theory Corres_UL_C

lemma ccorres_Guard:
  assumes cc: "ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c"
  shows "ccorres_underlying sr \<Gamma> r xf arrel axf A (C' \<inter> S) hs a (Guard F S c)" using cc apply - apply (rule ccorresI') apply (erule exec_handlers.cases) apply clarsimp apply (erule exec_Normal_elim_cases) apply (erule (4) ccorresE) apply (erule (1) EHAbrupt) apply (clarsimp elim!: bexI [rotated]) apply clarsimp apply clarsimp apply (erule exec_Normal_elim_cases) apply (erule (4) ccorresE) apply (erule (1) EHOther) apply (clarsimp elim!: bexI [rotated]) apply clarsimp apply simp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres_underlying sr \<Gamma> r xf arrel axf A (C' \<inter> S) hs a (Guard F S c) proof (prove)
using this:
ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c

goal (1 subgoal):
 1. ccorres_underlying sr \<Gamma> r xf arrel axf A (C' \<inter> S) hs a (Guard F S c) proof (prove)
goal (1 subgoal):
 1. ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c \<Longrightarrow> ccorres_underlying sr \<Gamma> r xf arrel axf A (C' \<inter> S) hs a (Guard F S c) proof (prove)
goal (1 subgoal):
 1. \<And>s s' n z. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, s') \<in> sr; A s; s' \<in> C' \<inter> S; \<Gamma>\<turnstile>\<^sub>h \<langle>Guard F S c # hs,s'\<rangle> \<Rightarrow> (n, z); \<not> snd (a s)\<rbrakk> \<Longrightarrow> \<exists>t'. z = Normal t' \<and> (\<exists>(ra, t)\<in>fst (a s). (t, t') \<in> sr \<and> unif_rrel (n = length hs) r xf arrel axf ra t') proof (prove)
goal (3 subgoals):
 1. \<And>s s' n z h sa za hsa na t. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, s') \<in> sr; A s; s' \<in> C' \<inter> S; \<not> snd (a s); s' = sa; Guard F S c # hs = h # hsa; n = na; z = t; \<Gamma>\<turnstile> \<langle>h,Normal sa\<rangle> \<Rightarrow> Abrupt za; \<Gamma>\<turnstile>\<^sub>h \<langle>hsa,za\<rangle> \<Rightarrow> (na, t)\<rbrakk> \<Longrightarrow> \<exists>t'. z = Normal t' \<and> (\<exists>(ra, t)\<in>fst (a s). (t, t') \<in> sr \<and> unif_rrel (n = length hs) r xf arrel axf ra t')
 2. \<And>s s' n z h sa t hsa. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, s') \<in> sr; A s; s' \<in> C' \<inter> S; \<not> snd (a s); s' = sa; Guard F S c # hs = h # hsa; n = length hsa; z = t; \<Gamma>\<turnstile> \<langle>h,Normal sa\<rangle> \<Rightarrow> t; \<not> isAbr t\<rbrakk> \<Longrightarrow> \<exists>t'. z = Normal t' \<and> (\<exists>(ra, t)\<in>fst (a s). (t, t') \<in> sr \<and> unif_rrel (n = length hs) r xf arrel axf ra t')
 3. \<And>s s' n z sa. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, s') \<in> sr; A s; s' \<in> C' \<inter> S; \<not> snd (a s); s' = sa; Guard F S c # hs = []; n = 0; z = Abrupt sa\<rbrakk> \<Longrightarrow> \<exists>t'. z = Normal t' \<and> (\<exists>(ra, t)\<in>fst (a s). (t, t') \<in> sr \<and> unif_rrel (n = length hs) r xf arrel axf ra t') proof (prove)
goal (3 subgoals):
 1. \<And>s sa za na t. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, sa) \<in> sr; A s; \<not> snd (a s); \<Gamma>\<turnstile> \<langle>Guard F S c,Normal sa\<rangle> \<Rightarrow> Abrupt za; \<Gamma>\<turnstile>\<^sub>h \<langle>hs,za\<rangle> \<Rightarrow> (na, t); sa \<in> C'; sa \<in> S\<rbrakk> \<Longrightarrow> \<exists>t'. t = Normal t' \<and> (\<exists>x\<in>fst (a s). case x of (ra, t) \<Rightarrow> (t, t') \<in> sr \<and> unif_rrel (na = length hs) r xf arrel axf ra t')
 2. \<And>s s' n z h sa t hsa. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, s') \<in> sr; A s; s' \<in> C' \<inter> S; \<not> snd (a s); s' = sa; Guard F S c # hs = h # hsa; n = length hsa; z = t; \<Gamma>\<turnstile> \<langle>h,Normal sa\<rangle> \<Rightarrow> t; \<not> isAbr t\<rbrakk> \<Longrightarrow> \<exists>t'. z = Normal t' \<and> (\<exists>(ra, t)\<in>fst (a s). (t, t') \<in> sr \<and> unif_rrel (n = length hs) r xf arrel axf ra t')
 3. \<And>s s' n z sa. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, s') \<in> sr; A s; s' \<in> C' \<inter> S; \<not> snd (a s); s' = sa; Guard F S c # hs = []; n = 0; z = Abrupt sa\<rbrakk> \<Longrightarrow> \<exists>t'. z = Normal t' \<and> (\<exists>(ra, t)\<in>fst (a s). (t, t') \<in> sr \<and> unif_rrel (n = length hs) r xf arrel axf ra t') proof (prove)
goal (4 subgoals):
 1. \<And>s sa za na t. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, sa) \<in> sr; A s; \<not> snd (a s); \<Gamma>\<turnstile>\<^sub>h \<langle>hs,za\<rangle> \<Rightarrow> (na, t); sa \<in> C'; sa \<in> S; sa \<in> S; \<Gamma>\<turnstile> \<langle>c,Normal sa\<rangle> \<Rightarrow> Abrupt za\<rbrakk> \<Longrightarrow> \<exists>t'. t = Normal t' \<and> (\<exists>x\<in>fst (a s). case x of (ra, t) \<Rightarrow> (t, t') \<in> sr \<and> unif_rrel (na = length hs) r xf arrel axf ra t')
 2. \<And>s sa za na t. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, sa) \<in> sr; A s; \<not> snd (a s); \<Gamma>\<turnstile>\<^sub>h \<langle>hs,za\<rangle> \<Rightarrow> (na, t); sa \<in> C'; sa \<in> S; Abrupt za = Fault F; sa \<notin> S\<rbrakk> \<Longrightarrow> \<exists>t'. t = Normal t' \<and> (\<exists>x\<in>fst (a s). case x of (ra, t) \<Rightarrow> (t, t') \<in> sr \<and> unif_rrel (na = length hs) r xf arrel axf ra t')
 3. \<And>s s' n z h sa t hsa. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, s') \<in> sr; A s; s' \<in> C' \<inter> S; \<not> snd (a s); s' = sa; Guard F S c # hs = h # hsa; n = length hsa; z = t; \<Gamma>\<turnstile> \<langle>h,Normal sa\<rangle> \<Rightarrow> t; \<not> isAbr t\<rbrakk> \<Longrightarrow> \<exists>t'. z = Normal t' \<and> (\<exists>(ra, t)\<in>fst (a s). (t, t') \<in> sr \<and> unif_rrel (n = length hs) r xf arrel axf ra t')
 4. \<And>s s' n z sa. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, s') \<in> sr; A s; s' \<in> C' \<inter> S; \<not> snd (a s); s' = sa; Guard F S c # hs = []; n = 0; z = Abrupt sa\<rbrakk> \<Longrightarrow> \<exists>t'. z = Normal t' \<and> (\<exists>(ra, t)\<in>fst (a s). (t, t') \<in> sr \<and> unif_rrel (n = length hs) r xf arrel axf ra t') proof (prove)
goal (5 subgoals):
 1. \<And>s sa za na t. \<lbrakk>(s, sa) \<in> sr; A s; \<not> snd (a s); \<Gamma>\<turnstile>\<^sub>h \<langle>hs,za\<rangle> \<Rightarrow> (na, t); sa \<in> C'; sa \<in> S; sa \<in> S; \<Gamma>\<turnstile> \<langle>c,Normal sa\<rangle> \<Rightarrow> Abrupt za\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^sub>h \<langle>c # hs,sa\<rangle> \<Rightarrow> (?n22 s sa za na t, ?x22 s sa za na t)
 2. \<And>s sa za na t t' ra ta. \<lbrakk>(s, sa) \<in> sr; A s; \<not> snd (a s); \<Gamma>\<turnstile>\<^sub>h \<langle>hs,za\<rangle> \<Rightarrow> (na, t); sa \<in> C'; sa \<in> S; sa \<in> S; \<Gamma>\<turnstile> \<langle>c,Normal sa\<rangle> \<Rightarrow> Abrupt za; ?x22 s sa za na t = Normal t'; (ra, ta) \<in> fst (a s); (ta, t') \<in> sr; unif_rrel (?n22 s sa za na t = length hs) r xf arrel axf ra t'; ?n22 s sa za na t \<le> length hs\<rbrakk> \<Longrightarrow> \<exists>t'. t = Normal t' \<and> (\<exists>x\<in>fst (a s). case x of (ra, t) \<Rightarrow> (t, t') \<in> sr \<and> unif_rrel (na = length hs) r xf arrel axf ra t')
 3. \<And>s sa za na t. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, sa) \<in> sr; A s; \<not> snd (a s); \<Gamma>\<turnstile>\<^sub>h \<langle>hs,za\<rangle> \<Rightarrow> (na, t); sa \<in> C'; sa \<in> S; Abrupt za = Fault F; sa \<notin> S\<rbrakk> \<Longrightarrow> \<exists>t'. t = Normal t' \<and> (\<exists>x\<in>fst (a s). case x of (ra, t) \<Rightarrow> (t, t') \<in> sr \<and> unif_rrel (na = length hs) r xf arrel axf ra t')
 4. \<And>s s' n z h sa t hsa. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, s') \<in> sr; A s; s' \<in> C' \<inter> S; \<not> snd (a s); s' = sa; Guard F S c # hs = h # hsa; n = length hsa; z = t; \<Gamma>\<turnstile> \<langle>h,Normal sa\<rangle> \<Rightarrow> t; \<not> isAbr t\<rbrakk> \<Longrightarrow> \<exists>t'. z = Normal t' \<and> (\<exists>(ra, t)\<in>fst (a s). (t, t') \<in> sr \<and> unif_rrel (n = length hs) r xf arrel axf ra t')
 5. \<And>s s' n z sa. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, s') \<in> sr; A s; s' \<in> C' \<inter> S; \<not> snd (a s); s' = sa; Guard F S c # hs = []; n = 0; z = Abrupt sa\<rbrakk> \<Longrightarrow> \<exists>t'. z = Normal t' \<and> (\<exists>(ra, t)\<in>fst (a s). (t, t') \<in> sr \<and> unif_rrel (n = length hs) r xf arrel axf ra t') proof (prove)
goal (4 subgoals):
 1. \<And>s sa za na t t' ra ta. \<lbrakk>(s, sa) \<in> sr; A s; \<not> snd (a s); \<Gamma>\<turnstile>\<^sub>h \<langle>hs,za\<rangle> \<Rightarrow> (na, t); sa \<in> C'; sa \<in> S; sa \<in> S; \<Gamma>\<turnstile> \<langle>c,Normal sa\<rangle> \<Rightarrow> Abrupt za; t = Normal t'; (ra, ta) \<in> fst (a s); (ta, t') \<in> sr; unif_rrel (na = length hs) r xf arrel axf ra t'; na \<le> length hs\<rbrakk> \<Longrightarrow> \<exists>t'. t = Normal t' \<and> (\<exists>x\<in>fst (a s). case x of (ra, t) \<Rightarrow> (t, t') \<in> sr \<and> unif_rrel (na = length hs) r xf arrel axf ra t')
 2. \<And>s sa za na t. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, sa) \<in> sr; A s; \<not> snd (a s); \<Gamma>\<turnstile>\<^sub>h \<langle>hs,za\<rangle> \<Rightarrow> (na, t); sa \<in> C'; sa \<in> S; Abrupt za = Fault F; sa \<notin> S\<rbrakk> \<Longrightarrow> \<exists>t'. t = Normal t' \<and> (\<exists>x\<in>fst (a s). case x of (ra, t) \<Rightarrow> (t, t') \<in> sr \<and> unif_rrel (na = length hs) r xf arrel axf ra t')
 3. \<And>s s' n z h sa t hsa. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, s') \<in> sr; A s; s' \<in> C' \<inter> S; \<not> snd (a s); s' = sa; Guard F S c # hs = h # hsa; n = length hsa; z = t; \<Gamma>\<turnstile> \<langle>h,Normal sa\<rangle> \<Rightarrow> t; \<not> isAbr t\<rbrakk> \<Longrightarrow> \<exists>t'. z = Normal t' \<and> (\<exists>(ra, t)\<in>fst (a s). (t, t') \<in> sr \<and> unif_rrel (n = length hs) r xf arrel axf ra t')
 4. \<And>s s' n z sa. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, s') \<in> sr; A s; s' \<in> C' \<inter> S; \<not> snd (a s); s' = sa; Guard F S c # hs = []; n = 0; z = Abrupt sa\<rbrakk> \<Longrightarrow> \<exists>t'. z = Normal t' \<and> (\<exists>(ra, t)\<in>fst (a s). (t, t') \<in> sr \<and> unif_rrel (n = length hs) r xf arrel axf ra t') proof (prove)
goal (3 subgoals):
 1. \<And>s sa za na t. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, sa) \<in> sr; A s; \<not> snd (a s); \<Gamma>\<turnstile>\<^sub>h \<langle>hs,za\<rangle> \<Rightarrow> (na, t); sa \<in> C'; sa \<in> S; Abrupt za = Fault F; sa \<notin> S\<rbrakk> \<Longrightarrow> \<exists>t'. t = Normal t' \<and> (\<exists>x\<in>fst (a s). case x of (ra, t) \<Rightarrow> (t, t') \<in> sr \<and> unif_rrel (na = length hs) r xf arrel axf ra t')
 2. \<And>s s' n z h sa t hsa. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, s') \<in> sr; A s; s' \<in> C' \<inter> S; \<not> snd (a s); s' = sa; Guard F S c # hs = h # hsa; n = length hsa; z = t; \<Gamma>\<turnstile> \<langle>h,Normal sa\<rangle> \<Rightarrow> t; \<not> isAbr t\<rbrakk> \<Longrightarrow> \<exists>t'. z = Normal t' \<and> (\<exists>(ra, t)\<in>fst (a s). (t, t') \<in> sr \<and> unif_rrel (n = length hs) r xf arrel axf ra t')
 3. \<And>s s' n z sa. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, s') \<in> sr; A s; s' \<in> C' \<inter> S; \<not> snd (a s); s' = sa; Guard F S c # hs = []; n = 0; z = Abrupt sa\<rbrakk> \<Longrightarrow> \<exists>t'. z = Normal t' \<and> (\<exists>(ra, t)\<in>fst (a s). (t, t') \<in> sr \<and> unif_rrel (n = length hs) r xf arrel axf ra t') proof (prove)
goal (2 subgoals):
 1. \<And>s s' n z h sa t hsa. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, s') \<in> sr; A s; s' \<in> C' \<inter> S; \<not> snd (a s); s' = sa; Guard F S c # hs = h # hsa; n = length hsa; z = t; \<Gamma>\<turnstile> \<langle>h,Normal sa\<rangle> \<Rightarrow> t; \<not> isAbr t\<rbrakk> \<Longrightarrow> \<exists>t'. z = Normal t' \<and> (\<exists>(ra, t)\<in>fst (a s). (t, t') \<in> sr \<and> unif_rrel (n = length hs) r xf arrel axf ra t')
 2. \<And>s s' n z sa. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, s') \<in> sr; A s; s' \<in> C' \<inter> S; \<not> snd (a s); s' = sa; Guard F S c # hs = []; n = 0; z = Abrupt sa\<rbrakk> \<Longrightarrow> \<exists>t'. z = Normal t' \<and> (\<exists>(ra, t)\<in>fst (a s). (t, t') \<in> sr \<and> unif_rrel (n = length hs) r xf arrel axf ra t') proof (prove)
goal (2 subgoals):
 1. \<And>s sa t. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, sa) \<in> sr; A s; \<not> snd (a s); \<Gamma>\<turnstile> \<langle>Guard F S c,Normal sa\<rangle> \<Rightarrow> t; \<not> isAbr t; sa \<in> C'; sa \<in> S\<rbrakk> \<Longrightarrow> \<exists>t'. t = Normal t' \<and> (\<exists>x\<in>fst (a s). case x of (ra, t) \<Rightarrow> (t, t') \<in> sr \<and> unif_rrel True r xf arrel axf ra t')
 2. \<And>s s' n z sa. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, s') \<in> sr; A s; s' \<in> C' \<inter> S; \<not> snd (a s); s' = sa; Guard F S c # hs = []; n = 0; z = Abrupt sa\<rbrakk> \<Longrightarrow> \<exists>t'. z = Normal t' \<and> (\<exists>(ra, t)\<in>fst (a s). (t, t') \<in> sr \<and> unif_rrel (n = length hs) r xf arrel axf ra t') proof (prove)
goal (3 subgoals):
 1. \<And>s sa t. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, sa) \<in> sr; A s; \<not> snd (a s); \<not> isAbr t; sa \<in> C'; sa \<in> S; sa \<in> S; \<Gamma>\<turnstile> \<langle>c,Normal sa\<rangle> \<Rightarrow> t\<rbrakk> \<Longrightarrow> \<exists>t'. t = Normal t' \<and> (\<exists>x\<in>fst (a s). case x of (ra, t) \<Rightarrow> (t, t') \<in> sr \<and> unif_rrel True r xf arrel axf ra t')
 2. \<And>s sa t. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, sa) \<in> sr; A s; \<not> snd (a s); \<not> isAbr t; sa \<in> C'; sa \<in> S; t = Fault F; sa \<notin> S\<rbrakk> \<Longrightarrow> \<exists>t'. t = Normal t' \<and> (\<exists>x\<in>fst (a s). case x of (ra, t) \<Rightarrow> (t, t') \<in> sr \<and> unif_rrel True r xf arrel axf ra t')
 3. \<And>s s' n z sa. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, s') \<in> sr; A s; s' \<in> C' \<inter> S; \<not> snd (a s); s' = sa; Guard F S c # hs = []; n = 0; z = Abrupt sa\<rbrakk> \<Longrightarrow> \<exists>t'. z = Normal t' \<and> (\<exists>(ra, t)\<in>fst (a s). (t, t') \<in> sr \<and> unif_rrel (n = length hs) r xf arrel axf ra t') proof (prove)
goal (4 subgoals):
 1. \<And>s sa t. \<lbrakk>(s, sa) \<in> sr; A s; \<not> snd (a s); \<not> isAbr t; sa \<in> C'; sa \<in> S; sa \<in> S; \<Gamma>\<turnstile> \<langle>c,Normal sa\<rangle> \<Rightarrow> t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^sub>h \<langle>c # hs,sa\<rangle> \<Rightarrow> (?n46 s sa t, ?x46 s sa t)
 2. \<And>s sa t t' ra ta. \<lbrakk>(s, sa) \<in> sr; A s; \<not> snd (a s); \<not> isAbr t; sa \<in> C'; sa \<in> S; sa \<in> S; \<Gamma>\<turnstile> \<langle>c,Normal sa\<rangle> \<Rightarrow> t; ?x46 s sa t = Normal t'; (ra, ta) \<in> fst (a s); (ta, t') \<in> sr; unif_rrel (?n46 s sa t = length hs) r xf arrel axf ra t'; ?n46 s sa t \<le> length hs\<rbrakk> \<Longrightarrow> \<exists>t'. t = Normal t' \<and> (\<exists>x\<in>fst (a s). case x of (ra, t) \<Rightarrow> (t, t') \<in> sr \<and> unif_rrel True r xf arrel axf ra t')
 3. \<And>s sa t. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, sa) \<in> sr; A s; \<not> snd (a s); \<not> isAbr t; sa \<in> C'; sa \<in> S; t = Fault F; sa \<notin> S\<rbrakk> \<Longrightarrow> \<exists>t'. t = Normal t' \<and> (\<exists>x\<in>fst (a s). case x of (ra, t) \<Rightarrow> (t, t') \<in> sr \<and> unif_rrel True r xf arrel axf ra t')
 4. \<And>s s' n z sa. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, s') \<in> sr; A s; s' \<in> C' \<inter> S; \<not> snd (a s); s' = sa; Guard F S c # hs = []; n = 0; z = Abrupt sa\<rbrakk> \<Longrightarrow> \<exists>t'. z = Normal t' \<and> (\<exists>(ra, t)\<in>fst (a s). (t, t') \<in> sr \<and> unif_rrel (n = length hs) r xf arrel axf ra t') proof (prove)
goal (3 subgoals):
 1. \<And>s sa t t' ra ta. \<lbrakk>(s, sa) \<in> sr; A s; \<not> snd (a s); \<not> isAbr t; sa \<in> C'; sa \<in> S; sa \<in> S; \<Gamma>\<turnstile> \<langle>c,Normal sa\<rangle> \<Rightarrow> t; t = Normal t'; (ra, ta) \<in> fst (a s); (ta, t') \<in> sr; unif_rrel (length hs = length hs) r xf arrel axf ra t'; length hs \<le> length hs\<rbrakk> \<Longrightarrow> \<exists>t'. t = Normal t' \<and> (\<exists>x\<in>fst (a s). case x of (ra, t) \<Rightarrow> (t, t') \<in> sr \<and> unif_rrel True r xf arrel axf ra t')
 2. \<And>s sa t. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, sa) \<in> sr; A s; \<not> snd (a s); \<not> isAbr t; sa \<in> C'; sa \<in> S; t = Fault F; sa \<notin> S\<rbrakk> \<Longrightarrow> \<exists>t'. t = Normal t' \<and> (\<exists>x\<in>fst (a s). case x of (ra, t) \<Rightarrow> (t, t') \<in> sr \<and> unif_rrel True r xf arrel axf ra t')
 3. \<And>s s' n z sa. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, s') \<in> sr; A s; s' \<in> C' \<inter> S; \<not> snd (a s); s' = sa; Guard F S c # hs = []; n = 0; z = Abrupt sa\<rbrakk> \<Longrightarrow> \<exists>t'. z = Normal t' \<and> (\<exists>(ra, t)\<in>fst (a s). (t, t') \<in> sr \<and> unif_rrel (n = length hs) r xf arrel axf ra t') proof (prove)
goal (2 subgoals):
 1. \<And>s sa t. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, sa) \<in> sr; A s; \<not> snd (a s); \<not> isAbr t; sa \<in> C'; sa \<in> S; t = Fault F; sa \<notin> S\<rbrakk> \<Longrightarrow> \<exists>t'. t = Normal t' \<and> (\<exists>x\<in>fst (a s). case x of (ra, t) \<Rightarrow> (t, t') \<in> sr \<and> unif_rrel True r xf arrel axf ra t')
 2. \<And>s s' n z sa. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, s') \<in> sr; A s; s' \<in> C' \<inter> S; \<not> snd (a s); s' = sa; Guard F S c # hs = []; n = 0; z = Abrupt sa\<rbrakk> \<Longrightarrow> \<exists>t'. z = Normal t' \<and> (\<exists>(ra, t)\<in>fst (a s). (t, t') \<in> sr \<and> unif_rrel (n = length hs) r xf arrel axf ra t') proof (prove)
goal (1 subgoal):
 1. \<And>s s' n z sa. \<lbrakk>ccorres_underlying sr \<Gamma> r xf arrel axf A C' hs a c; (s, s') \<in> sr; A s; s' \<in> C' \<inter> S; \<not> snd (a s); s' = sa; Guard F S c # hs = []; n = 0; z = Abrupt sa\<rbrakk> \<Longrightarrow> \<exists>t'. z = Normal t' \<and> (\<exists>(ra, t)\<in>fst (a s). (t, t') \<in> sr \<and> unif_rrel (n = length hs) r xf arrel axf ra t') proof (prove)
goal:
No subgoals!