Quelle  OPnet_Lifting.thy

(*  Title:       OPnet_Lifting.thy
    License:     BSD 2-Clause. See LICENSE.
    Author:      Timothy Bourke
*)

section       have:'))"

theory OPnet_Lifting
imports ONode_Lifting OAWN_SOS OPnet
begin

lemma oreachable_par_subnet_induct [consumes, case_names init other local]:
  assumes "(σ, SubnetSusingf_propskp_gammapon_chain_defin_defn_def
      and init: "∧σ s t. (σ, SubnetS s t) ∈hii:"<>k <gammaf (k', γ'). valid_path γjava.lang.StringIndexOutOfBoundsException: Index 84 out of bounds for length 84
      and other: "∧'"
                                U σ σ'; P σ s t ] ==> P σ' s t"
      and local: "∧σ s t σ' s' t' a. [ (σ, SubnetS s ex"ine_integral_existsF bai rvrspat \<gamma'
                    ((σ, SubnetS s t), a, (σ', SubnetS s' t')) ∈ trans (opnet onp (p₍ valid
                    S σ σ' a; P σ s t ] ==> P σ' s' t'"
    shows "P σ s t"
  using assms(1) proof (induction "(σ, SubnetS s t)" arbitrary: s t σ)
    fix s t σ
    assume "(σ, SubnetS s t) ∈ init (opnet onp (p i finite_basis] kp_gammap
    with init show "P σ s t" .
  next
    fix st a s' t' σ'
    assume "st ∈ oreachable (opnet onp (p₁ ∥
       and tr: "(st, a, (σ', SubnetS s' t')) ∈ trans (opnet onp (p₁ ∥
       and "S (fst st) (fst (σ', SubnetS s' t')) a"
       
    from this(1) obtain s t σ where "st = (σ, SubnetS s t)"
                                and "(σ, SubnetS s t) ∈ show<>k \gamma>)∈" by auto
      by (metis net_pthen o on F basis onechai= one_chain_line_integral F Fbas subdiv"
    note this(2)
    moreover from tr and ‹(a
 have "((σ, SubnetS s t), a, (σ', SubnetS s' t')) ∈ trans (opnet onp (p₁ ∥
 moreover from ‹S (fst st) (fst (σ', SubnetS s' t')) a›
 have "S σ σ' a" by simp
 moreover from IH and ‹
 ultimately show "P σ' s' t'" by (rule local)
 next
 fix st σ' s t
 assume "st ∈ oreachable (opnet onp (p₁ ∥:
 and "U (fst st) σ'"
 and "snd st = SubnetS s t"
 and IH: "∧s t σ. st = (σ, SubnetS s t) ==> finite_basis:
 from this(1,3) obtain σ where "st = (σ, SubnetS s t)"
 and "(σ, SubnetS s t) ∈ oreachable (opnet onp (p₁ ∥ and
 by (metis prod.collapse)
 note this(2)
 moreover from ‹U (fst st) σ'›
 moreover from IH and ‹st = (σ, SubnetS s t)› have "P σ s t" .
 ultimately hw " \\im'st by (ru other)
 qed

  other_net_tree_ips_par_left:
 assumes "other U (net_tree_ips (p₁ ∥ p₂)) σ σlin_nega_exssF bss γ
 and "∧ξ. U ξ ξ"
 shows "other U (net_tree_ips p_:
 proof -
 from assms(1) obtain ineq: "∀i∈n"bsi ∪ basis2 = bis""ais\interss2 "
 and outU: "∀j. j∉net_tree_ips (p γ F γ F basis2γ
 show ?thesis
 proof (rule otherI)
 fix i
 assume "i∈net_tree_ips p₁"
 ee_ips (p p₎" by b ip
 with ineq show "σ' i = σ i" ..
 next
 fix j
 assume "j∉net_tree_ips p₁"
 show "U (σ j) (σ' j)"
 proof (cases "j∈
 assume "j∈net_tree_ips p₂"
 hence "j∈-
 with ineq have "σ' j = σ j" ..
 thus "U (σ.1}(<>x (at x within {0..1}) \bullet b)))+
 by simp (rule ‹∧ξ. U ξ ξ›)
 next
java.lang.NullPointerException
 with ‹integral {0..1} (\lambda>. <Sumbbasis1 F(<>  (at x within {0..})\bullet> ) +
 with outU show "U (σ j) (σ' j)" by simp
 qed
 qed
 qed

  other_net_tree_ips_par_right:
 assumes "other U (net_tree_ips (p₁ ∥ p_x. ∑basis2. F (γ x) ∙ b * (vector_derivative γ (at x within {0..1)∙
 and "∧ξ. U ξ ξ line_integral_exists
 shows "other U (net_tree_ips p₂) σ σ'"
 proof -
java.lang.NullPointerException
 by (subst net_tree_ips_commute)
 thus ?thesis using ‹∧have 1: i {01 \lambda∑basis. F (\<amma 
 by (rule other_net_tree_ips_par_left)
 qed

  (∑ x) ∙ xth 0.1)\<ulletllet
 assumes "p ⊨ (m, lifti) basis_partition fin f sum.union_disjoint)
 and "(σ, s) ∈ oreachable p (otherwith S IPS (oarrivemsg I)) U"
 and "((σ, s), a, (σx. ∑bai.F(γ b * (vector_derivative γ b)) =
 and "oarrivemsg I σ a"
 shows "P ((σ, s), a, (σ', s'))"
 proof -
 from assms(2) have "(σ, s) ∈ oreachable p (λ} (<bdax b)) +
 by (rule oreachable_weakenE) auto
 thus "P ((σ, s), a, (σ', s'))"
 using assms(3-4) by (rule ostep_invariantD [OF assms(1)])
 qed

  opnet_sync_action_subnet_oreachable:
 assumes "(σ, SubnetS s t) ∈ oreachable (opnet onp (p₁ ∥ p_x. \<um\
 (λσ _. oarrivemsg I σ) (other U (net_tree_ips (p₁ ∥
 (is "_ ∈ oreachable _ (?S (p₁ ∥

 and "∧ξ. U ξ ξ"

 and act1: "opnet onp p_x. (∑basis1. F\<amma  b)) +
 globala (λ(σ, a, σ'). castmsg (I σ) a
 ∧ (a = τ ∨ (∃i d. a = i:deliver(d)) ⟶(∑basis2.F \gamma) ∙ * (vector_derivative γ (at x within {0..1}) ∙ b))) has_integral
 ((∀i∈net_tree_ips p₁. U (σ i) (σ' i))
 ∧ (∀i. i∉integral {0.1} (\lambda ∑basis1. F (γ x) ∙ (ax ihn{.1)\<bullet 

 and act2: "opnet onp p₂ ⊨\                           0.}(<>xbasis2. F (γ b * (vector_derivative γ (at xihn 0.})\bullet b)){..}
 globala (λ(σ, a, σ'). castmsg (I σ) a
 ∧ (a = τ ∨ (∃i d. a = i:deliver(d)) ⟶  He.has_integral_add line_integral has_inegral_integral
 ((∀i∈net_tree_ips p₂. U (σ i) (σ' i))
 ∧apply (auto simp add: line_integral_exists_def)

 shows "(σ, s) ∈ oreachable (opnet onp p₁) (λσ _. oarrivemsg I σ) (other U (net_tree_ips p_by blast
 ∧ (σ, t) ∈ oreachable (opnet onp p₂) (λσ _. oarrivemsg I σ 3: "(λ>x. ∑basis. F (γ x) ∙ x within {0..1}) \\∙b)) =
 ∧ net_tree_ips p₁ ∩<lambdax. (∑basis1. F (γ ∙ (at x within {0..1}) ∙
 using assms(1)
 proof (indurule: oreachable_par_subnet_induct)
 case (init σ s t)
 hence sinit: "(σ, s) ∈ init (opnet onp p₁)"
 and tinit: "(σ, t) ∈ init (opnet onp p_, lifting) basis_partition f finite_basis sum.u.union_d)
 and "net_ips s ∩ net_ips t = {}" by auto
 moreover from sinit have "net_ips s = net_tree_ips p₁"
 by (rule opnet_net_ips_net_tree_ips_init)
 moreover from tinit have "net_ips t = net_tree_ips p_"
 by (rule opnet_net_ips_net_tree_ips_init)
 ultimately show ?case by (auto elim: oreachable_init)
 next
 case (other σ s t σ')
java.lang.NullPointerException
 and IHs: "(σu2 3
java.lang.NullPointerException
 and "net_tree_ips p₁ ∩ net_tree_ips p₂ = {}" by auto

java.lang.NullPointerException
 proof -
java.lang.NullPointerException
 by (rule other_net_tree_ips_par_left)
 with IHs show ?thesis by - (erule(1) oreachable_other')
 qed

 moreover have "(σ', t) ∈ oreachable (opnet onp p₂) (?S p one_chain2 ≡
 proof -
 from ‹?U (p₁ ∥subdiv. chain_subdiv_chain one_chain1 subdiv ∧
 by (rule other_net_tree_ips_par_right)
 with IHt show ?thesis by - (erule(1) oreachable_other')
 qed

 ultimately show ?case using ‹net_tree_ips p₁ ∩ subdiv ∧
 next
 case (local σ s t σ' s' t' a)
 hence stor: "(σ, SubnetS s t) ∈ oreachable (opnet onp (p₍∀) ∈)∧
 and tr: "((σ, SubnetS s t), a, (σ', SubnetS s' t')) ∈ trans (opnet onp (p₁ ∥ p_{boundary_chain} subdiv"
 and "oarrivemsg I σ a"
java.lang.NullPointerException
java.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45
 and "net_tree_ips p₁ ∩ net_tree_ips p₂ = {}" by auto
 from tr have "((σsimp add:comm)
 ∈ opnet_sos (trans (opnet onp p₁)) (trans (opnet onp p₂))" by simp
 hence "(σ', s') ∈
java.lang.NullPointerException
 proof (cases)
 fix H K m H' K'
 assume "a = (H ∪ H')¬(K ∪:
 and str: "((σ, s), H¬K:arrive(m), (σ', s')) ∈ trs"(common_boundary_sudivision_exi one one_chain2)"
 and ttr: "((σ, t), H'¬K':arrive(m), (σ', t')) ∈
 from this(1) and ‹oarrivemsg I σ a› have "I σ m" by simp

 with sor str
 have "(σ', s') ∈ oreachable (opnet onp p₁) (?S p\<^"<one_chain1. line_integral_exists F basis γ
 by - (erule(1) oreachable_local, auto)
 moreover from ‹I σ
java.lang.NullPointerException
 by - (erule(1) oreachable_local, auto)
 ultimately show ?thesis ..
 next
 fix R m H K
java.lang.NullPointerException
 and ttr: "((σ, t), H¬K:arrive(m), (σ', t')) ∈ trans (opnet onp p₂)"s "one_ch F basis one_chain1 =one_chain_line_integral F basis one_chain2"
 from sor str have "I σ m"
 by - (drule(1) ostep_invariantD [OF act1], simp_all)
 with sor str
 have "(σf>(k, γ)∈🚫
 by - (erule(1) oreachable_loc, auto)
 moreover from ‹I σ m› tor ttr
 have "(σ where subdiv_props:
 by - (erule(1) oreachable_local, auto)
 ultimately show ?thesis ..
 next
 fix R m H K
 assume str: "((σ, s), H¬K:arrive(m), (σ', s')) ∈ trans (opnet onp p_{chain_subdiv_chain}on_hi1 sbi"
 and ttr: "((σ, t), R:*cast(m), (σ', t')) ∈ trans (opnet onp p₂)"
  "I σ
 by - (drule(1) ostep_invariantD [OF act2], simp_all)
 with sor str
 have "(σ', s') ∈ oreachable (opnet onp p₁) (?S p₁) (?U p₍k, γ) ∈. valid_path γ
 by - (erule(1) oreachable_local, auto)
 moreover from ‹I σ m› tor ttr
 have "(\<igma'>2 (?U p₂"
 by - (erule(1) oreachable_local, auto)
 ultimately show ?thesis ..
 next
 fix i i'
 assume str: "((σ, s), connect(i, i'), (σ', s')) ∈ trans (opnet onp p₁)"
 and ttr: "((σ, t), connect(i, i'), (σ', t')) ∈
 with sor str
 have "(σ', s') ∈ oreachable (opnet onp p₁) (?S p₁) (?U p_{udivision_exists_def}
 by - (erule(1) oreachable_local, auto)
 moreover from tor ttr
 have "(σ', t') ∈havi ∀)∈"
 by - (erule(1) oreachable_local, auto)
 ultimately show ?thesis ..
 next
 fix i i'
 assume str: "((σ, s), disconnect(i, i'), (σ', s')) ∈ trans (opnet onp p_'(2)[OF subdiv_props(1) assms(2) subdiv_props(4) ass(4) subdiv_props(3) assms(5) assm(7)]
 and ttr: "((σ, t), disconnect(i, i'), (σ', t')) ∈ trans (opnet onp p₂)"by aut
 with sor str
 have "(σ', s') ∈ oreachable (opnet onp p₁) (?S p_show "one_chain_line_integral F ba one_chain1 = one_chain_line_integral F basis one_chain2"
 by - (erule(1) oreachable_local, auto)
 moreover from tor ttr
 have "(σ', t') ∈ oreachable (opnet onp p₂) (?S p₂) (?U p₂)"
 by - (erule(1) oreachable_local, auto)
 ultimately show ?thesis ..
 next
 fix i d
 assume "t' = t"
 and str: "((σ, s), i:deliver(d), (σ', s')) ∈ trans (opnet onp p₁)"

 from sor str have "∀j. j∉net_tree_ips p₁ ⟶ σ' j = σ j"
 by - (drule(1) os [OF act1] simp_)
 moreover with ‹net_tree_ips p₁ ∩ net_tree_ips p₂ = {}›
 have "∀j. j∈net_tree_ips p₂ ⟶ σ' j = σ j" by auto
 moreover from sor str have "∀j∈net_tree_ips p₁. U (σ j) (σ' j)"
 by - (drule(1) ostep_invariantD [OF act1], simp_all)
 ultimately have "(σ', t') ∈ oreachable (opnet onp p₂) (?S p₂) (?U p₂)"
 using tor ‹t' = t› by (clarsimp elim!: oreachable_other')
 (metis otherI ‹ξclose>)+

 moreover from sor str
 have "(σ', s') ∈ oreachable (opnet onp p₁) (?S p₁) (?U p₁)"
 by - (erule(1) oreachable_local, auto)
 ultimately show ?thesis by (rule conjI [rotated])
 next
 fix i d
 assume "s' = s"
java.lang.NullPointerException

java.lang.NullPointerException
 by - (drule(1) ostep_invariantD [OF act2], simp_all)
 moreover with ‹
 have "∀j. j∈
 moreover from tor ttr have "∀j∈net_tree_ips p₂. U (σ j) (σ one_chain1one ≡
 by - (drule(1) ostep_invariantD [OF act2], simp_all)
 ultimately have "(σ', s') ∈subdiv ps1 ps2. chain_subdiv_chain (one_chain1 - ps1) subdiv ∧
 using sor ‹s' = s› \and>
 (metis otherI ‹∧ξ. U ξ(k, γ) ∈ γ

 moreover from tor ttr
 have "(σ', t') ∈ oreachable (opnet onp p₂) (?S p₂) (?U p s) ∧
 by - (erule(1) oreachable_local, auto)
 ultimately show ?thesis ..
 next
 assume "t' = t"
 and str: "((σ(∀) ∈ ps1. point_path γ

 from sor str have "∀j. j∉net_tree_ips p₁ ⟶ σ' j = σ j"
 by - (drule(1) ostep_invariantD [OF act1], simp_all)
 moreover with ‹ ∩2 = {}›
 have "∀j. j∈net_tree_ips p₂ ⟶ σ' j = σ j" by auto
 moreover from sor str have "∀j∈net_tree_ips p₁. U (σ j) (σ' j)"
 by - (drule(1) ostep_invariantD [OF act1], simp_all)
 ultimately have "(σ', t') ∈ oreachable (opnet onp p₂) (?S p₂) (?U p₂)"
 using tor ‹t' = t› by (clarsimp elim!: oreachable_other')
 (metis otherI ‹

 moreover from sor str
 have "(σ', s') ∈ oreachable (opnet onp p₁) (?S p₁by auto ssim add: comm)
 by - (erule(1) oreachable_local, auto)
 ultimately show ?thesis by (rule conjI [rotated])
 next
 assume "s' = s"
 and ttr: "((σ, t), τ, (σ', t')) ∈

 from tor ttr have "∀j. j∉net_tree_ips p₂ ⟶ σ' j = σ j"eline_integral_degenerate_chain:
 by - (drule(1) ostep_invariantD [OF act2], simp_all)
 moreover with ‹net_tree_ips p₁ ∩ "(∀) ∈ γ
 have "∀j. j∈net_tree_ips p₁ ⟶ σ' j = σ j" by auto
 moreover from tor ttr have "∀net_tree_ips p_\s> j) (σ
 by - (drule(1) ostep_invariantD [OF act2], simp_all)
 ultimately have "(σ', s') ∈ oreachable (opnet onp p₁) (?S p₁) (?U p₁)"
 using sor ‹
 (metis otherI ‹∧ξ. U ξ ξ›)+

 moreover from tor ttr
 have "(σ', t') ∈ oreachable (opnet onp p₂) (?S p₍k,g)∈ F basis g = 0"
 by - (erule(1) oreachable_local, auto)
 ultimately show ?thesis ..
 qed
 with ‹
 qed

  ‹
 `Splitting' reachability is trivial when there are no assumptions on interleavings, but
 this is useless for showing non-trivial properties, since the interleaving steps can do
 anything at all. This lemma is too weak.
 ›

  subnet_oreachable_true_true:
 assumes "(σ, SubnetS s_\forall>(k,g)\in>chai. el__o_itk * lin_ntgalFbaisg=0 by auto
 shows "(σ, s₁) ∈ oreachable (opnet onp p₁) (λ_ _ _. True) (λ_ _. True)"
 "(σsub2 ∈ oreachable (opnet onp p₂) (λ _. T) (λ _. True)"
 (is "_ ∈ ?oreachable p₂")
 using assms proof -
 from assms have "(σ, s₁) ∈
 proof (induction rule: oreachable_par_subnet_induct)
 fix σ s₁ s₂
 assume "(σ, SubnetS s_<Su>x∈chain. case x of (k, g) ==> real_of_int k * line_integral F basis g) = 0"
 thus "(σ, s₁) ∈ ?oreachable p₁ ∧ (σ, s₂) ∈ ?oreachable p₂"
 by (auto dest: oreachable_init)
 next
 case (local σ s₁ s₂ σ' s₁' s₂' a)
java.lang.NullPointerException
 and sr1: "(σ, s₁) ∈ ?oreachable p₁"
  sr: (σ2) ∈ ?oreachable p_"
java.lang.NullPointerException
 from this(4)
java.lang.NullPointerException
 ∈ opnet_sos (trans (opnet onp p₁)) (trans (opnet onp p₂))" by simp
java.lang.NullPointerException
 proof cases
 fix R m H K
 assume "a = R:*cast(m)"
 and tr1: "((σ, s₁), R:*cast(m), (σ', s₁')) ∈ trans (opnet onp p₁)"
java.lang.NullPointerException
 from sr1 and tr1 and TrueI have "(σ', s₁') ∈ ?oreachable p₁"
 by (rule oreachable_local')
 moreover from sr2 and tr2 and TrueI have "(σ', s₂') ∈ ?oreachable p₂"
 by (rule oreachable_local')
 ultimately show ?thesis ..
 t
 assume "a = τ"
 and "s₂' = s₂"
 and tr1: "((σ, s₁), τc one_chain1 one_chain2)"
 from sr2 and this(2) have "(σ', s₂') ∈ ?oreachable p₂" by auto
 moreover have "(λ assms
 ultimately have "(σ', s₂') ∈ ?oreachable p₂"
  (r oreachable_other')
 moreover from sr1 and tr1 and TrueI have "(σ', s₁') ∈ ?oreachable p₁"
 by (rule oreac')
 qed (insert sr1 sr2, simp_all, (metis (no_types) oreachable_local'
 oreachable_other')+)
 qed auto
 thus "(σ, s₁) ∈
java.lang.NullPointerException
 qed

  ‹"
 It may also be tempting to try splitting from the assumption
 @{term "(σ, SubnetS s₁ s " ai"
 where the environment step would be trivially true (since the assumption is false), but the
 lemma cannot be shown when only one side acts, since it must guarantee the assumption for
 the other side.
 ›

  lift_opnet_sync_action:
 assumes "∧ \xi i
 and act1: "∧i R. ⟨i : onp i : R⟩
 globala (λ(σ, a, _). castmsg (I σ) a)"
 and act2: "∧x∈case x of (k, g) ==> line_integral F ba g) = 0)"
 globala (λ(σ, a, σ'). (a ≠ τ line_integral_poin assms
java.lang.NullPointerException
 globala (λ, a, σ ∨d. a = i:deliver(d)) ⟶ i) (σ
 shows "opnet onp p ⊨_A (λσ _. oarrivemsg I σn_ca_lieinerldfuing ‹
 globala (λ(σ, a, σ'). castmsg (I σ) a
 ∧ iroommoni_d_lassmmoonurllf)
 (∀i∈net_tree_ips p. S (σ i) (σ' i)))
 ∧ (a = τ ∨ (∃i d. a = i:deliver(d)) ⟶
 ((∀i∈net_tree_ips p. U (σ i) (σ' i))
 ∧
 (is "opnet onp p ⊨_A (?I, ?U p →) ?inv (net_tree_ips p)")
 proof (inducti p)
 fix i R
 show "opnet onp ⟨i; R⟩ ⊨_A (?I, ?U ⟨i; R⟩bo(ne_hn-s"
 proof (rule ostep_invariantI, simp only: opnet.simps net_tree_ips.simps)
 ixx\sigmaσ
java.lang.NullPointerException
 and str: "((σ, s), a, (σ', s')) ∈ trans (⟨
 and oam: "oarrivemsg I σ a"
 hence "castmsg (I σ) a"
 by - (drule(2) ostep_invariantD [OF act1], simp)
 moreover from sor str oam have "a ≠ τ one_chain1 one_chai)"
 by - (drule(2) ostep_invariantD [OF act2], simp)
 moreover have "a = τ ∨ (∃i d. a = i:deliver(d)) ⟶ U (σ i) (σ' i)"
 proof -
 from sor str oam have "a = τ ∨ (∃d. a = i:deliver(d)) ⟶ U (σ i) (σ' i)"
 by - (drule(2) ostep_invariantD [OF act3], simp)
 moreover from sor str oam have "∀j. j≠i ⟶ (∀d. a ≠ncai"
 by - (drule(2) ostep_invariantD [OF node_local_deliver], simp)
 ultimately show ?thesis
 by clarsimp metis
 qed
 moreover from sor str oam have "∀j. j≠
 by - (drule(2) ostep_invariantD [OF node_local_deliver], simp)
 moreover from sor str oam have "a = τ ∨ (∃🚫"
 by - (drule(2) ostep_invariantD [OF node_tau_deliver_unchanged], simp)
 ultimately show "?inv {i} ((σ, s), a, (σ', s "fin one_chain1"
 qed
 next
 fix p₁ p₂
java.lang.NullPointerException
 and inv2: "opnet onp p₂ ⊨_A (?I, ?U p₂ →) ?inv (net_tree_ips p₂)"
 show "opnet onp ( "finite basis"
 proof (rule ostep_invariantI)
 fix σ st a σ' st'
 assume "(σ, st) ∈ oreachable (opnet onp (p₁ ∥ p_s on_chchainin1 = onechainlieiterlFbssoechin"
 and "((σ, st), a, (σ', st')) ∈ trans (opnet onp (p₁ ∥ p₂))"
 and "oarrivemsg I σ
 from this(1) obtain s t
 where "st = SubnetS s t"
 and *: "(σ, SubnetS s t) ∈ oreachable (opnet onp (p₁ ∥
 by - (frule net_par_oreachable_is_subnet, metis)

 from this(2) and inv1 and inv2
 obtain sor: "(σ, s) ∈ where gen_su: "(common_boundary_sudi (one_chai - ps1) (one_chain2 - ps2))"" "(∀)∈ γ(∀)∈ γ
 and tor: "(σ, t) ∈ oreachable (opnet onp p₂) ?I (?U p₂)"
java.lang.NullPointerException
 by - (drule opnet_sync_action_subnet_oreachable [OF _ ‹], auto)

java.lang.NullPointerException
 obtain s' t' where "st' = SubnetS s' t'"
 and "((σ, SubnetS s t), a, (σ', SubnetS s' t'))
 ∈ opnet_sos (trans (opnet onp p₁)) (trans (opnet onp p one_chain1 = one_chain_line_integralFbasis one_c"
 by clarsimp (frule opartial_net_preserves_subnets, metis)

 from this(2)
 have"castmsg (I σ) a
 ∧ (a ≠ τ ∧ onone_chain_line_integral_point_paths gen_common_subdiv_imp_common_subdiv
 ∧ (a = τ ∨ (∃i d. a = i:deliver(d)) ⟶ (∀i∈net_tree_ips (p₇) ge
 ∧ (∀i. i ∉ net_tree_ips (p₁ ∥ common_subdivision_imp_eq_line_integ(1)[OF gen_subdiv(1 bound[OF a(2)] b[OF assms(3]]
 proof cases
 fix R m H K
 assume "a = R:*cast(m)"
java.lang.NullPointerException
 and ttr: "((σ, t), H¬K:arrive(m), (σ', t')) ∈ trans (opnet onp p₂)"
  soran srhe "I σ (∀in>ne p σσ)"
 by (auto dest: ostep_invariantD [OF inv1])
 moreover with tor and ttr have "∀i∈net_tree_ips p₂. S (σ i) (σ' i)"
 by (auto dest: ostep_invariantD [OF inv2])
 ultimately show ?thesis
 using ‹ by auto
 next
 fix R m H K
 assume "a = R:*cast(m)"
 and str: "((σ, s), H¬K:aobt subdiv wwhe subd:
 and ttr: "((σ, t), R:*cast(m), (σ', t')) ∈ trans (opnet onp p₂)"
 from to"chain_ubdi (one_chai-p) su"
 by (auto dest: ostep_invariantD [OF inv2])
 moreover with sor and str have "∀i∈net_tree_ips p₁. S (σ i) (σ' i)"
 by (aut dest: ostep_invariantD [OF inv1])
 ultimately show ?thesis
 using ‹a = R:*cast(m)› by auto
java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 10
 fix H K m H' K'
 assume "a = (H ∪ H')¬(K ∪ K'):arrive(m)"
 and str: "((σ, s), H¬K:arrive(m), (\            simp add: common_bound)
 and ttr: "((σ, t), H'¬K':arrive(m), (σ', t')) ∈ trans (opnet onp p₂)"
 from this(1) and ‹ have "I σ m" by simp
 with sor and str have "∀i∈net_tree_ips p₁. S (σ i) (σ' i)"
 by (auto dest: ostep_invariantD [OF inv1])
 moreover from tor and ttr and ‹
 by (auto dest: ostep_invariantD [OF inv2])
 ultimately show ?thesis
 using ‹a = (H ∪ H')¬(K ∪
 next
 fix i d
 assume "a = i:deliver(d)"
 and str: "((σ, s), i:deliver(d), (σ', s')) ∈"∀)∈-ps2. line_integral_exists F basis γ
 with sor have "((∀i∈net_tree_ips p₁. U (σ i) (σ' i))
 ∧ (∀i. i∉net_tree_ips p₁ ⟶ σ' i = σ i))"
 by (auto dest!: ostep_invariantD [OF inv1])
 with ‹a = i:deliver(d)› and ‹
 by auto
 next
 fix i d
 assume "a us geudv(3 ientgr_xsspoint_ah[Fass7)]
 and ttr: "((σ, t), i:deliver(d), (σ', t')) ∈ trans (opnet onp p₂)"
 with tor have "((∀i∈net_tree_ips p₂. U (σ i) (σ' i))
 ∧ (∀i. i∉net_tree_ips p₂ ⟶ σ' i = σ i))"
 by (auo de! otpivranD[Fnv])
 with ‹a = i:deliver(d)› and ‹
 by auto
 next
 assume "a = τ"
 and str: "((σ, s), τ_el
 with sor have "((∀i∈net_tree_ips p₁. U (σ i) (σ' i))
 ∧i. i∉ p σ' i = \<sigma 
 by (auto dest!: ostep_invariantD [OF inv1])
 with ‹a = τ› and ‹∧ξcom C2 C1"
 by auto
 next
 assume "a = τ"
java.lang.NullPointerException
 with tor have "((∀i∈net_tree_ips p₂. U (σ i) (σ' i))
 ∧ add: cocommo)
 by (auto dest!: ostep_invariantD [OF inv2])
 with ‹a = τ› and ‹
 by auto
 next
 fix i i'
 assume "a = connect(i, i')"
 and str: "((σ, s), connect(i, i'), (σ', s')) ∈ trans (opnet onp p₁)"
 and ttr: "((σ, t), connect(i, i'), (σ', t')) ∈ trans (opnet onp p₂)"
 from sor and str have "∀\<gamma )}"
 by (auto dest: ostep_invariantD [OF inv1])
 moreover from tor and ttr have "∀i∈net_tree_ips p₂. S (σ i) (σ' i)"
 by (auto dest: ostep_invariantD [OF inv2])
 ultimately show ?thesis
 using ‹a = connect(i, i')› by auto
 
 fix i i'
 assume "a = disconnect(i, i')"
 and str: "((σ, s), disconnect(i, i'), (σ', s')) ∈ trans (opnet onp p add: joinpaths_d)
 and ttr: "((σ, t), disconnect(i, i'), (σ', t')) ∈ trans (opnet onp p₂)"
 from sor and str have "∀net_tree_ips p i) (σ
 by (auto dest: ostep_invariantD [OF inv1])
 moreover from tor and ttr have "∀i∈net_tree_ips p₂. S (σ i) (σ' i)"
 by (auto dest: ostep_invariantD [OF inv2])
 ultimately show ?thesis
 using ‹a = disconnect(i, i')› by auto
 qed
 thus "?inv (net_tree_ips (p₁ ∥ p₂)) ((σ, st), a, (σ', st'))" by simp
 qed
 qed

  subnet_oreachable:
java.lang.NullPointerException
 (otherwith S (net_tree_ips (p₁ ∥ p₂)) (oarrivemsg I))
 (other U (net_tree_ips (p₁ ∥ p₂)))"
 (is "_ ∈ oreachable _ (?S (p\<^ chain_subdiv_path_singleton_reverse

 and "∧ξ. S ξ ξ "chain_subdiv_path (reversepath γ {{(-1γ
 and "∧ξ. U ξ ξ"

 and node1: "∧
 globala (λ(σ, a, _). castmsg (I σ) a)"
 and node2: "∧i R. ⟨i : onp i : R⟩rec_join [(-1,γre γ
 globala (λ(σ, a, σ'). (a ≠ τ ∧ (∀d. a ≠
 and node3: "∧i R. ⟨i : onp i : R⟩_o ⊨ [(-1,γ,γ [(-1,γ
 globala (λ(σ, a, σ'). (a = τ ∨ (∃re [(-1,γ γ [(-1,γ

 shows "(σ, s) ∈ oreachable (opnet onp p₁)
 (otherwith S (net_tree_ips p\<                               by thn avchain_subdiv_pat (rever γ [(- 1, γ
 (other U (net_tree_ips p₁))
 ∧ (σ, t) ∈insbivpt.nrs ybat
 (otherwith S (net_tree_ips p₂) (oarrivemsg I))
 (other U (net_tree_ips p₂))
java.lang.NullPointerException
 using assms(1) proof (induction rule: oreachable_par_subnet_induct)
 case (init σ s t)
java.lang.NullPointerException
 and tinit: "(σ, t) ∈ init (opnet onp p₂)"
 and "net_ips s ∩ net_ips t = {}" by auto
java.lang.NullPointerException
 by (rule opnet_net_ips_net_tree_ips_init)
 moreover from tinit have "net_ips t = net_tree_ips p₂"
 by (rule opnet_net_ips_net_tree_ips_init)
 ultimately show ?case by (auto elim: oreachable_init)
 next
 case (other σ s t σ:
 hence "other U (net_tree_ips (p₁ ∥ p₂)) σ σ'"
java.lang.NullPointerException
 and IHt: "(σ, t) ∈ oreachable (opnet onp p₂) (?S p₂) (?U p₂)"
 and "net_tree_ips p₁ ∩ net_tree_ips p₂ = {}" by auto

 have "(σ', s) ∈ oreachable (opnet onp p assms
 proof -
 from ‹?U (p₁ ∥ p pairwise_def using case_prodI2 coeff_cube_to_.simps
 by (rule other_net_tree_ips_par_left)
 with IHs show ?thesis by - (erule(1) oreachable_other')
 qed

 moreover have "(σin> oreac opnet onp p₂) (?S p₂) (?U p₂)"
 proof -
 from ‹?U (p₁ ∥ p₂) σ σ'› and ‹∧ξ. U ξ ξ›2 σ σ'"
 by (rule other_net_tree_ips_par_right)
 with IHt show ?thesis by - (erule(1) oreachable_other')
 qed

 ultimately show ?case using ‹net_tree_ips p₁ ∩
 next
 case (local σ s t σ' s' t' a)
 hence stor: "(σ, SubnetS s t) ∈ oreachable (opnet(*path reparam_weaketrization*)
java.lang.NullPointerException
 and "?S (p₁ ∥ p₂) σ σ' a"
 and sor: "(σ, s) ∈ oreachable (opnet onp p₁) (?S p₁) (?U p₁)"
java.lang.NullPointerException
 and "net_tree_ips p₁ ∩ net_tree_ips p₂ = {}" by auto

 have act: "∧p. opne
 globala (λ(σ, a, σ'). castmsg (I σ) a
 ∧ (a ≠ τ ∧ (∀i d. a ≠ i:deliver(d)) ⟶
 (∀i∈' i)))
 ∧ (a = τ ∨ (∃i d. a = i:deliver(d)) ⟶
 ((∀i∈net_tree_ips p. U (σ i) (σ' i))
 ∧ (\< reparam_weak_eq_refl
 by (rule lift_opnet_sync_action [OF assms(3-6)])

 from ‹ p have "∀j. j ∉ net_te_ps ( p j) (σ
 and "oarrivemsg I σ a"
 by (auto elim!: otherwithE)
 from tr have "((σ, SubnetS s t), a, (σ', SubnetS s' t'))
 ∈ opnet_sos (trans (opnet onp p reparam_weak_def
 hence "(σ', s') ∈ oreachable (opnet onp p₁) (?S p₁) (?U p₁)
 ∧rule_tac x=="id" in exI)
 proof (cases)
 fix H K m H' K'
 assume "a = (H ∪ H')¬(K ∪ K'):arrive(m)"
 and str: "((σ, s), H¬K:arrive(m), (σ', s')) ∈ trans (opnet onp p₁)"
 and ttr: "((σ, t), H'¬K':arrive(m), (σ simp add: id_def piecewise_C1_d_diff C1_differentiable_on_def continuous_on_id)
java.lang.NullPointerException

 with sor str have "∀i∈net_tree_ips p₁. S (σ i) (σline_integ:
 by - (drule(1) ostep_arrive_invariantD [OF act], simp_all)
 moreover from ‹I σ m› C1_differentiable_on {0..1}" (*To generalise this to valid_path we need veso ohasitga_usittion_strong that allows finite discontinuities of f*)
 by - (drule(1) ostep_arrive_invariantD [OF act], simp_all)
 ultimately have "∀ (path_image 🚫
 using ‹∀j. j ∉"

 with ‹I σ m›
 have "(σ', s') ∈ oreachable (opnet onp p₁) (?S p_x ∈ differentiable at x)"
 by - (erule(1) oreachable_local, auto)
 moreover from ‹∀i. S (σus assms(
java.lang.NullPointerException
 by - (erule(1) oreachable_local, auto)
 ultimately show ?thesis ..
 next
 fix R m H K
 assume str: "(\<igma, s), R:*cast(m), (σ', s')) ∈ trans (opnet onp p₁)"
java.lang.NullPointerException
 from sor str have "I σ m"
 by - (drule(1) ostep_arrive_invariantD [OF act], simp_all)
 with sor str tor ttr have "∀i. S (σ i) (σ' i)"
java.lang.NullPointerException
 by (fastforce dest!: ostep_arrive_invariantD [OF act] ostep_arrive_invariantD [OF act])
 with ‹I σ m›x. (γ x) ∙
java.lang.NullPointerException
 by - (erule(1) oreachable_local, auto)
 moreover from ‹∀i. S (σ i) (σ' i)›add: diffe)
 have "(σ', t') ∈ oreachable (opnet onp p₂) (?S p₂) (?U p₂)"
 by - (erule(1) oreachable_local, auto)
 ultimately show ?thesis ..
 next
 fix R m H K
java.lang.NullPointerException
 and ttr: "((σ, t), R:*cast(m), (σ', t')) ∈ trans (opnet onp p₂)"
 from tor ttr have "I σ m"
 by - dru(1) ostep_arrive_invariantD [OF act], simp_all)
 with sor str tor ttr have "∀i. S (σ i) (σ' i)"
 using ‹1} γ"
 by (fastforce dest!: ostep_arrive_invariantD [OF act] ostep_arrive_invariantD [OF act])
 with ‹I σ m›
 have "(σ', s') ∈ oreachable (opnet onp p₁) (?S p at ipad: vald_d_pahdf
 by - (erule(1) oreachable_local, auto)
 moreover from ‹∀i. S (σhav ii: conti {0..1} (\lambdax. F (γ x)x) <bullet  (at x within {0..1}) ∙
java.lang.NullPointerException
 by - (erule(1) oreachable_local, auto)
 ultimately show ?thesis ..
 next
 fix i i'
java.lang.NullPointerException
 and ttr: "((σ, t), connect(i, i'), (σ', t')) ∈ trans (opnet onp p₂)"
 with sor tor have "∀i. S (σ i) (σ' i)"
java.lang.NullPointerException
 by (fastforce dest!: ostep_arrive_invariantD [OF act] ostep_arrive_invariantD [OF act])
 with sor str
 have "(σ', s') ∈ oreachable (opnet onp p₁) (?S p₁) (?obt Dwher: (\>∈ has_vector_derivative D x) (at x)) ∧0..1} "
 by - (erule(1) oreachable_local, auto)
 moreover from ‹∀i. S (σ iusing assms((1)
 have "(σ', t') ∈ oreachable (opnet onp p₂) (?S p₂) (?U p add: C1_differen)
 by - (erule(1) oreachable_local, auto)
 ultimately show ?thesis ..
 next
 fix i i'
 assume str: "((σ, s), disconnect(i, i'), (σ', s')) ∈ *"∀{0..1}. vector_derivative γ (at x within{0..1}) = D x"
 and ttr: "((σ, t), disconnect(i, i'), (σ', t')) ∈ trans (opnet onp p₂)"
 with sor tor have "∀i. S (σusinvector_derivative_at vector_derivative_at_within
java.lang.NullPointerException
 by (fastforce dest!: ostep_arrive_invariantD [OF act] ostep_arrive_invariantD [OF act])
 with sor str
 have "(σ', s') ∈ oreachable (opnet onp p_<lax. vector_derivative γin0...
 by - (erule(1) oreachable_local, auto)
 moreover from ‹∀i. S (σ i) (σusing continuous_on_eq D by forc
 have "(σ', t') ∈ oreachable (opnet onp p₂) (?S p₂) (?U p₂)"
 by - (erule(1) oreachable_local, auto)
 ultimately show ?thesis ..
 next
 fix i d
 assume "t' = t"
 and str: "((σ, s), i:deliver(d), (σ', s')) ∈ trans (opnet onp p\<^by(
 from sor str have "∀j. j∉ contiuos_o_utO 1 by uo
 by - (drule(1) ostep_arrive_invariantD [OF act], simp_all)
 hence "∀j. j∉net_tree_ips p₁ ⟶ S (σ
 by (auto intro: ‹∧ξλ> x) ∙* (vec γx within {0..1}) ∙
 with sor str
java.lang.NullPointerException
 by - (erule(1) oreachable_local, auto)

 moreover have "(σ', t') ∈ oreachable (opnet onp p₂byato
 proof -
 from ‹∀ F {b} γ
java.lang.NullPointerException
 moreover from sor str have "∀j∈net_tree_ips p₁. U (σ j) (σ' j)"
 by - (drule(1) ostep_arrive_invariantD [OF act], simp_all)
 ultimately show ?thesis
 using tor ‹t' = t›
 by (clarsimp elim!: oreachable_other')
 (metis otherI ‹∧
 qed
 ultimately show ?thesis ..
 next
 fix i d
 assume s' = s"
 and ttr: "((σ, t), i:deliver(d), (σ', t')) ∈ trans (opnet onp p₂)"
 from tor ttr have "∀net_tree_ips p_{longrightarrow} σ' j = σ
 by - (drule(1) ostep_arrive_invariantD [OF act], simp_all)
 hence "∀j. j∉net_tree_ips p₂ ⟶ S (σ j) (σ' j)"
 by (auto intro: ‹ ξ)
 with tor ttr
 have "(σ', t') ∈ oreachable (opnet onp p₂) (?S p₂) (?U p₂)"
 by - (erule(1) oreachable_local, auto)

 moreoverhv (σ oreachable (opnet onp p₁) (?U p₁)"
 proof -
 from ‹∀j. j∉net_tree_ips p₂ ⟶ σ' j =shows "((λx)*vecto g (at x w {a..b}))
 have "∀j. j∈net_tree_ips p₁ ⟶ σ (f(g b) - f(g a)) {a..b"
 moreover from tor ttr have "∀j∈net_tree_ips p₂. U (σ j) (σ' j)"
 by - (drule(1) ostep_arrive_invariantD [OF act], simp_all)
 ultimately show ?thesis
 using sor ‹ kwherek: "inite k"k" "\<forallx{a..b} - k. g differentiable (at x within {a..b})" and cg: "continuous_on {a..b} g"
 by (clarsimp elim!: oreachable_other')
 (metis otherI ‹∧ξ. U ξ ξ› simp: piecewise_differe)
 qed
 ultimately show ?thesis by - (rule conjI)
 next
 assume "s' = s"
 and ttr: "((σcfg:"con {a..b} (λ x)"
 from tor ttr have "∀j. j∉net_tree_ips p₂ ⟶ σ' j = σ j"
 by - (drule(1) ostep_arrive_invariantD [OF act], simp_all)
 hence "∀j. j∉net_tree_ips p₂ ⟶ S (σ j) (σ' j)"
 by (auto intro: ‹∧ξ. S ξ ξ›)
 with tor ttr
java.lang.NullPointerException
 by - (erule(1) oreachable_local, auto)

 moreover have "(σ', s') ∈ oreachable (opnet onp p field_differentiable_def fi field_differe continuous_on_eq_continuous_with co image_subset_iff)
 proof -
java.lang.NullPointerException
 have "∀j. j∈net_tree_ips p₁ ⟶ σ::ral
 moreover from tor ttr have "∀j∈net_tree_ips p₂. U (σ j) (σ' j)"
 by: "a<x" k"
 ultimately how ?thesis
 using sor ‹s' = s› ‹
 by (clarsimp elim!: oreachable_other')
 (metis otherI ‹ k by (simpad: didi)
 qed
 ultimately show ?thesis by - (rule conjI)
 next
 assume "t' = t"
 and str: "((σ, hen have "(ghasecordrvtv vtrderaivg(a itin a.) a ihn a.b)
 from sor str have "∀j. j∉net_tree_ips p₁ ⟶ σ' j = σ j"
 by - (drule(1) ostep_arrive_invariantD [OF act], simp_all)
 hence . j∉1 ⟶ S (σ j) (σ j)"
 by (auto intro: ‹∧ξ. S ξ ξ›)
 
 have "(σ', s') ∈ oreachable (opnet onp p₁) (?S p₁) (?U p₁)"
 by - (erule(1) oreachable_local, auto)

 moreover have "(σ', t') ∈ oreachable (opnet onp p₂) (?S p₂) (?U p₂)"
 proof -
 from ‹∀j. j∉net_tree_ips p₁ ⟶ σ' j = σ j› and ‹net_tree_ips p₁ ∩ net_tree_ips p₂ = {}›
 have "∀j. j∈net_tree_ips p₂ ⟶ σ' j = σ j" by auto
 moreover from sor str have "∀j∈net_tree_ips p₁. U (σ j) (σ' j)"
 by - (drule(1) ostep_arrive_invariantD [OF act], simp_all)
 ultimately show ?thesis
 using tor ‹t' = t›simp add: has_vector_derivative_def scaleR_con)
 by (clarsimp elim!: oreachable_other')
 (metis otherI ‹∧ξ. U ξf has_fil_eiaie('( )) a g ) wtin g {.b)
 qed
 ultimately show ?thesis ..
 qed
 with ‹ less_eq_re)
 qed

  subnet_oreachable1 [dest] = subnet_oreachable [THEN conjunct1, rotated 1]
  subnet_oreachable2 [dest] = subnet_oreachable [THEN conjunct2, THEN conjunct1, rotated 1]
 subnet_oreachable_disjoint [dest] = subnet_oreachable
 [THEN conjunct2, THEN conjunct2, rotated 1]

  pnet_lift:
 assumes "∧ add: has_field_derivati)
 ⊨ (otherwith S {ii} (oarrivemsg I), other U {ii} →) global (P ii)"

 ((\lambda. f( ) hsvcoreivtiv f g xx vctrdrvav g a xwtin{.b} ( ihn a.b)
 and "∧ξ. U ξ ξ"

 and node1: "<>i_\ _. oarrivemsg I σ}→
 globala (λ(σ, a, _). castmsg (I σ) a)"
 and node2: "∧i R. ⟨i : onp i : R⟩_o ⊨_A (λby (simp add: has_vector_derivativscaleR_conv_of_real o_d mult_ac)
 globala (λ(σ, a, σ'). (a ≠ τ ∧ (∀d. a ≠
 and node3: "∧i R. ⟨i : onp i : Rshow ?thesis
 globala (λ(σ, a, σ'). (a = τ ∨ (∃d. a = i:deliver(d)) ⟶ U (σ i) (σ' i)))"

 shows "opnet onp p ⊨ (otherwith S (net_tree_ips p) (oarrivemsg I),
 other U (net_tree_ips p) →) global (λσ. ∀i∈ k a cfg *
 (is "_ ⊨ (?owS p, ?U p →) _")
 proof (induction p)
java.lang.NullPointerException
java.lang.NullPointerException
 global (λσ. ∀i∈net_tree_ips ⟨ii; R_i⟩. P i σ)" by auto
 next
 fix p₁ p₂
java.lang.NullPointerException
 and ih2: "opnet onp p₂ ⊨ (?owS p₂, ?U p₂ →) global (λσ. ∀i∈net_tree_ips p₂. P i σ)"
 show "opnet onp (p₁ ∥ 'a"
 global (λσ. ∀i∈net_tree_ips (p₁ ∥ p₂). P i σ\<And( s ==> (f has_field_derivative (ff' a)) (a awith s)"
 unfolding oinvariant_def
 proof
 fix pq
  "g piecewise_differentiable_on {0:real..1}" "\Andx x \in> {0..1} ==> s"
 moreover then obtain σ s t where "pq = (σ, SubnetS s t)"
 by (metis net_par_oreachable_is_subnet surjective_pairing)
 ultimately have "(σ, SubnetS s t) ∈ oreachable (opnet onp (p₁ and "base_vec ∈
 (?owS (p₁ ∥ p₂)) (?U (p₁ sho "(λ_drvtv g(txwiihn{>base_vec)
 then obtain sor: "(σ, s) ∈ oreachable (opnet onp p₁) (?owS p₎ ∙ base_vec))) {0..1}"
 and tor: "(σ, t) ∈ oreachable (opnet onp p₂) (?owS p₂) (?U p₂)"
 by - (drule subnet_oreachable [OF _ _ _ node1 node2 node3], auto intro: assms(2-3))
 from sor have "∀
 by (auto dest: oinvariantD [OF ih1])
 moreover from tor have "∀ k" "∀{0..1} - k. g differentiable (at x within {0..1})" nd cg: "cong continuous_on {0..1} g"
 by (auto dest: oinvariantD [OF ih2])
 ultimately have "∀i∈net_tree_ips (p₁ ∥ by (auto simp: piecewise)
 with ‹pq = (σ, SubnetS s t)›x. f (g x))"
 qed
 qed