intros; unfold chsubsc_SC in |- *.
cut
match fSSC (subjectSC s) u with
| Some y => set_In (u, y) (subjectSC s)
| None => ~ set_In u (DOM SUBeq_dec (subjectSC s))
end.
split.
intro H1; rewrite H1; auto.
generalize H0; elim (fSSC (subjectSC s) u).
intro; intro;
replace
(fSSC
(set_add SSCeq_dec (u, sc) (set_remove SSCeq_dec (u, a) (subjectSC s)))
u) with (Some sc).
intro H2; discriminate H2.
unfold fSSC in |- *; apply AddEq1; auto.
auto.
auto.
unfold fSSC in |- *; apply DOMFuncRel4.
Qed.

(* Specifications: *)
Lemma Open_smCorr31 :
forall (s : SFSstate) (Sub u0 : SUBJECT) (o : OBJECT) (m : MODE),
FuncPre5 s ->
match fsecmat (open_sm s Sub o READ) o, fsecmat (secmat s) o with
| Some y, None =>
ActReaders y = set_add SUBeq_dec Sub (empty_set SUBJECT) /\
ActWriters y = empty_set SUBJECT
| None, _ => False
| Some y, Some z => set_In u0 (ActWriters y) -> set_In u0 (ActWriters z)
end.