intros.
cut
match fsecmat (secmat s) o with
| Some y => set_In (o, y) (secmat s)
| None => ~ set_In o (DOM OBJeq_dec (secmat s))
end.
unfold open_sm in |- *.
elim (fsecmat (secmat s) o).
intros;
replace
(fsecmat
(set_add SECMATeq_dec
(o, mkRW (ActReaders a) (set_add SUBeq_dec Sub (ActWriters a)))
(set_remove SECMATeq_dec (o, a) (secmat s))) o) with
(Some (mkRW (ActReaders a) (set_add SUBeq_dec Sub (ActWriters a)))).
simpl in |- *.
split; (intro; eauto).
unfold fsecmat in |- *; apply AddEq1; auto.
intros;
replace
(fsecmat
(set_add SECMATeq_dec
(o,
mkRW (empty_set SUBJECT) (set_add SUBeq_dec Sub (empty_set SUBJECT)))
(secmat s)) o) with
(Some
(mkRW (empty_set SUBJECT) (set_add SUBeq_dec Sub (empty_set SUBJECT)))).
auto.
unfold fsecmat in |- *; apply AddEq1; auto.
unfold fsecmat in |- *; apply DOMFuncRel4.
Qed.

(* Specifications: *)
Lemma Eqfsecmat3 :
forall (s : SFSstate) (o1 o2 : OBJECT) (u : SUBJECT) (m : MODE),
o1 <> o2 -> fsecmat (secmat s) o2 = fsecmat (open_sm s u o1 m) o2.