theory CCorresLemmas

lemma ccorres_While:
  assumes body_ccorres:
    "\<And>r. ccorresG srel \<Gamma> rrel xf
           (\<lambda>s. G r s \<and> C r s = Some True) (G' \<inter> C' \<inter> {s'. rrel r (xf s')}) []
           (B r) B'"
  assumes cond_ccorres:
    "\<And>r. ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf
           (G r) (G' \<inter> {s'. rrel r (xf s')}) []
           (gets_the (C r)) cond"
  assumes nf: "\<And>r. no_fail (\<lambda>s. G r s \<and> C r s = Some True) (B r)"
  assumes no_ofail: "\<And>r. no_ofail (G r) (C r)"
  assumes body_inv:
    "\<And>r. \<lbrace>\<lambda>s. G r s \<and> C r s = Some True\<rbrace> B r \<lbrace>G\<rbrace>"
    "\<And>r s. \<Gamma> \<turnstile> {s'. s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')
                    \<and> s' \<in> C' \<and> C r s = Some True}
                B' G'"
  assumes cond_hoarep:
    "\<And>r s. \<Gamma> \<turnstile> {s'. s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')}
                cond
                {s'. s' \<in> G' \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}"
  shows
    "ccorresG srel \<Gamma> rrel xf (G r) (G' \<inter> {s'. rrel r (xf s')}) hs
       (whileLoop (\<lambda>r s. the (C r s)) B r)
       (cond;; While {s'. cond_xf s' \<noteq> 0} (B';; cond))" proof - note unif_rrel_def[simp add] to_bool_def[simp add] have helper:
    "\<And>state xstate'.
       \<Gamma> \<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (Seq B' cond), Normal state\<rangle> \<Rightarrow> xstate' \<Longrightarrow>
       \<forall>st r s. Normal st = xstate' \<and> (s, state) \<in> srel
                 \<and> (C r s \<noteq> None) \<and> (cond_xf state \<noteq> 0) = the (C r s)
                 \<and> rrel r (xf state) \<and> G r s \<and> state \<in> G' \<and> (cond_xf state \<noteq> 0 \<longrightarrow> state \<in> C')
                \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s)) B r s)
                             \<and> (s', st) \<in> srel \<and> rrel rv (xf st))" apply (erule_tac C="{s'. cond_xf s' \<noteq> 0}" in exec_While_final_inv''; simp) apply (fastforce simp: whileLoop_cond_fail return_def) apply clarsimp apply (rename_tac t t' t'' r s y) apply (frule_tac P="{s'. s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')
                             \<and> s' \<in> C' \<and> (C r s \<noteq> None) \<and> the (C r s)}"
                  in intermediate_Normal_state) apply fastforce apply (fastforce intro: body_inv conseqPre) apply clarsimp apply (rename_tac inter_t) apply (prop_tac "\<exists>rv' s'. rrel rv' (xf inter_t) \<and> (rv', s') \<in> fst (B r s)
                              \<and> (s', inter_t) \<in> srel") apply (insert body_ccorres)[1] apply (drule_tac x=r in meta_spec) apply (erule (1) ccorresE) apply fastforce apply fastforce using nf apply (fastforce simp: no_fail_def) apply (fastforce dest!: EHOther) apply fastforce apply clarsimp apply (prop_tac "G rv' s'") apply (fastforce dest: use_valid intro: body_inv) apply (prop_tac "inter_t \<in> G'") apply (fastforce dest: hoarep_exec[rotated] intro: body_inv) apply (drule_tac x=rv' in spec) apply (drule_tac x=s' in spec) apply (prop_tac "rrel rv' (xf inter_t)") apply (fastforce dest: hoarep_exec[OF _ _ cond_hoarep, rotated]) apply (elim impE) apply (frule_tac s'=inter_t and r1=rv' in ccorresE_gets_the[OF cond_ccorres]; assumption?) apply fastforce apply (fastforce intro: no_ofail) apply (fastforce dest: EHOther) apply (intro conjI) apply fastforce using no_ofail apply (fastforce elim!: no_ofailD) apply fastforce apply (fastforce dest: hoarep_exec[OF _ _ cond_hoarep, rotated]) apply (fastforce dest: hoarep_exec[OF _ _ cond_hoarep, rotated]) apply (fastforce dest: hoarep_exec[OF _ _ cond_hoarep, rotated]) apply (fastforce dest: hoarep_exec[OF _ _ cond_hoarep, rotated]) apply (fastforce simp: whileLoop_def intro: whileLoop_results.intros(3)) done have cond_hoarep':
    "\<And>r s s' n xstate.
       \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;; While {s'. cond_xf s' \<noteq> 0} (B';; cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)
       \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')}
              cond
              {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s'))
                   \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> (s' \<in> C' \<and> C r s = Some True))}" apply (insert cond_ccorres) apply (drule_tac x=r in meta_spec) apply (frule_tac s=s in ccorres_to_vcg_gets_the) apply (fastforce intro: no_ofail) apply (insert cond_hoarep) apply (drule_tac x=s in meta_spec) apply (drule_tac x=r in meta_spec) apply (rule hoarep_conj_lift_pre_fix) apply (rule hoarep_conj_lift_pre_fix) apply (insert cond_hoarep)[1] apply (fastforce simp: conseq_under_new_pre) apply (fastforce intro!: hoarep_conj_lift_pre_fix simp: Collect_mono conseq_under_new_pre) apply (insert cond_hoarep) apply (drule_tac x=s in meta_spec) apply (drule_tac x=r in meta_spec) apply (simp add: imp_conjR) apply (rule hoarep_conj_lift_pre_fix) apply (simp add: Collect_mono conseq_under_new_pre) apply (rule_tac Q'="{s'. C r s \<noteq> None \<and> the (C r s) = (cond_xf s' \<noteq> 0)}"
                 in conseqPost[rotated]) apply fastforce apply fastforce apply (simp add: Collect_mono conseq_under_new_pre) done have cond_inv_guard:
    "\<And>r s. \<Gamma> \<turnstile> {s'. s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')}
                cond
                {s'. s' \<in> G' \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C')}" by (fastforce intro: conseqPost cond_hoarep) show ?thesis apply (clarsimp simp: ccorres_underlying_def) apply (rename_tac s s' n xstate) apply (frule_tac R'="{s'. s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')}"
                 and Q'="{s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')}"
                  in exec_handlers_use_hoare_nothrow_hoarep) apply fastforce apply (rule HoarePartial.Seq) apply (erule cond_hoarep') apply (rule conseqPre) apply (rule ccorres_While_Normal_helper) apply (fastforce intro!: cond_hoarep' hoarep_ex_lift) apply (intro hoarep_ex_pre, rename_tac rv new_s) apply (insert cond_inv_guard)[1] apply (drule_tac x=new_s in meta_spec) apply (drule_tac x=rv in meta_spec) apply (insert body_ccorres)[1] apply (drule_tac x=rv in meta_spec) apply (insert body_inv(2))[1] apply (drule_tac x=new_s in meta_spec) apply (drule_tac x=rv in meta_spec) apply (frule_tac s=new_s in ccorres_to_vcg_with_prop) using nf apply fastforce using body_inv apply fastforce apply (rule_tac Q'="{s'. s' \<in> G'
                               \<and> (\<exists>(rv, s) \<in>fst (B rv new_s). (s, s') \<in> srel \<and> rrel rv (xf s')
                                                               \<and> G rv s)}"
                   in conseqPost;
             fastforce?) apply (rule hoarep_conj_lift_pre_fix;
             fastforce simp: Collect_mono conseq_under_new_pre) apply fastforce apply (case_tac xstate; clarsimp) apply (frule intermediate_Normal_state[OF _ _ cond_hoarep]; assumption?) apply fastforce apply clarsimp apply (rename_tac inter_t) apply (insert cond_ccorres) apply (drule_tac x=r in meta_spec) apply (drule (2) ccorresE_gets_the) apply fastforce apply (fastforce intro: no_ofail) apply (fastforce dest: EHOther) apply (prop_tac "rrel r (xf inter_t)") apply (fastforce dest: hoarep_exec[rotated] intro: cond_hoarep) apply (case_tac "\<not> the (C r s)") apply (fastforce elim: exec_Normal_elim_cases simp: whileLoop_cond_fail return_def) apply (insert no_ofail) apply (fastforce dest!: helper hoarep_exec[OF _ _ cond_inv_guard, rotated] no_ofailD) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorresG srel \<Gamma> rrel xf (G r) (G' \<inter> {s'. rrel r (xf s')}) hs (whileLoop (\<lambda>r s. the (C r s))
  B r) (cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) proof (state)
goal (1 subgoal):
 1. ccorresG srel \<Gamma> rrel xf (G r) (G' \<inter> {s'. rrel r (xf s')}) hs (whileLoop (\<lambda>r s. the (C r s))
  B r) (cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) proof (state)
this:
unif_rrel ?f ?rrel ?xf ?arrel ?axf \<equiv> \<lambda>x s. if ?f then ?rrel x (?xf s) else ?arrel x (?axf s)
to_bool \<equiv> (\<noteq>) 0

goal (1 subgoal):
 1. ccorresG srel \<Gamma> rrel xf (G r) (G' \<inter> {s'. rrel r (xf s')}) hs (whileLoop (\<lambda>r s. the (C r s))
  B r) (cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) proof (prove)
goal (1 subgoal):
 1. \<And>state xstate'. \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal state\<rangle> \<Rightarrow> xstate' \<Longrightarrow> \<forall>st r s. Normal st = xstate' \<and> (s, state) \<in> srel \<and> C r s \<noteq> None \<and> (cond_xf state \<noteq> 0) = the (C r s) \<and> rrel r (xf state) \<and> G r s \<and> state \<in> G' \<and> (cond_xf state \<noteq> 0 \<longrightarrow> state \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', st) \<in> srel \<and> rrel rv (xf st)) proof (prove)
goal (2 subgoals):
 1. \<And>s. cond_xf s = 0 \<Longrightarrow> \<forall>r sa. (sa, s) \<in> srel \<and> (\<exists>y. C r sa = Some y) \<and> \<not> the (C r sa) \<and> rrel r (xf s) \<and> G r sa \<and> s \<in> G' \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r sa) \<and> (s', s) \<in> srel \<and> rrel rv (xf s))
 2. \<And>state xstate' t t' t''. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> t''; \<forall>st r s. Normal st = t'' \<and> (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', st) \<in> srel \<and> rrel rv (xf st))\<rbrakk> \<Longrightarrow> \<forall>st r s. Normal st = t'' \<and> (s, t) \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> the (C r s) \<and> rrel r (xf t) \<and> G r s \<and> t \<in> G' \<and> t \<in> C' \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', st) \<in> srel \<and> rrel rv (xf st)) proof (prove)
goal (1 subgoal):
 1. \<And>state xstate' t t' t''. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> t''; \<forall>st r s. Normal st = t'' \<and> (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', st) \<in> srel \<and> rrel rv (xf st))\<rbrakk> \<Longrightarrow> \<forall>st r s. Normal st = t'' \<and> (s, t) \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> the (C r s) \<and> rrel r (xf t) \<and> G r s \<and> t \<in> G' \<and> t \<in> C' \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', st) \<in> srel \<and> rrel rv (xf st)) proof (prove)
goal (1 subgoal):
 1. \<And>t t' st r s y. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal st; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', st) \<in> srel \<and> rrel rv (xf st)); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', st) \<in> srel \<and> rrel rv (xf st) proof (prove)
goal (1 subgoal):
 1. \<And>t t' t'' r s y. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (3 subgoals):
 1. \<And>t t' t'' r s y. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'\<rbrakk> \<Longrightarrow> t \<in> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s') \<and> s' \<in> C' \<and> C r s \<noteq> None \<and> the (C r s)}
 2. \<And>t t' t'' r s y. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s') \<and> s' \<in> C' \<and> C r s \<noteq> None \<and> the (C r s)} B' (?Q46 t t' t'' r s y)
 3. \<And>t t' t'' r s y. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<exists>t'a. \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal t'a \<and> \<Gamma>\<turnstile> \<langle>cond,Normal t'a\<rangle> \<Rightarrow> Normal t'\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (2 subgoals):
 1. \<And>t t' t'' r s y. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s') \<and> s' \<in> C' \<and> C r s \<noteq> None \<and> the (C r s)} B' (?Q46 t t' t'' r s y)
 2. \<And>t t' t'' r s y. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<exists>t'a. \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal t'a \<and> \<Gamma>\<turnstile> \<langle>cond,Normal t'a\<rangle> \<Rightarrow> Normal t'\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (1 subgoal):
 1. \<And>t t' t'' r s y. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<exists>t'a. \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal t'a \<and> \<Gamma>\<turnstile> \<langle>cond,Normal t'a\<rangle> \<Rightarrow> Normal t'\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (1 subgoal):
 1. \<And>t t' t'' r s y t'a. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal t'a; \<Gamma>\<turnstile> \<langle>cond,Normal t'a\<rangle> \<Rightarrow> Normal t'\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (1 subgoal):
 1. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (2 subgoals):
 1. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'\<rbrakk> \<Longrightarrow> \<exists>rv' s'. rrel rv' (xf inter_t) \<and> (rv', s') \<in> fst (B r s) \<and> (s', inter_t) \<in> srel
 2. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; \<exists>rv' s'. rrel rv' (xf inter_t) \<and> (rv', s') \<in> fst (B r s) \<and> (s', inter_t) \<in> srel\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (2 subgoals):
 1. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; \<And>r. ccorresG srel \<Gamma> rrel xf (\<lambda>s. G r s \<and> C r s = Some True) (G' \<inter> C' \<inter> {s'. rrel r (xf s')}) [] (B r) B'\<rbrakk> \<Longrightarrow> \<exists>rv' s'. rrel rv' (xf inter_t) \<and> (rv', s') \<in> fst (B r s) \<and> (s', inter_t) \<in> srel
 2. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; \<exists>rv' s'. rrel rv' (xf inter_t) \<and> (rv', s') \<in> fst (B r s) \<and> (s', inter_t) \<in> srel\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (2 subgoals):
 1. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; ccorresG srel \<Gamma> rrel xf (\<lambda>s. G r s \<and> C r s = Some True) (G' \<inter> C' \<inter> {s'. rrel r (xf s')}) [] (B r) B'\<rbrakk> \<Longrightarrow> \<exists>rv' s'. rrel rv' (xf inter_t) \<and> (rv', s') \<in> fst (B r s) \<and> (s', inter_t) \<in> srel
 2. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; \<exists>rv' s'. rrel rv' (xf inter_t) \<and> (rv', s') \<in> fst (B r s) \<and> (s', inter_t) \<in> srel\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (6 subgoals):
 1. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'\<rbrakk> \<Longrightarrow> G r s \<and> C r s = Some True
 2. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'\<rbrakk> \<Longrightarrow> t \<in> G' \<inter> C' \<inter> {s'. rrel r (xf s')}
 3. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'\<rbrakk> \<Longrightarrow> \<not> snd (B r s)
 4. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^sub>h \<langle>[B'],t\<rangle> \<Rightarrow> (?n258 t t' t'' r s y inter_t, ?x258 t t' t'' r s y inter_t)
 5. \<And>t t' t'' r s y inter_t t'a ra ta. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; ?x258 t t' t'' r s y inter_t = Normal t'a; (ra, ta) \<in> fst (B r s); (ta, t'a) \<in> srel; unif_rrel (?n258 t t' t'' r s y inter_t = length []) rrel xf rrel xf ra t'a; ?n258 t t' t'' r s y inter_t \<le> length []\<rbrakk> \<Longrightarrow> \<exists>rv' s'. rrel rv' (xf inter_t) \<and> (rv', s') \<in> fst (B r s) \<and> (s', inter_t) \<in> srel
 6. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; \<exists>rv' s'. rrel rv' (xf inter_t) \<and> (rv', s') \<in> fst (B r s) \<and> (s', inter_t) \<in> srel\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (5 subgoals):
 1. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'\<rbrakk> \<Longrightarrow> t \<in> G' \<inter> C' \<inter> {s'. rrel r (xf s')}
 2. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'\<rbrakk> \<Longrightarrow> \<not> snd (B r s)
 3. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^sub>h \<langle>[B'],t\<rangle> \<Rightarrow> (?n258 t t' t'' r s y inter_t, ?x258 t t' t'' r s y inter_t)
 4. \<And>t t' t'' r s y inter_t t'a ra ta. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; ?x258 t t' t'' r s y inter_t = Normal t'a; (ra, ta) \<in> fst (B r s); (ta, t'a) \<in> srel; unif_rrel (?n258 t t' t'' r s y inter_t = length []) rrel xf rrel xf ra t'a; ?n258 t t' t'' r s y inter_t \<le> length []\<rbrakk> \<Longrightarrow> \<exists>rv' s'. rrel rv' (xf inter_t) \<and> (rv', s') \<in> fst (B r s) \<and> (s', inter_t) \<in> srel
 5. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; \<exists>rv' s'. rrel rv' (xf inter_t) \<and> (rv', s') \<in> fst (B r s) \<and> (s', inter_t) \<in> srel\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (4 subgoals):
 1. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'\<rbrakk> \<Longrightarrow> \<not> snd (B r s)
 2. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^sub>h \<langle>[B'],t\<rangle> \<Rightarrow> (?n258 t t' t'' r s y inter_t, ?x258 t t' t'' r s y inter_t)
 3. \<And>t t' t'' r s y inter_t t'a ra ta. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; ?x258 t t' t'' r s y inter_t = Normal t'a; (ra, ta) \<in> fst (B r s); (ta, t'a) \<in> srel; unif_rrel (?n258 t t' t'' r s y inter_t = length []) rrel xf rrel xf ra t'a; ?n258 t t' t'' r s y inter_t \<le> length []\<rbrakk> \<Longrightarrow> \<exists>rv' s'. rrel rv' (xf inter_t) \<and> (rv', s') \<in> fst (B r s) \<and> (s', inter_t) \<in> srel
 4. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; \<exists>rv' s'. rrel rv' (xf inter_t) \<and> (rv', s') \<in> fst (B r s) \<and> (s', inter_t) \<in> srel\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
using this:
no_fail (\<lambda>s. G ?r s \<and> C ?r s = Some True) (B ?r)

goal (4 subgoals):
 1. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'\<rbrakk> \<Longrightarrow> \<not> snd (B r s)
 2. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^sub>h \<langle>[B'],t\<rangle> \<Rightarrow> (?n258 t t' t'' r s y inter_t, ?x258 t t' t'' r s y inter_t)
 3. \<And>t t' t'' r s y inter_t t'a ra ta. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; ?x258 t t' t'' r s y inter_t = Normal t'a; (ra, ta) \<in> fst (B r s); (ta, t'a) \<in> srel; unif_rrel (?n258 t t' t'' r s y inter_t = length []) rrel xf rrel xf ra t'a; ?n258 t t' t'' r s y inter_t \<le> length []\<rbrakk> \<Longrightarrow> \<exists>rv' s'. rrel rv' (xf inter_t) \<and> (rv', s') \<in> fst (B r s) \<and> (s', inter_t) \<in> srel
 4. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; \<exists>rv' s'. rrel rv' (xf inter_t) \<and> (rv', s') \<in> fst (B r s) \<and> (s', inter_t) \<in> srel\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (3 subgoals):
 1. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^sub>h \<langle>[B'],t\<rangle> \<Rightarrow> (?n258 t t' t'' r s y inter_t, ?x258 t t' t'' r s y inter_t)
 2. \<And>t t' t'' r s y inter_t t'a ra ta. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; ?x258 t t' t'' r s y inter_t = Normal t'a; (ra, ta) \<in> fst (B r s); (ta, t'a) \<in> srel; unif_rrel (?n258 t t' t'' r s y inter_t = length []) rrel xf rrel xf ra t'a; ?n258 t t' t'' r s y inter_t \<le> length []\<rbrakk> \<Longrightarrow> \<exists>rv' s'. rrel rv' (xf inter_t) \<and> (rv', s') \<in> fst (B r s) \<and> (s', inter_t) \<in> srel
 3. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; \<exists>rv' s'. rrel rv' (xf inter_t) \<and> (rv', s') \<in> fst (B r s) \<and> (s', inter_t) \<in> srel\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (2 subgoals):
 1. \<And>t t' t'' r s y inter_t t'a ra ta. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; Normal inter_t = Normal t'a; (ra, ta) \<in> fst (B r s); (ta, t'a) \<in> srel; unif_rrel (length [] = length []) rrel xf rrel xf ra t'a; length [] \<le> length []\<rbrakk> \<Longrightarrow> \<exists>rv' s'. rrel rv' (xf inter_t) \<and> (rv', s') \<in> fst (B r s) \<and> (s', inter_t) \<in> srel
 2. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; \<exists>rv' s'. rrel rv' (xf inter_t) \<and> (rv', s') \<in> fst (B r s) \<and> (s', inter_t) \<in> srel\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (1 subgoal):
 1. \<And>t t' t'' r s y inter_t. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; \<exists>rv' s'. rrel rv' (xf inter_t) \<and> (rv', s') \<in> fst (B r s) \<and> (s', inter_t) \<in> srel\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (1 subgoal):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (2 subgoals):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel\<rbrakk> \<Longrightarrow> G rv' s'
 2. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (1 subgoal):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (2 subgoals):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'\<rbrakk> \<Longrightarrow> inter_t \<in> G'
 2. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (1 subgoal):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; \<forall>r s. (s, t') \<in> srel \<and> (\<exists>y. C r s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C r s) \<and> rrel r (xf t') \<and> G r s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'')); (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (1 subgoal):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; \<forall>s. (s, t') \<in> srel \<and> (\<exists>y. C rv' s = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C rv' s) \<and> rrel rv' (xf t') \<and> G rv' s \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B rv' s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t''))\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (1 subgoal):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; (s', t') \<in> srel \<and> (\<exists>y. C rv' s' = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C rv' s') \<and> rrel rv' (xf t') \<and> G rv' s' \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'a. (rv, s'a) \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B rv' s') \<and> (s'a, t'') \<in> srel \<and> rrel rv (xf t''))\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (2 subgoals):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; (s', t') \<in> srel \<and> (\<exists>y. C rv' s' = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C rv' s') \<and> rrel rv' (xf t') \<and> G rv' s' \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'a. (rv, s'a) \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B rv' s') \<and> (s'a, t'') \<in> srel \<and> rrel rv (xf t''))\<rbrakk> \<Longrightarrow> rrel rv' (xf inter_t)
 2. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; (s', t') \<in> srel \<and> (\<exists>y. C rv' s' = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C rv' s') \<and> rrel rv' (xf t') \<and> G rv' s' \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'a. (rv, s'a) \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B rv' s') \<and> (s'a, t'') \<in> srel \<and> rrel rv (xf t'')); rrel rv' (xf inter_t)\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (1 subgoal):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; (s', t') \<in> srel \<and> (\<exists>y. C rv' s' = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C rv' s') \<and> rrel rv' (xf t') \<and> G rv' s' \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C') \<longrightarrow> (\<exists>rv s'a. (rv, s'a) \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B rv' s') \<and> (s'a, t'') \<in> srel \<and> rrel rv (xf t'')); rrel rv' (xf inter_t)\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (2 subgoals):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t)\<rbrakk> \<Longrightarrow> (s', t') \<in> srel \<and> (\<exists>y. C rv' s' = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C rv' s') \<and> rrel rv' (xf t') \<and> G rv' s' \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C')
 2. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); \<exists>rv s'a. (rv, s'a) \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B rv' s') \<and> (s'a, t'') \<in> srel \<and> rrel rv (xf t'')\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (5 subgoals):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t)\<rbrakk> \<Longrightarrow> inter_t \<in> G' \<inter> {s'. rrel rv' (xf s')}
 2. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t)\<rbrakk> \<Longrightarrow> no_ofail (G rv') (C rv')
 3. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^sub>h \<langle>[cond],inter_t\<rangle> \<Rightarrow> (?n751 t t' t'' r s y inter_t rv' s', Normal (?t'751 t t' t'' r s y inter_t rv' s'))
 4. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', ?t'751 t t' t'' r s y inter_t rv' s') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf (?t'751 t t' t'' r s y inter_t rv' s'))\<rbrakk> \<Longrightarrow> (s', t') \<in> srel \<and> (\<exists>y. C rv' s' = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C rv' s') \<and> rrel rv' (xf t') \<and> G rv' s' \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C')
 5. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); \<exists>rv s'a. (rv, s'a) \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B rv' s') \<and> (s'a, t'') \<in> srel \<and> rrel rv (xf t'')\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (4 subgoals):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t)\<rbrakk> \<Longrightarrow> no_ofail (G rv') (C rv')
 2. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^sub>h \<langle>[cond],inter_t\<rangle> \<Rightarrow> (?n751 t t' t'' r s y inter_t rv' s', Normal (?t'751 t t' t'' r s y inter_t rv' s'))
 3. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', ?t'751 t t' t'' r s y inter_t rv' s') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf (?t'751 t t' t'' r s y inter_t rv' s'))\<rbrakk> \<Longrightarrow> (s', t') \<in> srel \<and> (\<exists>y. C rv' s' = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C rv' s') \<and> rrel rv' (xf t') \<and> G rv' s' \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C')
 4. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); \<exists>rv s'a. (rv, s'a) \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B rv' s') \<and> (s'a, t'') \<in> srel \<and> rrel rv (xf t'')\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (3 subgoals):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^sub>h \<langle>[cond],inter_t\<rangle> \<Rightarrow> (?n751 t t' t'' r s y inter_t rv' s', Normal (?t'751 t t' t'' r s y inter_t rv' s'))
 2. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', ?t'751 t t' t'' r s y inter_t rv' s') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf (?t'751 t t' t'' r s y inter_t rv' s'))\<rbrakk> \<Longrightarrow> (s', t') \<in> srel \<and> (\<exists>y. C rv' s' = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C rv' s') \<and> rrel rv' (xf t') \<and> G rv' s' \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C')
 3. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); \<exists>rv s'a. (rv, s'a) \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B rv' s') \<and> (s'a, t'') \<in> srel \<and> rrel rv (xf t'')\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (2 subgoals):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> (s', t') \<in> srel \<and> (\<exists>y. C rv' s' = Some y) \<and> (cond_xf t' \<noteq> 0) = the (C rv' s') \<and> rrel rv' (xf t') \<and> G rv' s' \<and> t' \<in> G' \<and> (cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C')
 2. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); \<exists>rv s'a. (rv, s'a) \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B rv' s') \<and> (s'a, t'') \<in> srel \<and> rrel rv (xf t'')\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (8 subgoals):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> (s', t') \<in> srel
 2. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> \<exists>y. C rv' s' = Some y
 3. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> (cond_xf t' \<noteq> 0) = the (C rv' s')
 4. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> rrel rv' (xf t')
 5. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> G rv' s'
 6. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> t' \<in> G'
 7. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C'
 8. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); \<exists>rv s'a. (rv, s'a) \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B rv' s') \<and> (s'a, t'') \<in> srel \<and> rrel rv (xf t'')\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (7 subgoals):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> \<exists>y. C rv' s' = Some y
 2. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> (cond_xf t' \<noteq> 0) = the (C rv' s')
 3. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> rrel rv' (xf t')
 4. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> G rv' s'
 5. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> t' \<in> G'
 6. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C'
 7. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); \<exists>rv s'a. (rv, s'a) \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B rv' s') \<and> (s'a, t'') \<in> srel \<and> rrel rv (xf t'')\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
using this:
no_ofail (G ?r) (C ?r)

goal (7 subgoals):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> \<exists>y. C rv' s' = Some y
 2. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> (cond_xf t' \<noteq> 0) = the (C rv' s')
 3. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> rrel rv' (xf t')
 4. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> G rv' s'
 5. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> t' \<in> G'
 6. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C'
 7. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); \<exists>rv s'a. (rv, s'a) \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B rv' s') \<and> (s'a, t'') \<in> srel \<and> rrel rv (xf t'')\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (6 subgoals):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> (cond_xf t' \<noteq> 0) = the (C rv' s')
 2. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> rrel rv' (xf t')
 3. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> G rv' s'
 4. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> t' \<in> G'
 5. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C'
 6. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); \<exists>rv s'a. (rv, s'a) \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B rv' s') \<and> (s'a, t'') \<in> srel \<and> rrel rv (xf t'')\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (5 subgoals):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> rrel rv' (xf t')
 2. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> G rv' s'
 3. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> t' \<in> G'
 4. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C'
 5. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); \<exists>rv s'a. (rv, s'a) \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B rv' s') \<and> (s'a, t'') \<in> srel \<and> rrel rv (xf t'')\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (4 subgoals):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> G rv' s'
 2. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> t' \<in> G'
 3. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C'
 4. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); \<exists>rv s'a. (rv, s'a) \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B rv' s') \<and> (s'a, t'') \<in> srel \<and> rrel rv (xf t'')\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (3 subgoals):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> t' \<in> G'
 2. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C'
 3. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); \<exists>rv s'a. (rv, s'a) \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B rv' s') \<and> (s'a, t'') \<in> srel \<and> rrel rv (xf t'')\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (2 subgoals):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); (s', t') \<in> srel \<and> the (C rv' s') = to_bool (cond_xf t')\<rbrakk> \<Longrightarrow> cond_xf t' \<noteq> 0 \<longrightarrow> t' \<in> C'
 2. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); \<exists>rv s'a. (rv, s'a) \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B rv' s') \<and> (s'a, t'') \<in> srel \<and> rrel rv (xf t'')\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal (1 subgoal):
 1. \<And>t t' t'' r s y inter_t rv' s'. \<lbrakk>cond_xf t \<noteq> 0; \<Gamma>\<turnstile> \<langle>B';;
cond,Normal t\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal t''; (s, t) \<in> srel; C r s = Some True; y; rrel r (xf t); G r s; t \<in> G'; t \<in> C'; \<Gamma>\<turnstile> \<langle>B',Normal t\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>cond,Normal inter_t\<rangle> \<Rightarrow> Normal t'; rrel rv' (xf inter_t); (rv', s') \<in> fst (B r s); (s', inter_t) \<in> srel; G rv' s'; inter_t \<in> G'; rrel rv' (xf inter_t); \<exists>rv s'a. (rv, s'a) \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B rv' s') \<and> (s'a, t'') \<in> srel \<and> rrel rv (xf t'')\<rbrakk> \<Longrightarrow> \<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', t'') \<in> srel \<and> rrel rv (xf t'') proof (prove)
goal:
No subgoals! proof (state)
this:
\<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal ?state\<rangle> \<Rightarrow> ?xstate' \<Longrightarrow> \<forall>st r s. Normal st = ?xstate' \<and> (s, ?state) \<in> srel \<and> C r s \<noteq> None \<and> (cond_xf ?state \<noteq> 0) = the (C r s) \<and> rrel r (xf ?state) \<and> G r s \<and> ?state \<in> G' \<and> (cond_xf ?state \<noteq> 0 \<longrightarrow> ?state \<in> C') \<longrightarrow> (\<exists>rv s'. (rv, s') \<in> fst (whileLoop (\<lambda>r s. the (C r s))
  B r s) \<and> (s', st) \<in> srel \<and> rrel rv (xf st))

goal (1 subgoal):
 1. ccorresG srel \<Gamma> rrel xf (G r) (G' \<inter> {s'. rrel r (xf s')}) hs (whileLoop (\<lambda>r s. the (C r s))
  B r) (cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) proof (prove)
goal (1 subgoal):
 1. \<And>r s s' n xstate. \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate) \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} proof (prove)
goal (1 subgoal):
 1. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<And>r. ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} proof (prove)
goal (1 subgoal):
 1. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} proof (prove)
goal (2 subgoals):
 1. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond\<rbrakk> \<Longrightarrow> no_ofail (G r) (C r)
 2. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> C r s \<noteq> None \<and> the (C r s) = to_bool (cond_xf t')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} proof (prove)
goal (1 subgoal):
 1. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> C r s \<noteq> None \<and> the (C r s) = to_bool (cond_xf t')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} proof (prove)
goal (1 subgoal):
 1. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> C r s \<noteq> None \<and> the (C r s) = to_bool (cond_xf t')}; \<And>s r. \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} proof (prove)
goal (1 subgoal):
 1. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> C r s \<noteq> None \<and> the (C r s) = to_bool (cond_xf t')}; \<And>r. \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} proof (prove)
goal (1 subgoal):
 1. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> C r s \<noteq> None \<and> the (C r s) = to_bool (cond_xf t')}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} proof (prove)
goal (2 subgoals):
 1. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> C r s \<noteq> None \<and> the (C r s) = to_bool (cond_xf t')}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')}
 2. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> C r s \<noteq> None \<and> the (C r s) = to_bool (cond_xf t')}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True} proof (prove)
goal (3 subgoals):
 1. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> C r s \<noteq> None \<and> the (C r s) = to_bool (cond_xf t')}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. s' \<in> G'}
 2. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> C r s \<noteq> None \<and> the (C r s) = to_bool (cond_xf t')}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')}
 3. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> C r s \<noteq> None \<and> the (C r s) = to_bool (cond_xf t')}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True} proof (prove)
goal (3 subgoals):
 1. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> C r s \<noteq> None \<and> the (C r s) = to_bool (cond_xf t')}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}; \<And>s r. \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. s' \<in> G'}
 2. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> C r s \<noteq> None \<and> the (C r s) = to_bool (cond_xf t')}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')}
 3. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> C r s \<noteq> None \<and> the (C r s) = to_bool (cond_xf t')}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True} proof (prove)
goal (2 subgoals):
 1. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> C r s \<noteq> None \<and> the (C r s) = to_bool (cond_xf t')}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')}
 2. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> C r s \<noteq> None \<and> the (C r s) = to_bool (cond_xf t')}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True} proof (prove)
goal (1 subgoal):
 1. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> C r s \<noteq> None \<and> the (C r s) = to_bool (cond_xf t')}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True} proof (prove)
goal (1 subgoal):
 1. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> C r s \<noteq> None \<and> the (C r s) = to_bool (cond_xf t')}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}; \<And>s r. \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True} proof (prove)
goal (1 subgoal):
 1. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> C r s \<noteq> None \<and> the (C r s) = to_bool (cond_xf t')}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}; \<And>r. \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True} proof (prove)
goal (1 subgoal):
 1. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> C r s \<noteq> None \<and> the (C r s) = to_bool (cond_xf t')}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True} proof (prove)
goal (1 subgoal):
 1. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> (\<exists>y. C r s = Some y) \<and> the (C r s) = (cond_xf t' \<noteq> 0)}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> C r s = Some True)} proof (prove)
goal (2 subgoals):
 1. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> (\<exists>y. C r s = Some y) \<and> the (C r s) = (cond_xf t' \<noteq> 0)}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'}
 2. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> (\<exists>y. C r s = Some y) \<and> the (C r s) = (cond_xf t' \<noteq> 0)}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. cond_xf s' \<noteq> 0 \<longrightarrow> C r s = Some True} proof (prove)
goal (1 subgoal):
 1. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> (\<exists>y. C r s = Some y) \<and> the (C r s) = (cond_xf t' \<noteq> 0)}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. cond_xf s' \<noteq> 0 \<longrightarrow> C r s = Some True} proof (prove)
goal (3 subgoals):
 1. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> (\<exists>y. C r s = Some y) \<and> the (C r s) = (cond_xf t' \<noteq> 0)}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> {s'. C r s \<noteq> None \<and> the (C r s) = (cond_xf s' \<noteq> 0)} \<subseteq> {s'. cond_xf s' \<noteq> 0 \<longrightarrow> C r s = Some True}
 2. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> (\<exists>y. C r s = Some y) \<and> the (C r s) = (cond_xf t' \<noteq> 0)}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> ?A'43 r s s' n xstate \<subseteq> {}
 3. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> (\<exists>y. C r s = Some y) \<and> the (C r s) = (cond_xf t' \<noteq> 0)}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. C r s \<noteq> None \<and> the (C r s) = (cond_xf s' \<noteq> 0)},(?A'43 r s s' n xstate) proof (prove)
goal (2 subgoals):
 1. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> (\<exists>y. C r s = Some y) \<and> the (C r s) = (cond_xf t' \<noteq> 0)}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> ?A'43 r s s' n xstate \<subseteq> {}
 2. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> (\<exists>y. C r s = Some y) \<and> the (C r s) = (cond_xf t' \<noteq> 0)}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. C r s \<noteq> None \<and> the (C r s) = (cond_xf s' \<noteq> 0)},(?A'43 r s s' n xstate) proof (prove)
goal (1 subgoal):
 1. \<And>r s s' n xstate. \<lbrakk>\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond; \<Gamma>\<turnstile> (G' \<inter> {s'. rrel r (xf s')} \<inter> {s'. (s, s') \<in> srel \<and> G r s}) cond {t'. (s, t') \<in> srel \<and> G r s \<and> (\<exists>y. C r s = Some y) \<and> the (C r s) = (cond_xf t' \<noteq> 0)}; \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C') \<and> rrel r (xf s')}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s'. C r s \<noteq> None \<and> the (C r s) = (cond_xf s' \<noteq> 0)} proof (prove)
goal:
No subgoals! proof (state)
this:
\<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,?s'\<rangle> \<Rightarrow> (?n, ?xstate) \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (?s, s') \<in> srel \<and> G ?r ?s \<and> rrel ?r (xf s')} cond {s'. (s' \<in> G' \<and> (?s, s') \<in> srel \<and> G ?r ?s \<and> rrel ?r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C ?r ?s = Some True)}

goal (1 subgoal):
 1. ccorresG srel \<Gamma> rrel xf (G r) (G' \<inter> {s'. rrel r (xf s')}) hs (whileLoop (\<lambda>r s. the (C r s))
  B r) (cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) proof (prove)
goal (1 subgoal):
 1. \<And>r s. \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'} proof (state)
this:
\<Gamma>\<turnstile> {s' \<in> G'. (?s, s') \<in> srel \<and> G ?r ?s \<and> rrel ?r (xf s')} cond {s' \<in> G'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'}

goal (1 subgoal):
 1. ccorresG srel \<Gamma> rrel xf (G r) (G' \<inter> {s'. rrel r (xf s')}) hs (whileLoop (\<lambda>r s. the (C r s))
  B r) (cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) proof (prove)
goal (1 subgoal):
 1. ccorresG srel \<Gamma> rrel xf (G r) (G' \<inter> {s'. rrel r (xf s')}) hs (whileLoop (\<lambda>r s. the (C r s))
  B r) (cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) proof (prove)
goal (1 subgoal):
 1. \<And>a b n t. \<lbrakk>(a, b) \<in> srel; G r a; b \<in> G'; rrel r (xf b); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r a); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,b\<rangle> \<Rightarrow> (n, t)\<rbrakk> \<Longrightarrow> case t of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r a). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> s' \<in> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')}
 2. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond) {s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')}
 3. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond) {s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')}
 2. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond (?R31 s s' n xstate)
 2. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R31 s s' n xstate) While {s'. cond_xf s' \<noteq> 0} (B';;
cond) {s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')}
 3. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} While {s'. cond_xf s' \<noteq> 0} (B';;
cond) {s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')}
 2. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'35 s s' n xstate) While {s'. cond_xf s' \<noteq> 0} (B';;
cond) {s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')}
 2. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} \<subseteq> ?P'35 s s' n xstate
 3. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (4 subgoals):
 1. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')} cond {s'a. \<exists>rv sa. (s'a \<in> G' \<and> (sa, s'a) \<in> srel \<and> G rv sa \<and> rrel rv (xf s'a)) \<and> (cond_xf s'a \<noteq> 0 \<longrightarrow> ?Cnd38 s s' n xstate rv sa s'a)}
 2. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s'a. \<exists>rv sa. (s'a \<in> G' \<and> (sa, s'a) \<in> srel \<and> G rv sa \<and> rrel rv (xf s'a)) \<and> ?Cnd38 s s' n xstate rv sa s'a} B' {s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')}
 3. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} \<subseteq> {s'a. \<exists>rv sa. (s'a \<in> G' \<and> (sa, s'a) \<in> srel \<and> G rv sa \<and> rrel rv (xf s'a)) \<and> (cond_xf s'a \<noteq> 0 \<longrightarrow> ?Cnd38 s s' n xstate rv sa s'a)}
 4. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s'. \<exists>rv s. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')) \<and> s' \<in> C' \<and> C rv s = Some True} B' {s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')}
 2. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} \<subseteq> {s'. \<exists>rv s. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C rv s = Some True)}
 3. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s s' n xstate rv new_s. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s'. (s' \<in> G' \<and> (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')) \<and> s' \<in> C' \<and> C rv new_s = Some True} B' {s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')}
 2. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} \<subseteq> {s'. \<exists>rv s. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C rv s = Some True)}
 3. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s s' n xstate rv new_s. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<And>s r. \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')} cond {s' \<in> G'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s'. (s' \<in> G' \<and> (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')) \<and> s' \<in> C' \<and> C rv new_s = Some True} B' {s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')}
 2. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} \<subseteq> {s'. \<exists>rv s. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C rv s = Some True)}
 3. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s s' n xstate rv new_s. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<And>r. \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G r new_s \<and> rrel r (xf s')} cond {s' \<in> G'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s'. (s' \<in> G' \<and> (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')) \<and> s' \<in> C' \<and> C rv new_s = Some True} B' {s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')}
 2. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} \<subseteq> {s'. \<exists>rv s. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C rv s = Some True)}
 3. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s s' n xstate rv new_s. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')} cond {s' \<in> G'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s'. (s' \<in> G' \<and> (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')) \<and> s' \<in> C' \<and> C rv new_s = Some True} B' {s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')}
 2. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} \<subseteq> {s'. \<exists>rv s. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C rv s = Some True)}
 3. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s s' n xstate rv new_s. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')} cond {s' \<in> G'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'}; \<And>r. ccorresG srel \<Gamma> rrel xf (\<lambda>s. G r s \<and> C r s = Some True) (G' \<inter> C' \<inter> {s'. rrel r (xf s')}) [] (B r) B'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s'. (s' \<in> G' \<and> (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')) \<and> s' \<in> C' \<and> C rv new_s = Some True} B' {s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')}
 2. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} \<subseteq> {s'. \<exists>rv s. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C rv s = Some True)}
 3. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s s' n xstate rv new_s. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')} cond {s' \<in> G'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'}; ccorresG srel \<Gamma> rrel xf (\<lambda>s. G rv s \<and> C rv s = Some True) (G' \<inter> C' \<inter> {s'. rrel rv (xf s')}) [] (B rv) B'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s'. (s' \<in> G' \<and> (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')) \<and> s' \<in> C' \<and> C rv new_s = Some True} B' {s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')}
 2. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} \<subseteq> {s'. \<exists>rv s. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C rv s = Some True)}
 3. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s s' n xstate rv new_s. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')} cond {s' \<in> G'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'}; ccorresG srel \<Gamma> rrel xf (\<lambda>s. G rv s \<and> C rv s = Some True) (G' \<inter> C' \<inter> {s'. rrel rv (xf s')}) [] (B rv) B'; \<And>s r. \<Gamma>\<turnstile> {s' \<in> G'. (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s') \<and> s' \<in> C' \<and> C r s = Some True} B' G'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s'. (s' \<in> G' \<and> (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')) \<and> s' \<in> C' \<and> C rv new_s = Some True} B' {s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')}
 2. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} \<subseteq> {s'. \<exists>rv s. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C rv s = Some True)}
 3. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s s' n xstate rv new_s. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')} cond {s' \<in> G'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'}; ccorresG srel \<Gamma> rrel xf (\<lambda>s. G rv s \<and> C rv s = Some True) (G' \<inter> C' \<inter> {s'. rrel rv (xf s')}) [] (B rv) B'; \<And>r. \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G r new_s \<and> rrel r (xf s') \<and> s' \<in> C' \<and> C r new_s = Some True} B' G'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s'. (s' \<in> G' \<and> (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')) \<and> s' \<in> C' \<and> C rv new_s = Some True} B' {s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')}
 2. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} \<subseteq> {s'. \<exists>rv s. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C rv s = Some True)}
 3. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s s' n xstate rv new_s. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')} cond {s' \<in> G'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'}; ccorresG srel \<Gamma> rrel xf (\<lambda>s. G rv s \<and> C rv s = Some True) (G' \<inter> C' \<inter> {s'. rrel rv (xf s')}) [] (B rv) B'; \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s') \<and> s' \<in> C' \<and> C rv new_s = Some True} B' G'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s'. (s' \<in> G' \<and> (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')) \<and> s' \<in> C' \<and> C rv new_s = Some True} B' {s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')}
 2. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} \<subseteq> {s'. \<exists>rv s. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C rv s = Some True)}
 3. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (5 subgoals):
 1. \<And>s s' n xstate rv new_s. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')} cond {s' \<in> G'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'}; ccorresG srel \<Gamma> rrel xf (\<lambda>s. G rv s \<and> C rv s = Some True) (G' \<inter> C' \<inter> {s'. rrel rv (xf s')}) [] (B rv) B'; \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s') \<and> s' \<in> C' \<and> C rv new_s = Some True} B' G'\<rbrakk> \<Longrightarrow> no_fail (?Q72 s s' n xstate rv new_s) (B rv)
 2. \<And>s s' n xstate rv new_s. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')} cond {s' \<in> G'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'}; ccorresG srel \<Gamma> rrel xf (\<lambda>s. G rv s \<and> C rv s = Some True) (G' \<inter> C' \<inter> {s'. rrel rv (xf s')}) [] (B rv) B'; \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s') \<and> s' \<in> C' \<and> C rv new_s = Some True} B' G'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. G rv s \<and> C rv s = Some True\<rbrace> B rv \<lbrace>?R72 s s' n xstate rv new_s\<rbrace>
 3. \<And>s s' n xstate rv new_s. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')} cond {s' \<in> G'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'}; ccorresG srel \<Gamma> rrel xf (\<lambda>s. G rv s \<and> C rv s = Some True) (G' \<inter> C' \<inter> {s'. rrel rv (xf s')}) [] (B rv) B'; \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s') \<and> s' \<in> C' \<and> C rv new_s = Some True} B' G'; \<Gamma>\<turnstile> {s'a. (G rv new_s \<and> C rv new_s = Some True) \<and> ?Q72 s s' n xstate rv new_s new_s \<and> s'a \<in> G' \<inter> C' \<inter> {s'. rrel rv (xf s')} \<and> (new_s, s'a) \<in> srel} B' {t'. \<exists>(rva, t)\<in>fst (B rv new_s). (t, t') \<in> srel \<and> rrel rva (xf t') \<and> ?R72 s s' n xstate rv new_s rva t}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s'. (s' \<in> G' \<and> (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')) \<and> s' \<in> C' \<and> C rv new_s = Some True} B' {s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')}
 4. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} \<subseteq> {s'. \<exists>rv s. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C rv s = Some True)}
 5. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
using this:
no_fail (\<lambda>s. G ?r s \<and> C ?r s = Some True) (B ?r)

goal (5 subgoals):
 1. \<And>s s' n xstate rv new_s. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')} cond {s' \<in> G'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'}; ccorresG srel \<Gamma> rrel xf (\<lambda>s. G rv s \<and> C rv s = Some True) (G' \<inter> C' \<inter> {s'. rrel rv (xf s')}) [] (B rv) B'; \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s') \<and> s' \<in> C' \<and> C rv new_s = Some True} B' G'\<rbrakk> \<Longrightarrow> no_fail (?Q72 s s' n xstate rv new_s) (B rv)
 2. \<And>s s' n xstate rv new_s. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')} cond {s' \<in> G'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'}; ccorresG srel \<Gamma> rrel xf (\<lambda>s. G rv s \<and> C rv s = Some True) (G' \<inter> C' \<inter> {s'. rrel rv (xf s')}) [] (B rv) B'; \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s') \<and> s' \<in> C' \<and> C rv new_s = Some True} B' G'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. G rv s \<and> C rv s = Some True\<rbrace> B rv \<lbrace>?R72 s s' n xstate rv new_s\<rbrace>
 3. \<And>s s' n xstate rv new_s. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')} cond {s' \<in> G'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'}; ccorresG srel \<Gamma> rrel xf (\<lambda>s. G rv s \<and> C rv s = Some True) (G' \<inter> C' \<inter> {s'. rrel rv (xf s')}) [] (B rv) B'; \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s') \<and> s' \<in> C' \<and> C rv new_s = Some True} B' G'; \<Gamma>\<turnstile> {s'a. (G rv new_s \<and> C rv new_s = Some True) \<and> ?Q72 s s' n xstate rv new_s new_s \<and> s'a \<in> G' \<inter> C' \<inter> {s'. rrel rv (xf s')} \<and> (new_s, s'a) \<in> srel} B' {t'. \<exists>(rva, t)\<in>fst (B rv new_s). (t, t') \<in> srel \<and> rrel rva (xf t') \<and> ?R72 s s' n xstate rv new_s rva t}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s'. (s' \<in> G' \<and> (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')) \<and> s' \<in> C' \<and> C rv new_s = Some True} B' {s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')}
 4. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} \<subseteq> {s'. \<exists>rv s. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C rv s = Some True)}
 5. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (4 subgoals):
 1. \<And>s s' n xstate rv new_s. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')} cond {s' \<in> G'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'}; ccorresG srel \<Gamma> rrel xf (\<lambda>s. G rv s \<and> C rv s = Some True) (G' \<inter> C' \<inter> {s'. rrel rv (xf s')}) [] (B rv) B'; \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s') \<and> s' \<in> C' \<and> C rv new_s = Some True} B' G'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. G rv s \<and> C rv s = Some True\<rbrace> B rv \<lbrace>?R72 s s' n xstate rv new_s\<rbrace>
 2. \<And>s s' n xstate rv new_s. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')} cond {s' \<in> G'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'}; ccorresG srel \<Gamma> rrel xf (\<lambda>s. G rv s \<and> C rv s = Some True) (G' \<inter> C' \<inter> {s'. rrel rv (xf s')}) [] (B rv) B'; \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s') \<and> s' \<in> C' \<and> C rv new_s = Some True} B' G'; \<Gamma>\<turnstile> {s'. (G rv new_s \<and> C rv new_s = Some True) \<and> (G rv new_s \<and> C rv new_s = Some True) \<and> s' \<in> G' \<inter> C' \<inter> {s'. rrel rv (xf s')} \<and> (new_s, s') \<in> srel} B' {t'. \<exists>(rva, t)\<in>fst (B rv new_s). (t, t') \<in> srel \<and> rrel rva (xf t') \<and> ?R72 s s' n xstate rv new_s rva t}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s'. (s' \<in> G' \<and> (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')) \<and> s' \<in> C' \<and> C rv new_s = Some True} B' {s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')}
 3. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} \<subseteq> {s'. \<exists>rv s. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C rv s = Some True)}
 4. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
using this:
\<lbrace>\<lambda>s. G ?r s \<and> C ?r s = Some True\<rbrace> B ?r \<lbrace>G\<rbrace>
\<Gamma>\<turnstile> {s' \<in> G'. (?s, s') \<in> srel \<and> G ?r ?s \<and> rrel ?r (xf s') \<and> s' \<in> C' \<and> C ?r ?s = Some True} B' G'

goal (4 subgoals):
 1. \<And>s s' n xstate rv new_s. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')} cond {s' \<in> G'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'}; ccorresG srel \<Gamma> rrel xf (\<lambda>s. G rv s \<and> C rv s = Some True) (G' \<inter> C' \<inter> {s'. rrel rv (xf s')}) [] (B rv) B'; \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s') \<and> s' \<in> C' \<and> C rv new_s = Some True} B' G'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. G rv s \<and> C rv s = Some True\<rbrace> B rv \<lbrace>?R72 s s' n xstate rv new_s\<rbrace>
 2. \<And>s s' n xstate rv new_s. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')} cond {s' \<in> G'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'}; ccorresG srel \<Gamma> rrel xf (\<lambda>s. G rv s \<and> C rv s = Some True) (G' \<inter> C' \<inter> {s'. rrel rv (xf s')}) [] (B rv) B'; \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s') \<and> s' \<in> C' \<and> C rv new_s = Some True} B' G'; \<Gamma>\<turnstile> {s'. (G rv new_s \<and> C rv new_s = Some True) \<and> (G rv new_s \<and> C rv new_s = Some True) \<and> s' \<in> G' \<inter> C' \<inter> {s'. rrel rv (xf s')} \<and> (new_s, s') \<in> srel} B' {t'. \<exists>(rva, t)\<in>fst (B rv new_s). (t, t') \<in> srel \<and> rrel rva (xf t') \<and> ?R72 s s' n xstate rv new_s rva t}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s'. (s' \<in> G' \<and> (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')) \<and> s' \<in> C' \<and> C rv new_s = Some True} B' {s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')}
 3. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} \<subseteq> {s'. \<exists>rv s. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C rv s = Some True)}
 4. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s s' n xstate rv new_s. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')} cond {s' \<in> G'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'}; ccorresG srel \<Gamma> rrel xf (\<lambda>s. G rv s \<and> C rv s = Some True) (G' \<inter> C' \<inter> {s'. rrel rv (xf s')}) [] (B rv) B'; \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s') \<and> s' \<in> C' \<and> C rv new_s = Some True} B' G'; \<Gamma>\<turnstile> {s'. (G rv new_s \<and> C rv new_s = Some True) \<and> (G rv new_s \<and> C rv new_s = Some True) \<and> s' \<in> G' \<inter> C' \<inter> {s'. rrel rv (xf s')} \<and> (new_s, s') \<in> srel} B' {t'. \<exists>(rv, t)\<in>fst (B rv new_s). (t, t') \<in> srel \<and> rrel rv (xf t') \<and> G rv t}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s'. (s' \<in> G' \<and> (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')) \<and> s' \<in> C' \<and> C rv new_s = Some True} B' {s'. \<exists>rv s. s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')}
 2. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} \<subseteq> {s'. \<exists>rv s. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C rv s = Some True)}
 3. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s s' n xstate rv new_s. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')} cond {s' \<in> G'. cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C'}; ccorresG srel \<Gamma> rrel xf (\<lambda>s. G rv s \<and> C rv s = Some True) (G' \<inter> C' \<inter> {s'. rrel rv (xf s')}) [] (B rv) B'; \<Gamma>\<turnstile> {s' \<in> G'. (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s') \<and> s' \<in> C' \<and> C rv new_s = Some True} B' G'; \<Gamma>\<turnstile> {s'. (G rv new_s \<and> C rv new_s = Some True) \<and> (G rv new_s \<and> C rv new_s = Some True) \<and> s' \<in> G' \<inter> C' \<inter> {s'. rrel rv (xf s')} \<and> (new_s, s') \<in> srel} B' {t'. \<exists>(rv, t)\<in>fst (B rv new_s). (t, t') \<in> srel \<and> rrel rv (xf t') \<and> G rv t}\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s'. (s' \<in> G' \<and> (new_s, s') \<in> srel \<and> G rv new_s \<and> rrel rv (xf s')) \<and> s' \<in> C' \<and> C rv new_s = Some True} B' {s' \<in> G'. \<exists>(rv, s)\<in>fst (B rv new_s). (s, s') \<in> srel \<and> rrel rv (xf s') \<and> G rv s}
 2. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} \<subseteq> {s'. \<exists>rv s. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C rv s = Some True)}
 3. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate)\<rbrakk> \<Longrightarrow> {s'. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G r s \<and> rrel r (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C r s = Some True)} \<subseteq> {s'. \<exists>rv s. (s' \<in> G' \<and> (s, s') \<in> srel \<and> G rv s \<and> rrel rv (xf s')) \<and> (cond_xf s' \<noteq> 0 \<longrightarrow> s' \<in> C' \<and> C rv s = Some True)}
 2. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>s s' n xstate. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, xstate); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> xstate \<and> isNormal xstate\<rbrakk> \<Longrightarrow> case xstate of Normal s'' \<Rightarrow> \<exists>(r, t)\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). (t, s'') \<in> srel \<and> unif_rrel (n = length hs) rrel xf rrel xf r s'' | _ \<Rightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>s s' n x1. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). case x of (r, t) \<Rightarrow> (t, x1) \<in> srel \<and> rrel r (xf x1) proof (prove)
goal (2 subgoals):
 1. \<And>s s' n x1. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1\<rbrakk> \<Longrightarrow> s' \<in> {s'a \<in> G'. (?s150 s s' n x1, s'a) \<in> srel \<and> G (?r150 s s' n x1) (?s150 s s' n x1) \<and> rrel (?r150 s s' n x1) (xf s'a)}
 2. \<And>s s' n x1. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<exists>t'. \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal t' \<and> \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal x1\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). case x of (r, t) \<Rightarrow> (t, x1) \<in> srel \<and> rrel r (xf x1) proof (prove)
goal (1 subgoal):
 1. \<And>s s' n x1. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<exists>t'. \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal t' \<and> \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal x1\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). case x of (r, t) \<Rightarrow> (t, x1) \<in> srel \<and> rrel r (xf x1) proof (prove)
goal (1 subgoal):
 1. \<And>s s' n x1 t'. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal t'\<rangle> \<Rightarrow> Normal x1\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). case x of (r, t) \<Rightarrow> (t, x1) \<in> srel \<and> rrel r (xf x1) proof (prove)
goal (1 subgoal):
 1. \<And>s s' n x1 inter_t. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal inter_t\<rangle> \<Rightarrow> Normal x1\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). case x of (r, t) \<Rightarrow> (t, x1) \<in> srel \<and> rrel r (xf x1) proof (prove)
goal (1 subgoal):
 1. \<And>s s' n x1 inter_t. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal inter_t\<rangle> \<Rightarrow> Normal x1; \<And>r. ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). case x of (r, t) \<Rightarrow> (t, x1) \<in> srel \<and> rrel r (xf x1) proof (prove)
goal (1 subgoal):
 1. \<And>s s' n x1 inter_t. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal inter_t\<rangle> \<Rightarrow> Normal x1; ccorresG srel \<Gamma> (\<lambda>rv rv'. rv = to_bool rv') cond_xf (G r) (G' \<inter> {s'. rrel r (xf s')}) [] (gets_the (C r)) cond\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). case x of (r, t) \<Rightarrow> (t, x1) \<in> srel \<and> rrel r (xf x1) proof (prove)
goal (4 subgoals):
 1. \<And>s s' n x1 inter_t. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal inter_t\<rangle> \<Rightarrow> Normal x1\<rbrakk> \<Longrightarrow> s' \<in> G' \<inter> {s'. rrel r (xf s')}
 2. \<And>s s' n x1 inter_t. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal inter_t\<rangle> \<Rightarrow> Normal x1\<rbrakk> \<Longrightarrow> no_ofail (G r) (C r)
 3. \<And>s s' n x1 inter_t. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal inter_t\<rangle> \<Rightarrow> Normal x1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^sub>h \<langle>[cond],s'\<rangle> \<Rightarrow> (?n170 s s' n x1 inter_t, Normal (?t'170 s s' n x1 inter_t))
 4. \<And>s s' n x1 inter_t. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal inter_t\<rangle> \<Rightarrow> Normal x1; (s, ?t'170 s s' n x1 inter_t) \<in> srel \<and> the (C r s) = to_bool (cond_xf (?t'170 s s' n x1 inter_t))\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). case x of (r, t) \<Rightarrow> (t, x1) \<in> srel \<and> rrel r (xf x1) proof (prove)
goal (3 subgoals):
 1. \<And>s s' n x1 inter_t. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal inter_t\<rangle> \<Rightarrow> Normal x1\<rbrakk> \<Longrightarrow> no_ofail (G r) (C r)
 2. \<And>s s' n x1 inter_t. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal inter_t\<rangle> \<Rightarrow> Normal x1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^sub>h \<langle>[cond],s'\<rangle> \<Rightarrow> (?n170 s s' n x1 inter_t, Normal (?t'170 s s' n x1 inter_t))
 3. \<And>s s' n x1 inter_t. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal inter_t\<rangle> \<Rightarrow> Normal x1; (s, ?t'170 s s' n x1 inter_t) \<in> srel \<and> the (C r s) = to_bool (cond_xf (?t'170 s s' n x1 inter_t))\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). case x of (r, t) \<Rightarrow> (t, x1) \<in> srel \<and> rrel r (xf x1) proof (prove)
goal (2 subgoals):
 1. \<And>s s' n x1 inter_t. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal inter_t\<rangle> \<Rightarrow> Normal x1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^sub>h \<langle>[cond],s'\<rangle> \<Rightarrow> (?n170 s s' n x1 inter_t, Normal (?t'170 s s' n x1 inter_t))
 2. \<And>s s' n x1 inter_t. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal inter_t\<rangle> \<Rightarrow> Normal x1; (s, ?t'170 s s' n x1 inter_t) \<in> srel \<and> the (C r s) = to_bool (cond_xf (?t'170 s s' n x1 inter_t))\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). case x of (r, t) \<Rightarrow> (t, x1) \<in> srel \<and> rrel r (xf x1) proof (prove)
goal (1 subgoal):
 1. \<And>s s' n x1 inter_t. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal inter_t\<rangle> \<Rightarrow> Normal x1; (s, inter_t) \<in> srel \<and> the (C r s) = to_bool (cond_xf inter_t)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). case x of (r, t) \<Rightarrow> (t, x1) \<in> srel \<and> rrel r (xf x1) proof (prove)
goal (2 subgoals):
 1. \<And>s s' n x1 inter_t. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal inter_t\<rangle> \<Rightarrow> Normal x1; (s, inter_t) \<in> srel \<and> the (C r s) = to_bool (cond_xf inter_t)\<rbrakk> \<Longrightarrow> rrel r (xf inter_t)
 2. \<And>s s' n x1 inter_t. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal inter_t\<rangle> \<Rightarrow> Normal x1; (s, inter_t) \<in> srel \<and> the (C r s) = to_bool (cond_xf inter_t); rrel r (xf inter_t)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). case x of (r, t) \<Rightarrow> (t, x1) \<in> srel \<and> rrel r (xf x1) proof (prove)
goal (1 subgoal):
 1. \<And>s s' n x1 inter_t. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal inter_t\<rangle> \<Rightarrow> Normal x1; (s, inter_t) \<in> srel \<and> the (C r s) = to_bool (cond_xf inter_t); rrel r (xf inter_t)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). case x of (r, t) \<Rightarrow> (t, x1) \<in> srel \<and> rrel r (xf x1) proof (prove)
goal (2 subgoals):
 1. \<And>s s' n x1 inter_t. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal inter_t\<rangle> \<Rightarrow> Normal x1; (s, inter_t) \<in> srel \<and> the (C r s) = to_bool (cond_xf inter_t); rrel r (xf inter_t); \<not> the (C r s)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). case x of (r, t) \<Rightarrow> (t, x1) \<in> srel \<and> rrel r (xf x1)
 2. \<And>s s' n x1 inter_t. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal inter_t\<rangle> \<Rightarrow> Normal x1; (s, inter_t) \<in> srel \<and> the (C r s) = to_bool (cond_xf inter_t); rrel r (xf inter_t); \<not> \<not> the (C r s)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). case x of (r, t) \<Rightarrow> (t, x1) \<in> srel \<and> rrel r (xf x1) proof (prove)
goal (1 subgoal):
 1. \<And>s s' n x1 inter_t. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal inter_t\<rangle> \<Rightarrow> Normal x1; (s, inter_t) \<in> srel \<and> the (C r s) = to_bool (cond_xf inter_t); rrel r (xf inter_t); \<not> \<not> the (C r s)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). case x of (r, t) \<Rightarrow> (t, x1) \<in> srel \<and> rrel r (xf x1) proof (prove)
goal (1 subgoal):
 1. \<And>s s' n x1 inter_t. \<lbrakk>(s, s') \<in> srel; G r s; s' \<in> G'; rrel r (xf s'); \<not> snd (whileLoop (\<lambda>r s. the (C r s))
  B r s); \<Gamma>\<turnstile>\<^sub>h \<langle>(cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond)) # hs,s'\<rangle> \<Rightarrow> (n, Normal x1); \<Gamma>\<turnstile> \<langle>cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal s'\<rangle> \<Rightarrow> Normal x1; \<Gamma>\<turnstile> \<langle>cond,Normal s'\<rangle> \<Rightarrow> Normal inter_t; \<Gamma>\<turnstile> \<langle>While {s'. cond_xf s' \<noteq> 0} (B';;
cond),Normal inter_t\<rangle> \<Rightarrow> Normal x1; (s, inter_t) \<in> srel \<and> the (C r s) = to_bool (cond_xf inter_t); rrel r (xf inter_t); \<not> \<not> the (C r s); \<And>r. no_ofail (G r) (C r)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (whileLoop (\<lambda>r s. the (C r s))
  B r s). case x of (r, t) \<Rightarrow> (t, x1) \<in> srel \<and> rrel r (xf x1) proof (prove)
goal:
No subgoals! proof (state)
this:
ccorresG srel \<Gamma> rrel xf (G r) (G' \<inter> {s'. rrel r (xf s')}) hs (whileLoop (\<lambda>r s. the (C r s))
  B r) (cond;;
While {s'. cond_xf s' \<noteq> 0} (B';;
cond))

goal:
No subgoals!