theory InfoFlow_IF

lemma reads_respects_g:
  "\<lbrakk> reads_respects aag l P f; doesnt_touch_globals Q f \<rbrakk>
     \<Longrightarrow> reads_respects_g aag l (P and Q) f" apply (clarsimp simp: equiv_valid_def2 equiv_valid_2_def) apply (drule reads_equiv_gD) apply (subgoal_tac "globals_equiv b ba", fastforce intro: reads_equiv_gI) apply (rule globals_equiv_trans) apply (rule globals_equiv_sym) apply (fastforce intro: globals_equivI) apply (rule globals_equiv_trans) apply (elim conjE, assumption) apply (fastforce intro: globals_equivI) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>reads_respects aag l P f; doesnt_touch_globals Q f\<rbrakk> \<Longrightarrow> reads_respects_g aag l (P and Q) f proof (prove)
goal (1 subgoal):
 1. \<And>s t a b aa ba. \<lbrakk>\<forall>s t. P s \<and> P t \<and> reads_equiv aag s t \<and> affects_equiv aag l s t \<longrightarrow> (\<forall>x\<in>fst (f s). case x of (rva, s') \<Rightarrow> \<forall>x\<in>fst (f t). case x of (rvb, t') \<Rightarrow> rva = rvb \<and> reads_equiv aag s' t' \<and> affects_equiv aag l s' t'); doesnt_touch_globals Q f; (a, b) \<in> fst (f s); (aa, ba) \<in> fst (f t); P s; Q s; P t; Q t; reads_equiv_g aag s t; affects_equiv aag l s t\<rbrakk> \<Longrightarrow> a = aa \<and> reads_equiv_g aag b ba \<and> affects_equiv aag l b ba proof (prove)
goal (1 subgoal):
 1. \<And>s t a b aa ba. \<lbrakk>\<forall>s t. P s \<and> P t \<and> reads_equiv aag s t \<and> affects_equiv aag l s t \<longrightarrow> (\<forall>x\<in>fst (f s). case x of (rva, s') \<Rightarrow> \<forall>x\<in>fst (f t). case x of (rvb, t') \<Rightarrow> rva = rvb \<and> reads_equiv aag s' t' \<and> affects_equiv aag l s' t'); doesnt_touch_globals Q f; (a, b) \<in> fst (f s); (aa, ba) \<in> fst (f t); P s; Q s; P t; Q t; affects_equiv aag l s t; reads_equiv aag s t \<and> globals_equiv s t\<rbrakk> \<Longrightarrow> a = aa \<and> reads_equiv_g aag b ba \<and> affects_equiv aag l b ba proof (prove)
goal (1 subgoal):
 1. \<And>s t a b aa ba. \<lbrakk>\<forall>s t. P s \<and> P t \<and> reads_equiv aag s t \<and> affects_equiv aag l s t \<longrightarrow> (\<forall>x\<in>fst (f s). case x of (rva, s') \<Rightarrow> \<forall>x\<in>fst (f t). case x of (rvb, t') \<Rightarrow> rva = rvb \<and> reads_equiv aag s' t' \<and> affects_equiv aag l s' t'); doesnt_touch_globals Q f; (a, b) \<in> fst (f s); (aa, ba) \<in> fst (f t); P s; Q s; P t; Q t; affects_equiv aag l s t; reads_equiv aag s t \<and> globals_equiv s t\<rbrakk> \<Longrightarrow> globals_equiv b ba proof (prove)
goal (2 subgoals):
 1. \<And>s t a b aa ba. \<lbrakk>\<forall>s t. P s \<and> P t \<and> reads_equiv aag s t \<and> affects_equiv aag l s t \<longrightarrow> (\<forall>x\<in>fst (f s). case x of (rva, s') \<Rightarrow> \<forall>x\<in>fst (f t). case x of (rvb, t') \<Rightarrow> rva = rvb \<and> reads_equiv aag s' t' \<and> affects_equiv aag l s' t'); doesnt_touch_globals Q f; (a, b) \<in> fst (f s); (aa, ba) \<in> fst (f t); P s; Q s; P t; Q t; affects_equiv aag l s t; reads_equiv aag s t \<and> globals_equiv s t\<rbrakk> \<Longrightarrow> globals_equiv b (?t64 s t a b aa ba)
 2. \<And>s t a b aa ba. \<lbrakk>\<forall>s t. P s \<and> P t \<and> reads_equiv aag s t \<and> affects_equiv aag l s t \<longrightarrow> (\<forall>x\<in>fst (f s). case x of (rva, s') \<Rightarrow> \<forall>x\<in>fst (f t). case x of (rvb, t') \<Rightarrow> rva = rvb \<and> reads_equiv aag s' t' \<and> affects_equiv aag l s' t'); doesnt_touch_globals Q f; (a, b) \<in> fst (f s); (aa, ba) \<in> fst (f t); P s; Q s; P t; Q t; affects_equiv aag l s t; reads_equiv aag s t \<and> globals_equiv s t\<rbrakk> \<Longrightarrow> globals_equiv (?t64 s t a b aa ba) ba proof (prove)
goal (2 subgoals):
 1. \<And>s t a b aa ba. \<lbrakk>\<forall>s t. P s \<and> P t \<and> reads_equiv aag s t \<and> affects_equiv aag l s t \<longrightarrow> (\<forall>x\<in>fst (f s). case x of (rva, s') \<Rightarrow> \<forall>x\<in>fst (f t). case x of (rvb, t') \<Rightarrow> rva = rvb \<and> reads_equiv aag s' t' \<and> affects_equiv aag l s' t'); doesnt_touch_globals Q f; (a, b) \<in> fst (f s); (aa, ba) \<in> fst (f t); P s; Q s; P t; Q t; affects_equiv aag l s t; reads_equiv aag s t \<and> globals_equiv s t\<rbrakk> \<Longrightarrow> globals_equiv (?t64 s t a b aa ba) b
 2. \<And>s t a b aa ba. \<lbrakk>\<forall>s t. P s \<and> P t \<and> reads_equiv aag s t \<and> affects_equiv aag l s t \<longrightarrow> (\<forall>x\<in>fst (f s). case x of (rva, s') \<Rightarrow> \<forall>x\<in>fst (f t). case x of (rvb, t') \<Rightarrow> rva = rvb \<and> reads_equiv aag s' t' \<and> affects_equiv aag l s' t'); doesnt_touch_globals Q f; (a, b) \<in> fst (f s); (aa, ba) \<in> fst (f t); P s; Q s; P t; Q t; affects_equiv aag l s t; reads_equiv aag s t \<and> globals_equiv s t\<rbrakk> \<Longrightarrow> globals_equiv (?t64 s t a b aa ba) ba proof (prove)
goal (1 subgoal):
 1. \<And>s t a b aa ba. \<lbrakk>\<forall>s t. P s \<and> P t \<and> reads_equiv aag s t \<and> affects_equiv aag l s t \<longrightarrow> (\<forall>x\<in>fst (f s). case x of (rva, s') \<Rightarrow> \<forall>x\<in>fst (f t). case x of (rvb, t') \<Rightarrow> rva = rvb \<and> reads_equiv aag s' t' \<and> affects_equiv aag l s' t'); doesnt_touch_globals Q f; (a, b) \<in> fst (f s); (aa, ba) \<in> fst (f t); P s; Q s; P t; Q t; affects_equiv aag l s t; reads_equiv aag s t \<and> globals_equiv s t\<rbrakk> \<Longrightarrow> globals_equiv s ba proof (prove)
goal (2 subgoals):
 1. \<And>s t a b aa ba. \<lbrakk>\<forall>s t. P s \<and> P t \<and> reads_equiv aag s t \<and> affects_equiv aag l s t \<longrightarrow> (\<forall>x\<in>fst (f s). case x of (rva, s') \<Rightarrow> \<forall>x\<in>fst (f t). case x of (rvb, t') \<Rightarrow> rva = rvb \<and> reads_equiv aag s' t' \<and> affects_equiv aag l s' t'); doesnt_touch_globals Q f; (a, b) \<in> fst (f s); (aa, ba) \<in> fst (f t); P s; Q s; P t; Q t; affects_equiv aag l s t; reads_equiv aag s t \<and> globals_equiv s t\<rbrakk> \<Longrightarrow> globals_equiv s (?t89 s t a b aa ba)
 2. \<And>s t a b aa ba. \<lbrakk>\<forall>s t. P s \<and> P t \<and> reads_equiv aag s t \<and> affects_equiv aag l s t \<longrightarrow> (\<forall>x\<in>fst (f s). case x of (rva, s') \<Rightarrow> \<forall>x\<in>fst (f t). case x of (rvb, t') \<Rightarrow> rva = rvb \<and> reads_equiv aag s' t' \<and> affects_equiv aag l s' t'); doesnt_touch_globals Q f; (a, b) \<in> fst (f s); (aa, ba) \<in> fst (f t); P s; Q s; P t; Q t; affects_equiv aag l s t; reads_equiv aag s t \<and> globals_equiv s t\<rbrakk> \<Longrightarrow> globals_equiv (?t89 s t a b aa ba) ba proof (prove)
goal (1 subgoal):
 1. \<And>s t a b aa ba. \<lbrakk>\<forall>s t. P s \<and> P t \<and> reads_equiv aag s t \<and> affects_equiv aag l s t \<longrightarrow> (\<forall>x\<in>fst (f s). case x of (rva, s') \<Rightarrow> \<forall>x\<in>fst (f t). case x of (rvb, t') \<Rightarrow> rva = rvb \<and> reads_equiv aag s' t' \<and> affects_equiv aag l s' t'); doesnt_touch_globals Q f; (a, b) \<in> fst (f s); (aa, ba) \<in> fst (f t); P s; Q s; P t; Q t; affects_equiv aag l s t; reads_equiv aag s t \<and> globals_equiv s t\<rbrakk> \<Longrightarrow> globals_equiv t ba proof (prove)
goal:
No subgoals!