intros until m; intro; unfold open_sm in |- *.
cut
match fsecmat (secmat s) o with
| Some y => set_In (o, y) (secmat s)
| None => ~ set_In o (DOM OBJeq_dec (secmat s))
end.
elim m; elim (fsecmat (secmat s) o).
intro; intro;
replace
(fsecmat
(set_add SECMATeq_dec
(o, mkRW (set_add SUBeq_dec Sub (ActReaders a)) (ActWriters a))
(set_remove SECMATeq_dec (o, a) (secmat s))) o) with
(Some (mkRW (set_add SUBeq_dec Sub (ActReaders a)) (ActWriters a))).
intros H2; discriminate H2.
unfold fsecmat in |- *; apply AddEq1; auto.
intro;
replace
(fsecmat
(set_add SECMATeq_dec
(o,
mkRW (set_add SUBeq_dec Sub (empty_set SUBJECT)) (empty_set SUBJECT))
(secmat s)) o) with
(Some
(mkRW (set_add SUBeq_dec Sub (empty_set SUBJECT)) (empty_set SUBJECT))).
intro H2; discriminate H2.
unfold fsecmat in |- *; apply AddEq1; auto.
intro; intro;
replace
(fsecmat
(set_add SECMATeq_dec
(o, mkRW (ActReaders a) (set_add SUBeq_dec Sub (ActWriters a)))
(set_remove SECMATeq_dec (o, a) (secmat s))) o) with
(Some (mkRW (ActReaders a) (set_add SUBeq_dec Sub (ActWriters a)))).
intro H2; discriminate H2.
unfold fsecmat in |- *; apply AddEq1; auto.
intro;
replace
(fsecmat
(set_add SECMATeq_dec
(o,
mkRW (empty_set SUBJECT) (set_add SUBeq_dec Sub (empty_set SUBJECT)))
(secmat s)) o) with
(Some
(mkRW (empty_set SUBJECT) (set_add SUBeq_dec Sub (empty_set SUBJECT)))).
intro H2; discriminate H2.
unfold fsecmat in |- *; apply AddEq1; auto.
unfold fsecmat in |- *; apply DOMFuncRel4.
Qed.

(* Specifications: *)
Lemma Open_smCorr21 :
forall (s : SFSstate) (Sub u0 : SUBJECT) (o : OBJECT) (m : MODE),
Sub <> u0 ->
FuncPre5 s ->
match fsecmat (open_sm s Sub o READ) o, fsecmat (secmat s) o with
| Some y, None =>
ActReaders y = set_add SUBeq_dec Sub (empty_set SUBJECT) /\
ActWriters y = empty_set SUBJECT
| None, _ => False
| Some y, Some z =>
(set_In u0 (ActReaders y) -> set_In u0 (ActReaders z)) /\
(set_In u0 (ActWriters y) -> set_In u0 (ActWriters z))
end.