@ReceiverA(i,j') =>
(fst(fst(input@ReceiverA(i,j))) = fst(fst(input@ReceiverA(i,j')))
&& snd(snd(fst(input@ReceiverA(i,j)))) = snd(snd(fst(input@ReceiverA(i,j')))))
||
(fst(fst(input@ReceiverA(i,j))) <> fst(fst(input@ReceiverA(i,j')))
&& snd(snd(fst(input@ReceiverA(i,j)))) <> snd(snd(fst(input@ReceiverA(i,j'))))).
Goal injectivity :
happens(ReceiverA(i, j'), ReceiverA(i, j)) =>
exec@ReceiverA(i, j) && exec@ReceiverA(i, j') =>
fst (fst (input@ReceiverA(i, j))) = fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) =
snd (snd (fst (input@ReceiverA(i, j')))) ||
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverA(i, j'))))




Proof.
[goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j':index
----------------------------------------
happens(ReceiverA(i, j'), ReceiverA(i, j)) =>
exec@ReceiverA(i, j) && exec@ReceiverA(i, j') =>
fst (fst (input@ReceiverA(i, j))) = fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) =
snd (snd (fst (input@ReceiverA(i, j')))) ||
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverA(i, j'))))


intro [Hap Hap'] [Hexec Hexec'].
[> Line 445: (intro) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j':index[const]
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverA(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverA(i, j')
----------------------------------------
fst (fst (input@ReceiverA(i, j))) = fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) =
snd (snd (fst (input@ReceiverA(i, j')))) ||
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverA(i, j'))))


use authA with i,j as H => //.
[> Line 446: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j':index[const]
H: exists (j':index),
SenderB(i, j') < ReceiverA(i, j) &&
snd (output@SenderB(i, j')) = snd (input@ReceiverA(i, j)) &&
fst (fst (output@SenderB(i, j'))) = fst (fst (input@ReceiverA(i, j)))
&&
snd (snd (fst (output@SenderB(i, j')))) =
snd (snd (fst (input@ReceiverA(i, j)))) &&
cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverA(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverA(i, j')
----------------------------------------
fst (fst (input@ReceiverA(i, j))) = fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) =
snd (snd (fst (input@ReceiverA(i, j')))) ||
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverA(i, j'))))


destruct H as [j1 [Ord Eq0 Eq1 Eq2 HCpt]].
[> Line 447: (destruct) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1:index[const]
Eq0: snd (output@SenderB(i, j1)) = snd (input@ReceiverA(i, j))
Eq1: fst (fst (output@SenderB(i, j1))) = fst (fst (input@ReceiverA(i, j)))
Eq2: snd (snd (fst (output@SenderB(i, j1)))) =
snd (snd (fst (input@ReceiverA(i, j))))
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverA(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverA(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
----------------------------------------
fst (fst (input@ReceiverA(i, j))) = fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) =
snd (snd (fst (input@ReceiverA(i, j')))) ||
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverA(i, j'))))


use authA with i,j' as H => //.
[> Line 448: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1:index[const]
Eq0: snd (output@SenderB(i, j1)) = snd (input@ReceiverA(i, j))
Eq1: fst (fst (output@SenderB(i, j1))) = fst (fst (input@ReceiverA(i, j)))
Eq2: snd (snd (fst (output@SenderB(i, j1)))) =
snd (snd (fst (input@ReceiverA(i, j))))
H: exists (j'0:index),
SenderB(i, j'0) < ReceiverA(i, j') &&
snd (output@SenderB(i, j'0)) = snd (input@ReceiverA(i, j')) &&
fst (fst (output@SenderB(i, j'0))) = fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (output@SenderB(i, j'0)))) =
snd (snd (fst (input@ReceiverA(i, j')))) &&
cellA i@pred (ReceiverA(i, j')) ~< cellB i@SenderB(i, j'0)
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverA(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverA(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
----------------------------------------
fst (fst (input@ReceiverA(i, j))) = fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) =
snd (snd (fst (input@ReceiverA(i, j')))) ||
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverA(i, j'))))


destruct H as [j1' [Ord' Eq0' Eq1' Eq2' HCpt']].
[> Line 449: (destruct) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: snd (output@SenderB(i, j1)) = snd (input@ReceiverA(i, j))
Eq0': snd (output@SenderB(i, j1')) = snd (input@ReceiverA(i, j'))
Eq1: fst (fst (output@SenderB(i, j1))) = fst (fst (input@ReceiverA(i, j)))
Eq1': fst (fst (output@SenderB(i, j1'))) = fst (fst (input@ReceiverA(i, j')))
Eq2: snd (snd (fst (output@SenderB(i, j1)))) =
snd (snd (fst (input@ReceiverA(i, j))))
Eq2': snd (snd (fst (output@SenderB(i, j1')))) =
snd (snd (fst (input@ReceiverA(i, j'))))
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellA i@pred (ReceiverA(i, j')) ~< cellB i@SenderB(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverA(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverA(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderB(i, j1') < ReceiverA(i, j')
----------------------------------------
fst (fst (input@ReceiverA(i, j))) = fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) =
snd (snd (fst (input@ReceiverA(i, j')))) ||
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverA(i, j'))))


expand output.
[> Line 450: (expand) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: snd
<<msgB (i, j1),<SIGN,cellB i@SenderB(i, j1)>>,
hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i)> =
snd (input@ReceiverA(i, j))
Eq0': snd
<<msgB (i, j1'),<SIGN,cellB i@SenderB(i, j1')>>,
hmac (<cellB i@SenderB(i, j1'),msgB (i, j1')>, sk i)> =
snd (input@ReceiverA(i, j'))
Eq1: fst
(fst
<<msgB (i, j1),<SIGN,cellB i@SenderB(i, j1)>>,
hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i)>) =
fst (fst (input@ReceiverA(i, j)))
Eq1': fst
(fst
<<msgB (i, j1'),<SIGN,cellB i@SenderB(i, j1')>>,
hmac (<cellB i@SenderB(i, j1'),msgB (i, j1')>, sk i)>) =
fst (fst (input@ReceiverA(i, j')))
Eq2: snd
(snd
(fst
<<msgB (i, j1),<SIGN,cellB i@SenderB(i, j1)>>,
hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i)>)) =
snd (snd (fst (input@ReceiverA(i, j))))
Eq2': snd
(snd
(fst
<<msgB (i, j1'),<SIGN,cellB i@SenderB(i, j1')>>,
hmac (<cellB i@SenderB(i, j1'),msgB (i, j1')>, sk i)>))
= snd (snd (fst (input@ReceiverA(i, j'))))
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellA i@pred (ReceiverA(i, j')) ~< cellB i@SenderB(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverA(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverA(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderB(i, j1') < ReceiverA(i, j')
----------------------------------------
fst (fst (input@ReceiverA(i, j))) = fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) =
snd (snd (fst (input@ReceiverA(i, j')))) ||
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverA(i, j'))))


simpl.
[> Line 451: (simpl) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellB i@SenderB(i, j1'),msgB (i, j1')>, sk i) =
snd (input@ReceiverA(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgB (i, j1') = fst (fst (input@ReceiverA(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellB i@SenderB(i, j1') = snd (snd (fst (input@ReceiverA(i, j'))))
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellA i@pred (ReceiverA(i, j')) ~< cellB i@SenderB(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverA(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverA(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderB(i, j1') < ReceiverA(i, j')
----------------------------------------
fst (fst (input@ReceiverA(i, j))) = fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) =
snd (snd (fst (input@ReceiverA(i, j')))) ||
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverA(i, j'))))



case (j1 = j1') => H.
[> Line 453: ((case);(intro)) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellB i@SenderB(i, j1'),msgB (i, j1')>, sk i) =
snd (input@ReceiverA(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgB (i, j1') = fst (fst (input@ReceiverA(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellB i@SenderB(i, j1') = snd (snd (fst (input@ReceiverA(i, j'))))
H: j1 = j1'
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellA i@pred (ReceiverA(i, j')) ~< cellB i@SenderB(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverA(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverA(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderB(i, j1') < ReceiverA(i, j')
----------------------------------------
fst (fst (input@ReceiverA(i, j))) = fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) =
snd (snd (fst (input@ReceiverA(i, j')))) ||
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverA(i, j'))))


+ by left.
[> Line 454: by (left) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellB i@SenderB(i, j1'),msgB (i, j1')>, sk i) =
snd (input@ReceiverA(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgB (i, j1') = fst (fst (input@ReceiverA(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellB i@SenderB(i, j1') = snd (snd (fst (input@ReceiverA(i, j'))))
H: not (j1 = j1')
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellA i@pred (ReceiverA(i, j')) ~< cellB i@SenderB(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverA(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverA(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderB(i, j1') < ReceiverA(i, j')
----------------------------------------
fst (fst (input@ReceiverA(i, j))) = fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) =
snd (snd (fst (input@ReceiverA(i, j')))) ||
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverA(i, j'))))


+ right.
[> Line 455: (right) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellB i@SenderB(i, j1'),msgB (i, j1')>, sk i) =
snd (input@ReceiverA(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgB (i, j1') = fst (fst (input@ReceiverA(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellB i@SenderB(i, j1') = snd (snd (fst (input@ReceiverA(i, j'))))
H: not (j1 = j1')
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellA i@pred (ReceiverA(i, j')) ~< cellB i@SenderB(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverA(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverA(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderB(i, j1') < ReceiverA(i, j')
----------------------------------------
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverA(i, j'))))


split;
1: by rewrite -Eq1 -Eq1' in *.
[> Line 457: ((split); 1: by (rewrite)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellB i@SenderB(i, j1'),msgB (i, j1')>, sk i) =
snd (input@ReceiverA(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgB (i, j1') = fst (fst (input@ReceiverA(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellB i@SenderB(i, j1') = snd (snd (fst (input@ReceiverA(i, j'))))
H: not (j1 = j1')
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellA i@pred (ReceiverA(i, j')) ~< cellB i@SenderB(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverA(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverA(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderB(i, j1') < ReceiverA(i, j')
----------------------------------------
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverA(i, j'))))


rewrite -Eq2 -Eq2' in *.
[> Line 458: (rewrite) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellB i@SenderB(i, j1'),msgB (i, j1')>, sk i) =
snd (input@ReceiverA(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgB (i, j1') = fst (fst (input@ReceiverA(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellB i@SenderB(i, j1') = snd (snd (fst (input@ReceiverA(i, j'))))
H: not (j1 = j1')
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellA i@pred (ReceiverA(i, j')) ~< cellB i@SenderB(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverA(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverA(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderB(i, j1') < ReceiverA(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellB i@SenderB(i, j1')


assert (SenderB(i,j1) < SenderB(i,j1') ||
SenderB(i,j1') < SenderB(i,j1)) as H0 by auto.
[> Line 460: ((have); 1: by (auto)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellB i@SenderB(i, j1'),msgB (i, j1')>, sk i) =
snd (input@ReceiverA(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgB (i, j1') = fst (fst (input@ReceiverA(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellB i@SenderB(i, j1') = snd (snd (fst (input@ReceiverA(i, j'))))
H: not (j1 = j1')
H0: SenderB(i, j1) < SenderB(i, j1') || SenderB(i, j1') < SenderB(i, j1)
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellA i@pred (ReceiverA(i, j')) ~< cellB i@SenderB(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverA(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverA(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderB(i, j1') < ReceiverA(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellB i@SenderB(i, j1')


case H0.
[> Line 461: (case) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellB i@SenderB(i, j1'),msgB (i, j1')>, sk i) =
snd (input@ReceiverA(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgB (i, j1') = fst (fst (input@ReceiverA(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellB i@SenderB(i, j1') = snd (snd (fst (input@ReceiverA(i, j'))))
H: not (j1 = j1')
H0: SenderB(i, j1) < SenderB(i, j1')
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellA i@pred (ReceiverA(i, j')) ~< cellB i@SenderB(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverA(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverA(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderB(i, j1') < ReceiverA(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellB i@SenderB(i, j1')



(* SenderB(i,j1) < SenderB(i,j1') *)
- use counterIncreaseStrictSB with i, j1', SenderB(i,j1) => //=.
[> Line 464: ((have);(intro)) [goal> Focused goal (1/3):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellB i@SenderB(i, j1'),msgB (i, j1')>, sk i) =
snd (input@ReceiverA(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgB (i, j1') = fst (fst (input@ReceiverA(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellB i@SenderB(i, j1') = snd (snd (fst (input@ReceiverA(i, j'))))
H: j1 <> j1'
H0: SenderB(i, j1) < SenderB(i, j1')
H1: cellB i@SenderB(i, j1) ~< cellB i@SenderB(i, j1')
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellA i@pred (ReceiverA(i, j')) ~< cellB i@SenderB(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverA(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverA(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderB(i, j1') < ReceiverA(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellB i@SenderB(i, j1')


intro U; by apply orderStrict in U.
[> Line 465: ((intro);by (apply)) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellB i@SenderB(i, j1'),msgB (i, j1')>, sk i) =
snd (input@ReceiverA(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgB (i, j1') = fst (fst (input@ReceiverA(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellB i@SenderB(i, j1') = snd (snd (fst (input@ReceiverA(i, j'))))
H: j1 <> j1'
H0: SenderB(i, j1) < SenderB(i, j1')
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellA i@pred (ReceiverA(i, j')) ~< cellB i@SenderB(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverA(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverA(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderB(i, j1') < ReceiverA(i, j')
----------------------------------------
exec@pred (SenderB(i, j1'))


executable ReceiverA(i,j') => // HexecPred'.
[> Line 466: ((executable);(intro)) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellB i@SenderB(i, j1'),msgB (i, j1')>, sk i) =
snd (input@ReceiverA(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgB (i, j1') = fst (fst (input@ReceiverA(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellB i@SenderB(i, j1') = snd (snd (fst (input@ReceiverA(i, j'))))
H: j1 <> j1'
H0: SenderB(i, j1) < SenderB(i, j1')
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellA i@pred (ReceiverA(i, j')) ~< cellB i@SenderB(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverA(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverA(i, j')
HexecPred': forall (t:timestamp), t <= ReceiverA(i, j') => exec@t
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderB(i, j1') < ReceiverA(i, j')
----------------------------------------
exec@pred (SenderB(i, j1'))


by apply HexecPred'.
[> Line 467: by (apply) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellB i@SenderB(i, j1'),msgB (i, j1')>, sk i) =
snd (input@ReceiverA(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgB (i, j1') = fst (fst (input@ReceiverA(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellB i@SenderB(i, j1') = snd (snd (fst (input@ReceiverA(i, j'))))
H: not (j1 = j1')
H0: SenderB(i, j1') < SenderB(i, j1)
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellA i@pred (ReceiverA(i, j')) ~< cellB i@SenderB(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverA(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverA(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderB(i, j1') < ReceiverA(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellB i@SenderB(i, j1')



(* SenderB(i,j1') < SenderB(i,j1) *)
- use counterIncreaseStrictSB with i, j1, SenderB(i,j1') => //=.
[> Line 470: ((have);(intro)) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellB i@SenderB(i, j1'),msgB (i, j1')>, sk i) =
snd (input@ReceiverA(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgB (i, j1') = fst (fst (input@ReceiverA(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellB i@SenderB(i, j1') = snd (snd (fst (input@ReceiverA(i, j'))))
H: j1 <> j1'
H0: SenderB(i, j1') < SenderB(i, j1)
H1: cellB i@SenderB(i, j1') ~< cellB i@SenderB(i, j1)
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellA i@pred (ReceiverA(i, j')) ~< cellB i@SenderB(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverA(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverA(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderB(i, j1') < ReceiverA(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellB i@SenderB(i, j1')


* intro U.
[> Line 470: (intro) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellB i@SenderB(i, j1'),msgB (i, j1')>, sk i) =
snd (input@ReceiverA(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgB (i, j1') = fst (fst (input@ReceiverA(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellB i@SenderB(i, j1') = snd (snd (fst (input@ReceiverA(i, j'))))
H: j1 <> j1'
H0: SenderB(i, j1') < SenderB(i, j1)
H1: cellB i@SenderB(i, j1') ~< cellB i@SenderB(i, j1)
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellA i@pred (ReceiverA(i, j')) ~< cellB i@SenderB(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverA(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverA(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderB(i, j1') < ReceiverA(i, j')
U: cellB i@SenderB(i, j1) = cellB i@SenderB(i, j1')
----------------------------------------
false

rewrite eq_sym in U; by apply orderStrict in U. [> Line 471: ((rewrite);by (apply)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellB i@SenderB(i, j1'),msgB (i, j1')>, sk i) =
snd (input@ReceiverA(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgB (i, j1') = fst (fst (input@ReceiverA(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellB i@SenderB(i, j1') = snd (snd (fst (input@ReceiverA(i, j'))))
H: j1 <> j1'
H0: SenderB(i, j1') < SenderB(i, j1)
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellA i@pred (ReceiverA(i, j')) ~< cellB i@SenderB(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverA(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverA(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderB(i, j1') < ReceiverA(i, j')
----------------------------------------
exec@pred (SenderB(i, j1))


* executable ReceiverA(i,j) => // HexecPred.
[> Line 471: ((executable);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellB i@SenderB(i, j1'),msgB (i, j1')>, sk i) =
snd (input@ReceiverA(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgB (i, j1') = fst (fst (input@ReceiverA(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellB i@SenderB(i, j1') = snd (snd (fst (input@ReceiverA(i, j'))))
H: j1 <> j1'
H0: SenderB(i, j1') < SenderB(i, j1)
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellA i@pred (ReceiverA(i, j')) ~< cellB i@SenderB(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverA(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverA(i, j')
HexecPred: forall (t:timestamp), t <= ReceiverA(i, j) => exec@t
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderB(i, j1') < ReceiverA(i, j')
----------------------------------------
exec@pred (SenderB(i, j1))

by apply HexecPred. [> Line 472: by (apply) [goal> lemma injectivity is proved


Qed.
lemma injectivity @system:(set:default; equiv:None) :
forall (i,j,j':index),
happens(ReceiverA(i, j'), ReceiverA(i, j)) =>
exec@ReceiverA(i, j) && exec@ReceiverA(i, j') =>
fst (fst (input@ReceiverA(i, j))) = fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) =
snd (snd (fst (input@ReceiverA(i, j')))) ||
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverA(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverA(i, j'))))
Exiting proof mode.




(* 2nd property w.r.t A and B *)
lemma injectivityAB(i,j,j':index) :
happens(ReceiverA(i,j)) && happens(ReceiverB(i,j')) =>
exec@ReceiverA(i,j) && exec@ReceiverB(i,j') =>
(fst(fst(input@ReceiverA(i,j))) = fst(fst(input@ReceiverB(i,j')))
&& snd(snd(fst(input@ReceiverA(i,j)))) = snd(snd(fst(input@ReceiverB(i,j')))))
||
(fst(fst(input@ReceiverA(i,j))) <> fst(fst(input@ReceiverB(i,j')))
&& snd(snd(fst(input@ReceiverA(i,j)))) <> snd(snd(fst(input@ReceiverB(i,j'))))).
Goal injectivityAB :
happens(ReceiverB(i, j'), ReceiverA(i, j)) =>
exec@ReceiverA(i, j) && exec@ReceiverB(i, j') =>
fst (fst (input@ReceiverA(i, j))) = fst (fst (input@ReceiverB(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) =
snd (snd (fst (input@ReceiverB(i, j')))) ||
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverB(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverB(i, j'))))


Proof.
[goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j':index
----------------------------------------
happens(ReceiverB(i, j'), ReceiverA(i, j)) =>
exec@ReceiverA(i, j) && exec@ReceiverB(i, j') =>
fst (fst (input@ReceiverA(i, j))) = fst (fst (input@ReceiverB(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) =
snd (snd (fst (input@ReceiverB(i, j')))) ||
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverB(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverB(i, j'))))


intro [Hap Hap'] [Hexec Hexec'].
[> Line 487: (intro) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j':index[const]
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
----------------------------------------
fst (fst (input@ReceiverA(i, j))) = fst (fst (input@ReceiverB(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) =
snd (snd (fst (input@ReceiverB(i, j')))) ||
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverB(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverB(i, j'))))


use authA with i,j as H => //.
[> Line 488: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j':index[const]
H: exists (j':index),
SenderB(i, j') < ReceiverA(i, j) &&
snd (output@SenderB(i, j')) = snd (input@ReceiverA(i, j)) &&
fst (fst (output@SenderB(i, j'))) = fst (fst (input@ReceiverA(i, j)))
&&
snd (snd (fst (output@SenderB(i, j')))) =
snd (snd (fst (input@ReceiverA(i, j)))) &&
cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
----------------------------------------
fst (fst (input@ReceiverA(i, j))) = fst (fst (input@ReceiverB(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) =
snd (snd (fst (input@ReceiverB(i, j')))) ||
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverB(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverB(i, j'))))


destruct H as [j1 [Ord Eq0 Eq1 Eq2 HCpt]].
[> Line 489: (destruct) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1:index[const]
Eq0: snd (output@SenderB(i, j1)) = snd (input@ReceiverA(i, j))
Eq1: fst (fst (output@SenderB(i, j1))) = fst (fst (input@ReceiverA(i, j)))
Eq2: snd (snd (fst (output@SenderB(i, j1)))) =
snd (snd (fst (input@ReceiverA(i, j))))
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
----------------------------------------
fst (fst (input@ReceiverA(i, j))) = fst (fst (input@ReceiverB(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) =
snd (snd (fst (input@ReceiverB(i, j')))) ||
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverB(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverB(i, j'))))


use authB with i,j' as H => //.
[> Line 490: ((have);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1:index[const]
Eq0: snd (output@SenderB(i, j1)) = snd (input@ReceiverA(i, j))
Eq1: fst (fst (output@SenderB(i, j1))) = fst (fst (input@ReceiverA(i, j)))
Eq2: snd (snd (fst (output@SenderB(i, j1)))) =
snd (snd (fst (input@ReceiverA(i, j))))
H: exists (j'0:index),
SenderA(i, j'0) < ReceiverB(i, j') &&
snd (output@SenderA(i, j'0)) = snd (input@ReceiverB(i, j')) &&
fst (fst (output@SenderA(i, j'0))) = fst (fst (input@ReceiverB(i, j')))
&&
snd (snd (fst (output@SenderA(i, j'0)))) =
snd (snd (fst (input@ReceiverB(i, j')))) &&
cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j'0)
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
----------------------------------------
fst (fst (input@ReceiverA(i, j))) = fst (fst (input@ReceiverB(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) =
snd (snd (fst (input@ReceiverB(i, j')))) ||
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverB(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverB(i, j'))))


destruct H as [j1' [Ord' Eq0' Eq1' Eq2' HCpt']].
[> Line 491: (destruct) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: snd (output@SenderB(i, j1)) = snd (input@ReceiverA(i, j))
Eq0': snd (output@SenderA(i, j1')) = snd (input@ReceiverB(i, j'))
Eq1: fst (fst (output@SenderB(i, j1))) = fst (fst (input@ReceiverA(i, j)))
Eq1': fst (fst (output@SenderA(i, j1'))) = fst (fst (input@ReceiverB(i, j')))
Eq2: snd (snd (fst (output@SenderB(i, j1)))) =
snd (snd (fst (input@ReceiverA(i, j))))
Eq2': snd (snd (fst (output@SenderA(i, j1')))) =
snd (snd (fst (input@ReceiverB(i, j'))))
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
fst (fst (input@ReceiverA(i, j))) = fst (fst (input@ReceiverB(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) =
snd (snd (fst (input@ReceiverB(i, j')))) ||
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverB(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverB(i, j'))))


expand output.
[> Line 492: (expand) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: snd
<<msgB (i, j1),<SIGN,cellB i@SenderB(i, j1)>>,
hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i)> =
snd (input@ReceiverA(i, j))
Eq0': snd
<<msgA (i, j1'),<SIGN,cellA i@SenderA(i, j1')>>,
hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i)> =
snd (input@ReceiverB(i, j'))
Eq1: fst
(fst
<<msgB (i, j1),<SIGN,cellB i@SenderB(i, j1)>>,
hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i)>) =
fst (fst (input@ReceiverA(i, j)))
Eq1': fst
(fst
<<msgA (i, j1'),<SIGN,cellA i@SenderA(i, j1')>>,
hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i)>) =
fst (fst (input@ReceiverB(i, j')))
Eq2: snd
(snd
(fst
<<msgB (i, j1),<SIGN,cellB i@SenderB(i, j1)>>,
hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i)>)) =
snd (snd (fst (input@ReceiverA(i, j))))
Eq2': snd
(snd
(fst
<<msgA (i, j1'),<SIGN,cellA i@SenderA(i, j1')>>,
hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i)>))
= snd (snd (fst (input@ReceiverB(i, j'))))
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
fst (fst (input@ReceiverA(i, j))) = fst (fst (input@ReceiverB(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) =
snd (snd (fst (input@ReceiverB(i, j')))) ||
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverB(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverB(i, j'))))


simpl.
[> Line 493: (simpl) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
fst (fst (input@ReceiverA(i, j))) = fst (fst (input@ReceiverB(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) =
snd (snd (fst (input@ReceiverB(i, j')))) ||
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverB(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverB(i, j'))))



rewrite -Eq1 -Eq1' -Eq2 -Eq2' in *.
[> Line 495: (rewrite) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
msgB (i, j1) = msgA (i, j1') &&
cellB i@SenderB(i, j1) = cellA i@SenderA(i, j1') ||
msgB (i, j1) <> msgA (i, j1') &&
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')



right.
[> Line 497: (right) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
msgB (i, j1) <> msgA (i, j1') &&
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')


split => //.
[> Line 498: ((split);(intro)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')



assert (SenderB(i,j1) < ReceiverB(i,j') ||
ReceiverB(i,j') < SenderB(i,j1)) as H by auto.
[> Line 501: ((have); 1: by (auto)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: SenderB(i, j1) < ReceiverB(i, j') || ReceiverB(i, j') < SenderB(i, j1)
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')


case H.
[> Line 502: (case) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: SenderB(i, j1) < ReceiverB(i, j')
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')



+ (* SenderB(i,j1) < ReceiverB(i,j') *)
use counterIncreaseStrictRB with i, j',SenderB(i,j1) as Meq => //.
[> Line 505: ((have);(intro)) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: SenderB(i, j1) < ReceiverB(i, j')
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Meq: cellB i@SenderB(i, j1) ~< cellB i@ReceiverB(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')


expand cellB(i)@ReceiverB(i,j').
[> Line 506: (expand) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: SenderB(i, j1) < ReceiverB(i, j')
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Meq: cellB i@SenderB(i, j1) ~< mySucc (cellB i@pred (ReceiverB(i, j')))
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')


apply orderEqSucc in Meq.
[> Line 507: (apply) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: SenderB(i, j1) < ReceiverB(i, j')
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Meq: cellB i@SenderB(i, j1) = cellB i@pred (ReceiverB(i, j')) ||
cellB i@SenderB(i, j1) ~< cellB i@pred (ReceiverB(i, j'))
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')


case Meq.
[> Line 508: (case) [goal> Focused goal (1/3):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: SenderB(i, j1) < ReceiverB(i, j')
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Meq: cellB i@SenderB(i, j1) = cellB i@pred (ReceiverB(i, j'))
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')



- rewrite -Meq in HCpt'.
[> Line 510: (rewrite) [goal> Focused goal (1/3):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: SenderB(i, j1) < ReceiverB(i, j')
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@SenderB(i, j1) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Meq: cellB i@SenderB(i, j1) = cellB i@pred (ReceiverB(i, j'))
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')


intro U.
[> Line 511: (intro) [goal> Focused goal (1/3):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: SenderB(i, j1) < ReceiverB(i, j')
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@SenderB(i, j1) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Meq: cellB i@SenderB(i, j1) = cellB i@pred (ReceiverB(i, j'))
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
U: cellB i@SenderB(i, j1) = cellA i@SenderA(i, j1')
----------------------------------------
false


by apply orderStrict in U.
[> Line 512: by (apply) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: SenderB(i, j1) < ReceiverB(i, j')
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Meq: cellB i@SenderB(i, j1) ~< cellB i@pred (ReceiverB(i, j'))
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')



- use orderTrans with cellB(i)@SenderB(i,j1), cellB(i)@pred(ReceiverB(i,j')), cellA(i)@SenderA(i,j1') => //.
[> Line 514: ((have);(intro)) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: SenderB(i, j1) < ReceiverB(i, j')
H0: cellB i@SenderB(i, j1) ~< cellA i@SenderA(i, j1')
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Meq: cellB i@SenderB(i, j1) ~< cellB i@pred (ReceiverB(i, j'))
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')


by intro U; apply orderStrict in U.
[> Line 515: by ((intro);(apply)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: ReceiverB(i, j') < SenderB(i, j1)
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')



+ (* ReceiverB(i,j') < SenderB(i,j1) *)
assert (SenderA(i,j1') <ReceiverA(i,j) || ReceiverA(i,j) <SenderA(i,j1')) as H0 by auto.
[> Line 518: ((have); 1: by (auto)) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: ReceiverB(i, j') < SenderB(i, j1)
H0: SenderA(i, j1') < ReceiverA(i, j) || ReceiverA(i, j) < SenderA(i, j1')
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')


case H0.
[> Line 519: (case) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: ReceiverB(i, j') < SenderB(i, j1)
H0: SenderA(i, j1') < ReceiverA(i, j)
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')



- (* SenderA(i,j1') < ReceiverA(i,j) *)
use counterIncreaseStrictRA with i, j,SenderA(i,j1') as Meq => //.
[> Line 522: ((have);(intro)) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: ReceiverB(i, j') < SenderB(i, j1)
H0: SenderA(i, j1') < ReceiverA(i, j)
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Meq: cellA i@SenderA(i, j1') ~< cellA i@ReceiverA(i, j)
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')


expand cellA(i)@ReceiverA(i,j).
[> Line 523: (expand) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: ReceiverB(i, j') < SenderB(i, j1)
H0: SenderA(i, j1') < ReceiverA(i, j)
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Meq: cellA i@SenderA(i, j1') ~< mySucc (cellA i@pred (ReceiverA(i, j)))
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')


apply orderEqSucc in Meq.
[> Line 524: (apply) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: ReceiverB(i, j') < SenderB(i, j1)
H0: SenderA(i, j1') < ReceiverA(i, j)
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Meq: cellA i@SenderA(i, j1') = cellA i@pred (ReceiverA(i, j)) ||
cellA i@SenderA(i, j1') ~< cellA i@pred (ReceiverA(i, j))
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')


case Meq.
[> Line 525: (case) [goal> Focused goal (1/3):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: ReceiverB(i, j') < SenderB(i, j1)
H0: SenderA(i, j1') < ReceiverA(i, j)
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Meq: cellA i@SenderA(i, j1') = cellA i@pred (ReceiverA(i, j))
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')



* rewrite -Meq in HCpt.
[> Line 526: (rewrite) [goal> Focused goal (1/3):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: ReceiverB(i, j') < SenderB(i, j1)
H0: SenderA(i, j1') < ReceiverA(i, j)
HCpt: cellA i@SenderA(i, j1') ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Meq: cellA i@SenderA(i, j1') = cellA i@pred (ReceiverA(i, j))
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')

intro U. [> Line 526: (intro) [goal> Focused goal (1/3):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: ReceiverB(i, j') < SenderB(i, j1)
H0: SenderA(i, j1') < ReceiverA(i, j)
HCpt: cellA i@SenderA(i, j1') ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Meq: cellA i@SenderA(i, j1') = cellA i@pred (ReceiverA(i, j))
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
U: cellB i@SenderB(i, j1) = cellA i@SenderA(i, j1')
----------------------------------------
false

rewrite eq_sym in U. [> Line 526: (rewrite) [goal> Focused goal (1/3):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: ReceiverB(i, j') < SenderB(i, j1)
H0: SenderA(i, j1') < ReceiverA(i, j)
HCpt: cellA i@SenderA(i, j1') ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Meq: cellA i@SenderA(i, j1') = cellA i@pred (ReceiverA(i, j))
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
U: cellA i@SenderA(i, j1') = cellB i@SenderB(i, j1)
----------------------------------------
false

by apply orderStrict in U. [> Line 527: by (apply) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: ReceiverB(i, j') < SenderB(i, j1)
H0: SenderA(i, j1') < ReceiverA(i, j)
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Meq: cellA i@SenderA(i, j1') ~< cellA i@pred (ReceiverA(i, j))
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')


* use orderTrans with cellA(i)@SenderA(i,j1'), cellA(i)@pred(ReceiverA(i,j)), cellB(i)@SenderB(i,j1) => //.
[> Line 528: ((have);(intro)) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: ReceiverB(i, j') < SenderB(i, j1)
H0: SenderA(i, j1') < ReceiverA(i, j)
H1: cellA i@SenderA(i, j1') ~< cellB i@SenderB(i, j1)
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Meq: cellA i@SenderA(i, j1') ~< cellA i@pred (ReceiverA(i, j))
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')


intro U.
[> Line 529: (intro) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: ReceiverB(i, j') < SenderB(i, j1)
H0: SenderA(i, j1') < ReceiverA(i, j)
H1: cellA i@SenderA(i, j1') ~< cellB i@SenderB(i, j1)
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Meq: cellA i@SenderA(i, j1') ~< cellA i@pred (ReceiverA(i, j))
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
U: cellB i@SenderB(i, j1) = cellA i@SenderA(i, j1')
----------------------------------------
false


rewrite eq_sym in U.
[> Line 530: (rewrite) [goal> Focused goal (1/2):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: ReceiverB(i, j') < SenderB(i, j1)
H0: SenderA(i, j1') < ReceiverA(i, j)
H1: cellA i@SenderA(i, j1') ~< cellB i@SenderB(i, j1)
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Meq: cellA i@SenderA(i, j1') ~< cellA i@pred (ReceiverA(i, j))
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
U: cellA i@SenderA(i, j1') = cellB i@SenderB(i, j1)
----------------------------------------
false


by apply orderStrict in U.
[> Line 531: by (apply) [goal> Focused goal (1/1):
System: (set:default; equiv:None)
Variables: i,j,j',j1,j1':index[const]
Eq0: hmac (<cellB i@SenderB(i, j1),msgB (i, j1)>, sk i) =
snd (input@ReceiverA(i, j))
Eq0': hmac (<cellA i@SenderA(i, j1'),msgA (i, j1')>, sk i) =
snd (input@ReceiverB(i, j'))
Eq1: msgB (i, j1) = fst (fst (input@ReceiverA(i, j)))
Eq1': msgA (i, j1') = fst (fst (input@ReceiverB(i, j')))
Eq2: cellB i@SenderB(i, j1) = snd (snd (fst (input@ReceiverA(i, j))))
Eq2': cellA i@SenderA(i, j1') = snd (snd (fst (input@ReceiverB(i, j'))))
H: ReceiverB(i, j') < SenderB(i, j1)
H0: ReceiverA(i, j) < SenderA(i, j1')
HCpt: cellA i@pred (ReceiverA(i, j)) ~< cellB i@SenderB(i, j1)
HCpt': cellB i@pred (ReceiverB(i, j')) ~< cellA i@SenderA(i, j1')
Hap: happens(ReceiverA(i, j))
Hap': happens(ReceiverB(i, j'))
Hexec: exec@ReceiverA(i, j)
Hexec': exec@ReceiverB(i, j')
Ord: SenderB(i, j1) < ReceiverA(i, j)
Ord': SenderA(i, j1') < ReceiverB(i, j')
----------------------------------------
cellB i@SenderB(i, j1) <> cellA i@SenderA(i, j1')



- (* ReceiverA(i,j) < SenderA(i,j1') *)
(* We have SendB < ReceiveA < SendA < ReceiveB < SendB ==> contradiction *)
auto.
[> Line 535: (auto) [goal> lemma injectivityAB is proved


Qed.
lemma injectivityAB @system:(set:default; equiv:None) :
forall (i,j,j':index),
happens(ReceiverB(i, j'), ReceiverA(i, j)) =>
exec@ReceiverA(i, j) && exec@ReceiverB(i, j') =>
fst (fst (input@ReceiverA(i, j))) = fst (fst (input@ReceiverB(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) =
snd (snd (fst (input@ReceiverB(i, j')))) ||
fst (fst (input@ReceiverA(i, j))) <> fst (fst (input@ReceiverB(i, j')))
&&
snd (snd (fst (input@ReceiverA(i, j)))) <>
snd (snd (fst (input@ReceiverB(i, j'))))
Exiting proof mode.

Press the left and right arrows to do and undo an instruction.

Alternatively, you can double-click on an instruction.

This zone shows a Squirrel file. You can double-click on a comment to collapse it for better readabilility.

This zone shows the output given by Squirrel.

This zone shows the output of the previous instruction, to help identifying the change caused by the instruction.

Previously: