diff --git a/thys/HOL-CSP/Assertions.thy b/thys/HOL-CSP/Assertions.thy
--- a/thys/HOL-CSP/Assertions.thy
+++ b/thys/HOL-CSP/Assertions.thy
@@ -1,620 +1,706 @@
 (*<*)
 \<comment>\<open> ******************************************************************** 
  * Project         : HOL-CSP - A Shallow Embedding of CSP in  Isabelle/HOL
  * Version         : 2.0
  *
  * Author          : Burkhart Wolff, Safouan Taha, Lina Ye.
  *                   (Based on HOL-CSP 1.0 by Haykal Tej and Burkhart Wolff)
  *
  * This file       : A Combined CSP Theory
  *
  * Copyright (c) 2009 Université Paris-Sud, France
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials provided
  *       with the distribution.
  *
  *     * Neither the name of the copyright holders nor the names of its
  *       contributors may be used to endorse or promote products derived
  *       from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  ******************************************************************************\<close>
 (*>*)
 
 theory Assertions
-  imports CSP Process_Order
+  imports CSP
 begin
 
 
 
+default_sort "type"
 
 section\<open>CSP Assertions\<close>
 
 definition DF :: "'a set \<Rightarrow> 'a process"
   where   "DF A \<equiv> \<mu> X. \<sqinter> x \<in> A \<rightarrow> X"
 
 lemma DF_unfold : "DF A = (\<sqinter> z \<in> A \<rightarrow> DF A)"
  by(simp add: DF_def, rule trans, rule fix_eq, simp)
 
 definition deadlock_free :: "'a process \<Rightarrow> bool"
   where   "deadlock_free P \<equiv> DF UNIV \<sqsubseteq>\<^sub>F\<^sub>D P"
 
 definition DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P :: "'a set \<Rightarrow> 'a process"
   where   "DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P A \<equiv> \<mu> X. ((\<sqinter> x \<in> A \<rightarrow> X) \<sqinter> SKIP)"
 
 (* TO DO: rename this in deadlock_free\<^sub>S\<^sub>K\<^sub>I\<^sub>P *)
 definition deadlock_free_v2 :: "'a process \<Rightarrow> bool"
   where   "deadlock_free_v2 P \<equiv> DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P UNIV \<sqsubseteq>\<^sub>F P"
 
 
 section\<open>Some deadlock freeness laws\<close>
 
 lemma DF_subset: "A \<noteq> {} \<Longrightarrow> A \<subseteq> B \<Longrightarrow> DF B \<sqsubseteq>\<^sub>F\<^sub>D DF A" 
   apply(subst DF_def, rule fix_ind) 
   apply(rule le_FD_adm, simp_all add: monofunI, subst DF_unfold)
   by (meson mono_Mndetprefix_FD mono_Mndetprefix_FD_set trans_FD)
 
 lemma DF_Univ_freeness: "A \<noteq> {} \<Longrightarrow> (DF A) \<sqsubseteq>\<^sub>F\<^sub>D P  \<Longrightarrow> deadlock_free P"
   by (meson deadlock_free_def DF_subset failure_divergence_refine_def order.trans subset_UNIV)
 
 lemma deadlock_free_Ndet: "deadlock_free P \<Longrightarrow> deadlock_free Q \<Longrightarrow> deadlock_free (P \<sqinter> Q)"
   by (simp add: D_Ndet F_Ndet deadlock_free_def failure_divergence_refine_def le_ref_def)
 
 
 
 section \<open>Preliminaries\<close>
 
 lemma DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_unfold : "DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P A = ((\<sqinter> z \<in> A \<rightarrow> DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P A) \<sqinter> SKIP)"
   by(simp add: DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_def, rule trans, rule fix_eq, simp)
 
 
 section \<open>Deadlock Free\<close>
 
 lemma div_free_DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P: "\<D>(DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P A) = {}"
 proof(simp add:DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_def fix_def) 
   define Y where "Y \<equiv> \<lambda>i. iterate i\<cdot>(\<Lambda> x. (\<sqinter>xa\<in>A \<rightarrow>  x) \<sqinter> SKIP)\<cdot>\<bottom>"
   hence a:"chain Y" by simp
   have "\<D> (Y (Suc i)) = {d. d \<noteq> [] \<and> hd d  \<in> (ev ` A) \<and> tl d \<in> \<D>(Y i)}" for i
     by (cases "A={}", auto simp add:Y_def D_STOP D_SKIP D_Mndetprefix write0_def D_Mprefix D_Ndet) 
   hence b:"d \<in> \<D>(Y i) \<Longrightarrow> length d \<ge> i" for d i
     by (induct i arbitrary:d, simp_all add: Nitpick.size_list_simp(2))
   { fix x
     assume c:"\<forall> i. x \<in> \<D> (Y i)"
     from b have "x \<notin> \<D> (Y (Suc (length x)))" using Suc_n_not_le_n by blast
     with c have False by simp
   }
   with a show "\<D> (\<Squnion>i. Y i) = {}"
   using D_LUB[OF a] limproc_is_thelub[OF a] by auto
 qed
 
 lemma div_free_DF: "\<D>(DF A) = {}"
 proof - 
   have "DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P A  \<sqsubseteq>\<^sub>D DF A"
     apply (simp add:DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_def)
     by(rule fix_ind, simp_all add: monofunI, subst DF_unfold, simp)
   then show ?thesis using divergence_refine_def div_free_DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P by blast 
 qed
 
 lemma deadlock_free_implies_div_free: "deadlock_free P \<Longrightarrow> \<D> P = {}"
   by (simp add: deadlock_free_def div_free_DF failure_divergence_refine_def le_ref_def)
 
 
 
 
 section \<open>Run\<close>
 
 definition RUN :: "'a set \<Rightarrow> 'a process"
   where   "RUN A \<equiv> \<mu> X. \<box> x \<in> A \<rightarrow> X"
 
 definition CHAOS :: "'a set \<Rightarrow> 'a process" 
   where   "CHAOS A \<equiv> \<mu> X. (STOP \<sqinter> (\<box> x \<in> A \<rightarrow> X))"
 
 definition lifelock_free :: "'a process \<Rightarrow> bool"
   where   "lifelock_free P \<equiv> CHAOS UNIV \<sqsubseteq>\<^sub>F\<^sub>D P"
 
 
 
 
 section \<open>Reference processes and their unfolding rules\<close>
 
 
 definition CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P :: "'a set \<Rightarrow> 'a process" 
   where   "CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A \<equiv> \<mu> X. (SKIP \<sqinter> STOP \<sqinter> (\<box> x \<in> A \<rightarrow> X))"
 
 
 lemma RUN_unfold : "RUN A = (\<box> z \<in> A \<rightarrow> RUN A)"
   by(simp add: RUN_def, rule trans, rule fix_eq, simp)
 
 lemma CHAOS_unfold : "CHAOS A = (STOP \<sqinter> (\<box> z \<in> A \<rightarrow> CHAOS A))"
   by(simp add: CHAOS_def, rule trans, rule fix_eq, simp)
                                               
 lemma CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_unfold: "CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A \<equiv> SKIP \<sqinter> STOP \<sqinter> (\<box> x \<in> A \<rightarrow> CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A)"
   unfolding CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_def using fix_eq[of "\<Lambda> X. (SKIP \<sqinter> STOP \<sqinter> (\<box> x \<in> A \<rightarrow> X))"] by simp
 
 section \<open>Process events and reference processes events\<close>
 
 definition events_of where "events_of P \<equiv> (\<Union>t\<in>\<T> P. {a. ev a \<in> set t})"
 
 lemma events_DF: "events_of (DF A) = A"
 proof(auto simp add:events_of_def)
   fix x t
   show "t \<in> \<T> (DF A) \<Longrightarrow> ev x \<in> set t \<Longrightarrow> x \<in> A"
   proof(induct t)
     case Nil
     then show ?case by simp
   next
     case (Cons a t)
     from Cons(2) have "a # t \<in> \<T> (\<sqinter>z\<in>A \<rightarrow>  DF A)" using DF_unfold by metis
     then obtain aa where "a = ev aa \<and> aa \<in> A \<and> t \<in> \<T> (DF A)" 
       by (cases "A={}", auto simp add: T_Mndetprefix write0_def T_Mprefix T_STOP)
     with Cons show ?case by auto
   qed
 next
   fix x
   show "x \<in> A \<Longrightarrow> \<exists>xa\<in>\<T> (DF A). ev x \<in> set xa"
     apply(subst DF_unfold, cases "A={}", auto simp add:T_Mndetprefix write0_def T_Mprefix)
     by (metis Nil_elem_T list.sel(1) list.sel(3) list.set_intros(1))
 qed
 
 lemma events_DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P: "events_of (DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P A) = A"
 proof(auto simp add:events_of_def)
   fix x t
   show "t \<in> \<T> (DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P A) \<Longrightarrow> ev x \<in> set t \<Longrightarrow> x \<in> A"
   proof(induct t)
     case Nil
     then show ?case by simp
   next
     case (Cons a t)
     from Cons(2) have "a # t \<in> \<T> ((\<sqinter>z\<in>A \<rightarrow>  DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P A) \<sqinter> SKIP)" using DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_unfold by metis
     with Cons obtain aa where "a = ev aa \<and> aa \<in> A \<and> t \<in> \<T> (DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P A)" 
       by (cases "A={}", auto simp add:T_Mndetprefix write0_def T_Mprefix T_STOP T_SKIP T_Ndet)  
     with Cons show ?case by auto
   qed
 next
   fix x
   show "x \<in> A \<Longrightarrow> \<exists>xa\<in>\<T> (DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P A). ev x \<in> set xa"
     apply(subst DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_unfold, cases "A={}")
      apply(auto simp add:T_Mndetprefix write0_def T_Mprefix T_SKIP T_Ndet)
     by (metis Nil_elem_T list.sel(1) list.sel(3) list.set_intros(1))
 qed
 
 lemma events_RUN: "events_of (RUN A) = A"
 proof(auto simp add:events_of_def)
   fix x t
   show "t \<in> \<T> (RUN A) \<Longrightarrow> ev x \<in> set t \<Longrightarrow> x \<in> A"
   proof(induct t)
     case Nil
     then show ?case by simp
   next
     case (Cons a t)
     from Cons(2) have "a # t \<in> \<T> (\<box>z\<in>A \<rightarrow>  RUN A)" using RUN_unfold by metis
     then obtain aa where "a = ev aa \<and> aa \<in> A \<and> t \<in> \<T> (RUN A)" by (auto simp add:T_Mprefix)
     with Cons show ?case by auto
   qed
 next
   fix x
   show "x \<in> A \<Longrightarrow> \<exists>xa \<in> \<T>(RUN A). ev x \<in> set xa"
     apply(subst RUN_unfold, simp add: T_Mprefix)
     by (metis Nil_elem_T list.sel(1) list.sel(3) list.set_intros(1))
 qed
 
 lemma events_CHAOS: "events_of (CHAOS A) = A"
 proof(auto simp add:events_of_def)
   fix x t
   show "t \<in> \<T> (CHAOS A) \<Longrightarrow> ev x \<in> set t \<Longrightarrow> x \<in> A"
   proof(induct t)
     case Nil
     then show ?case by simp
   next
     case (Cons a t)
     from Cons(2) have "a # t \<in> \<T> (STOP \<sqinter> (\<box> z \<in> A \<rightarrow> CHAOS A))" using CHAOS_unfold by metis
     then obtain aa where "a = ev aa \<and> aa \<in> A \<and> t \<in> \<T> (CHAOS A)" 
       by (auto simp add:T_Ndet T_Mprefix T_STOP)
     with Cons show ?case by auto
   qed
 next
   fix x
   show "x \<in> A \<Longrightarrow> \<exists>xa\<in>\<T> (CHAOS A). ev x \<in> set xa"
     apply(subst CHAOS_unfold, simp add:T_Ndet T_Mprefix T_STOP)
     by (metis Nil_elem_T list.sel(1) list.sel(3) list.set_intros(1))
 qed
 
 lemma events_CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P: "events_of (CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A) = A"
 proof(auto simp add:events_of_def)
   fix x t
   show "t \<in> \<T> (CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A) \<Longrightarrow> ev x \<in> set t \<Longrightarrow> x \<in> A"
   proof(induct t)
     case Nil
     then show ?case by simp
   next
     case (Cons a t)
     from Cons(2) have "a # t \<in> \<T> (SKIP \<sqinter> STOP \<sqinter> (\<box> z \<in> A \<rightarrow> CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A))" 
       using CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_unfold by metis
     with Cons obtain aa where "a = ev aa \<and> aa \<in> A \<and> t \<in> \<T> (CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A)" 
       by (auto simp add:T_Ndet T_Mprefix T_STOP T_SKIP)
     with Cons show ?case by auto
   qed
 next
   fix x
   show "x \<in> A \<Longrightarrow> \<exists>xa\<in>\<T> (CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A). ev x \<in> set xa"
     apply(subst CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_unfold, simp add:T_Ndet T_Mprefix T_STOP T_SKIP)
     by (metis Nil_elem_T list.sel(1) list.sel(3) list.set_intros(1))
 qed
 
 lemma events_div: "\<D>(P) \<noteq> {} \<Longrightarrow>  events_of (P) = UNIV"
 proof(auto simp add:events_of_def)
   fix x xa
   assume 1: "x \<in> \<D> P"
   show "\<exists>x\<in>\<T> P. ev xa \<in> set x"
   proof(cases "tickFree x")
     case True  
     hence "x@[ev xa] \<in> \<T> P"
       using 1 NT_ND front_tickFree_single is_processT7 by blast   
     then show ?thesis by force 
   next
     case False
     hence "(butlast x)@[ev xa] \<in> \<T> P"
       by (metis "1" D_T D_imp_front_tickFree append_single_T_imp_tickFree butlast_snoc 
                 front_tickFree_single nonTickFree_n_frontTickFree process_charn) 
     then show ?thesis by force
   qed
 qed
 
 
 
 lemma DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_subset_FD: "A \<noteq> {} \<Longrightarrow> A \<subseteq> B \<Longrightarrow> DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P B \<sqsubseteq>\<^sub>F\<^sub>D DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P A"
   apply(subst DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_def, rule fix_ind, rule le_FD_adm, simp_all add:monofunI, subst DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_unfold)
   by (rule mono_Ndet_FD, simp_all) (meson mono_Mndetprefix_FD mono_Mndetprefix_FD_set trans_FD) 
 
 lemma RUN_subset_DT: "A \<subseteq> B \<Longrightarrow> RUN B \<sqsubseteq>\<^sub>D\<^sub>T RUN A"
   apply(subst RUN_def, rule fix_ind, rule le_DT_adm, simp_all add:monofunI, subst RUN_unfold)
   by (meson mono_Mprefix_DT mono_Mprefix_DT_set trans_DT)
 
 lemma CHAOS_subset_FD: "A \<subseteq> B \<Longrightarrow> CHAOS B \<sqsubseteq>\<^sub>F\<^sub>D CHAOS A"
   apply(subst CHAOS_def, rule fix_ind, rule le_FD_adm, simp_all add:monofunI, subst CHAOS_unfold)
   by (auto simp add: failure_divergence_refine_def le_ref_def 
                      D_Mprefix D_Ndet F_STOP F_Mprefix F_Ndet) 
 
 lemma CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_subset_FD: "A \<subseteq> B \<Longrightarrow> CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P B \<sqsubseteq>\<^sub>F\<^sub>D CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A"
   apply(subst CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_def, rule fix_ind, rule le_FD_adm) 
      apply(simp_all add:monofunI, subst CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_unfold)
   by (auto simp add: failure_divergence_refine_def le_ref_def 
                      D_Mprefix D_Ndet F_STOP F_Mprefix F_Ndet)
 
 section \<open>Relations between refinements on reference processes\<close>
 
 lemma CHAOS_has_all_tickFree_failures: 
       "tickFree a \<Longrightarrow> {x. ev x \<in> set a} \<subseteq> A \<Longrightarrow> (a,b) \<in> \<F> (CHAOS A)"
 proof(induct a)
   case Nil
   then show ?case 
     by (subst CHAOS_unfold, simp add:F_Ndet F_STOP)
 next
   case (Cons a0 al)
   hence "tickFree al"
     by (metis append.left_neutral append_Cons front_tickFree_charn front_tickFree_mono)
   with Cons show ?case 
     apply (subst CHAOS_unfold, simp add:F_Ndet F_STOP F_Mprefix events_of_def)
     using event_set by blast
 qed
 
 lemma CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_has_all_failures: 
   assumes as:"(events_of P) \<subseteq> A" 
   shows "CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A \<sqsubseteq>\<^sub>F P"
 proof -
   have "front_tickFree a \<Longrightarrow> set a \<subseteq> (\<Union>t\<in>\<T> P. set t) \<Longrightarrow> (a,b) \<in> \<F> (CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A)" for a b
   proof(induct a)
     case Nil
     then show ?case 
       by (subst CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_unfold, simp add:F_Ndet F_STOP)
   next
     case (Cons a0 al)
     hence "front_tickFree al"
       by (metis append.left_neutral append_Cons front_tickFree_charn front_tickFree_mono)
     with Cons show ?case 
       apply (subst CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_unfold, simp add:F_Ndet F_STOP F_SKIP F_Mprefix events_of_def as)
       apply(cases "a0=tick")
        apply (metis append.simps(2) front_tickFree_charn 
                     front_tickFree_mono list.distinct(1) tickFree_Cons)
       using event_set image_iff as[simplified events_of_def] by fastforce
   qed
   thus ?thesis 
     by (simp add: F_T SUP_upper failure_refine_def process_charn subrelI) 
 qed
 
 corollary CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_has_all_failures_ev: "CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P (events_of P) \<sqsubseteq>\<^sub>F P" 
       and CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_has_all_failures_Un: "CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P UNIV \<sqsubseteq>\<^sub>F P"
   by (simp_all add: CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_has_all_failures)
 
 
 lemma DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_DF_refine_F: "DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P A  \<sqsubseteq>\<^sub>F DF A"
   by (simp add:DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_def, rule fix_ind, simp_all add: monofunI, subst DF_unfold, simp) 
 
 lemma DF_RUN_refine_F: "DF A  \<sqsubseteq>\<^sub>F RUN A"
   apply (simp add:DF_def, rule fix_ind, simp_all add: monofunI, subst RUN_unfold)
   by (meson Mprefix_refines_Mndetprefix_F mono_Mndetprefix_F trans_F)
 
 lemma CHAOS_DF_refine_F: "CHAOS A  \<sqsubseteq>\<^sub>F DF A"
   apply (simp add:CHAOS_def DF_def, rule parallel_fix_ind, simp_all add: monofunI)
    apply (rule le_F_adm, simp_all add: monofun_snd)
   by (cases "A={}", auto simp add:adm_def failure_refine_def F_Mndetprefix 
                                   F_Mprefix write0_def F_Ndet F_STOP)
 
 corollary CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_CHAOS_refine_F: "CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A  \<sqsubseteq>\<^sub>F CHAOS A"
       and CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_refine_F: "CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A  \<sqsubseteq>\<^sub>F DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P A"
   by (simp_all add: CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_has_all_failures events_CHAOS events_DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P 
                     trans_F[OF CHAOS_DF_refine_F DF_RUN_refine_F])
 
 
 
 
 lemma div_free_CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P: "\<D> (CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A) = {}"
 proof -
   have "DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P A  \<sqsubseteq>\<^sub>D CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A"
   proof (simp add:DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_def, rule fix_ind, simp_all add: monofunI, subst CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_unfold)
     fix x
     assume 1:"x \<sqsubseteq>\<^sub>D CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A"
     have a:"((\<sqinter>xa\<in>A \<rightarrow>  x) \<sqinter> SKIP) = (SKIP \<sqinter> SKIP \<sqinter> (\<sqinter>xa\<in>A \<rightarrow>  x))" 
       by (simp add: Ndet_commute Ndet_id)
     from 1 have b:"(SKIP \<sqinter> SKIP \<sqinter> (\<sqinter>xa\<in>A \<rightarrow>  x)) \<sqsubseteq>\<^sub>D (SKIP \<sqinter> STOP \<sqinter> (\<box>xa\<in>A \<rightarrow> CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A))"
       by (meson Mprefix_refines_Mndetprefix_D idem_D leD_STOP mono_Mprefix_D mono_Ndet_D trans_D)
     from a b show "((\<sqinter>xa\<in>A \<rightarrow>  x) |-| SKIP) \<sqsubseteq>\<^sub>D (SKIP |-| STOP |-| Mprefix A (\<lambda>x. CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A))" 
       by simp
   qed
   then show ?thesis using divergence_refine_def div_free_DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P by blast 
 qed
 
 lemma div_free_CHAOS: "\<D>(CHAOS A) = {}"
 proof - 
   have "CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A  \<sqsubseteq>\<^sub>D CHAOS A"
     apply (simp add:CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_def, rule fix_ind)
     by (simp_all add: monofunI, subst CHAOS_unfold, simp) 
   then show ?thesis using divergence_refine_def div_free_CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P by blast 
 qed
 
 lemma div_free_RUN: "\<D>(RUN A) = {}"
 proof - 
   have "CHAOS A  \<sqsubseteq>\<^sub>D RUN A"
     by (simp add:CHAOS_def, rule fix_ind, simp_all add: monofunI, subst RUN_unfold, simp) 
   then show ?thesis using divergence_refine_def div_free_CHAOS by blast 
 qed
 
 corollary DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_DF_refine_FD: "DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P A  \<sqsubseteq>\<^sub>F\<^sub>D DF A"
       and DF_RUN_refine_FD: "DF A  \<sqsubseteq>\<^sub>F\<^sub>D RUN A"
       and CHAOS_DF_refine_FD: "CHAOS A  \<sqsubseteq>\<^sub>F\<^sub>D DF A"
       and CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_CHAOS_refine_FD: "CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A  \<sqsubseteq>\<^sub>F\<^sub>D CHAOS A"
       and CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_refine_FD: "CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A  \<sqsubseteq>\<^sub>F\<^sub>D DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P A"
   using div_free_DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P[of A] div_free_CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P[of A] div_free_DF[of A] div_free_RUN[of A] 
         div_free_CHAOS[of A] 
         leF_leD_imp_leFD[OF DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_DF_refine_F, of A] leF_leD_imp_leFD[OF DF_RUN_refine_F, of A] 
         leF_leD_imp_leFD[OF CHAOS_DF_refine_F, of A] leF_leD_imp_leFD[OF CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_CHAOS_refine_F, of A] 
         leF_leD_imp_leFD[OF CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_refine_F, of A]
   by (auto simp add:divergence_refine_def) 
 
 
 lemma traces_CHAOS_sub: "\<T>(CHAOS A) \<subseteq> {s. set s \<subseteq> ev ` A}"
 proof(auto)
   fix s sa
   assume "s \<in> \<T> (CHAOS A)" and "sa \<in> set s"
   then show "sa \<in> ev ` A"
     apply (induct s, simp) 
     by (subst (asm) (2) CHAOS_unfold, cases "A={}", auto simp add:T_Ndet T_STOP T_Mprefix)  
 qed
 
 lemma traces_RUN_sub: "{s. set s \<subseteq> ev ` A} \<subseteq> \<T>(RUN A)"
 proof(auto)
   fix s
   assume "set s \<subseteq> ev ` A"
   then show "s \<in> \<T> (RUN A)"
     by (induct s, simp add: Nil_elem_T) (subst RUN_unfold, auto simp add:T_Mprefix)
 qed
 
 corollary RUN_all_tickfree_traces1: "\<T>(RUN A) = {s. set s \<subseteq> ev ` A}" 
       and DF_all_tickfree_traces1: "\<T>(DF A) = {s. set s \<subseteq> ev ` A}" 
       and CHAOS_all_tickfree_traces1: "\<T>(CHAOS A) = {s. set s \<subseteq> ev ` A}"
   using DF_RUN_refine_F[THEN leF_imp_leT, simplified trace_refine_def]
         CHAOS_DF_refine_F[THEN leF_imp_leT,simplified trace_refine_def] 
         traces_CHAOS_sub traces_RUN_sub by blast+
 
 corollary RUN_all_tickfree_traces2: "tickFree s \<Longrightarrow> s \<in> \<T>(RUN UNIV)" 
       and DF_all_tickfree_traces2: "tickFree s \<Longrightarrow> s \<in> \<T>(DF UNIV)" 
       and CHAOS_all_tickfree_trace2: "tickFree s \<Longrightarrow> s \<in> \<T>(CHAOS UNIV)"
     apply(simp_all add:tickFree_def RUN_all_tickfree_traces1 
                        DF_all_tickfree_traces1 CHAOS_all_tickfree_traces1)
   by (metis event_set insertE subsetI)+
 
 lemma traces_CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_sub: "\<T>(CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A) \<subseteq> {s. front_tickFree s \<and> set s \<subseteq> (ev ` A \<union> {tick})}"
 proof(auto simp add:is_processT2_TR)
   fix s sa
   assume "s \<in> \<T> (CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A)" and "sa \<in> set s" and "sa \<notin> ev ` A"
   then show "sa = tick"
     apply (induct s, simp) 
     by (subst (asm) (2) CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_unfold, cases "A={}", auto simp add:T_Ndet T_STOP T_SKIP T_Mprefix)  
 qed
 
 lemma traces_DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_sub: 
   "{s. front_tickFree s \<and> set s \<subseteq> (ev ` A \<union> {tick})} \<subseteq> \<T>(DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P A::'a process)"
 proof(auto)
   fix s
   assume a:"front_tickFree s" and b:"set s \<subseteq> insert tick (ev ` A)"
   have c:"front_tickFree ((tick::'a event) # s) \<Longrightarrow> s = []" for s
     by (metis butlast.simps(2) butlast_snoc front_tickFree_charn list.distinct(1) tickFree_Cons) 
   with a b show "s \<in> \<T> (DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P A)"
     apply (induct s, simp add: Nil_elem_T, subst DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_unfold, cases "A={}") 
      apply (subst DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_unfold, cases "A={}")
       apply(auto simp add:T_Mprefix T_Mndetprefix write0_def T_SKIP T_Ndet T_STOP)
     apply (metis append_Cons append_Nil front_tickFree_charn front_tickFree_mono)
     by (metis append_Cons append_Nil front_tickFree_mono)
   qed
 
 corollary DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_all_front_tickfree_traces1: 
                               "\<T>(DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P A) = {s. front_tickFree s \<and> set s \<subseteq> (ev ` A \<union> {tick})}" 
       and CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_all_front_tickfree_traces1: 
                               "\<T>(CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A) = {s. front_tickFree s \<and> set s \<subseteq> (ev ` A \<union> {tick})}"
   using CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_refine_F[THEN leF_imp_leT, simplified trace_refine_def]
         traces_CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_sub traces_DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_sub by blast+
 
 corollary DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_all_front_tickfree_traces2: "front_tickFree s \<Longrightarrow> s \<in> \<T>(DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P UNIV)" 
       and CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_all_front_tickfree_traces2: "front_tickFree s \<Longrightarrow> s \<in> \<T>(CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P UNIV)"
    apply(simp_all add:tickFree_def DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_all_front_tickfree_traces1 
                       CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_all_front_tickfree_traces1)
   by (metis event_set subsetI)+
 
 corollary DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_has_all_traces: "DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P UNIV \<sqsubseteq>\<^sub>T P"
       and CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_has_all_traces: "CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P UNIV \<sqsubseteq>\<^sub>T P"
   apply (simp add:trace_refine_def DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_all_front_tickfree_traces2 is_processT2_TR subsetI) 
   by (simp add:trace_refine_def CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_all_front_tickfree_traces2 is_processT2_TR subsetI) 
 
 
 
 lemma deadlock_free_implies_non_terminating: 
   "deadlock_free (P::'a process) \<Longrightarrow> \<forall>s\<in>\<T> P. tickFree s"
   unfolding deadlock_free_def apply(drule leFD_imp_leF, drule leF_imp_leT) unfolding trace_refine_def 
   using DF_all_tickfree_traces1[of "(UNIV::'a set)"] tickFree_def by fastforce 
 
 lemma deadlock_free_v2_is_right: 
   "deadlock_free_v2 (P::'a process) \<longleftrightarrow> (\<forall>s\<in>\<T> P. tickFree s \<longrightarrow> (s, UNIV::'a event set) \<notin> \<F> P)"
 proof
   assume a:"deadlock_free_v2 P"
   have "tickFree s \<longrightarrow> (s, UNIV) \<notin> \<F> (DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P UNIV)" for s::"'a event list"
   proof(induct s)
     case Nil
     then show ?case by (subst DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_unfold, simp add:F_Mndetprefix write0_def F_Mprefix F_Ndet F_SKIP)
   next
     case (Cons a s)
     then show ?case 
       by (subst DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_unfold, simp add:F_Mndetprefix write0_def F_Mprefix F_Ndet F_SKIP)
   qed
   with a show "\<forall>s\<in>\<T> P. tickFree s \<longrightarrow> (s, UNIV) \<notin> \<F> P"
     using deadlock_free_v2_def failure_refine_def by blast
 next 
   assume as1:"\<forall>s\<in>\<T> P. tickFree s \<longrightarrow> (s, UNIV) \<notin> \<F> P"
   have as2:"front_tickFree s \<Longrightarrow> (\<exists>aa \<in> UNIV. ev aa \<notin> b) \<Longrightarrow> (s, b) \<in> \<F> (DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P (UNIV::'a set))" 
        for s b
   proof(induct s)
     case Nil
     then show ?case
       by (subst DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_unfold, auto simp add:F_Mndetprefix write0_def F_Mprefix F_Ndet F_SKIP)
   next
     case (Cons hda tla)
     then show ?case 
     proof(simp add:DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_def fix_def)
       define Y where "Y \<equiv> \<lambda>i. iterate i\<cdot>(\<Lambda> x. (\<sqinter>xa\<in>(UNIV::'a set) \<rightarrow>  x) \<sqinter> SKIP)\<cdot>\<bottom>"
       assume a:"front_tickFree (hda # tla)" and b:"front_tickFree tla \<Longrightarrow> (tla, b) \<in> \<F> (\<Squnion>i. Y i)"
              and c:"\<exists>aa. ev aa \<notin> b"
       from Y_def have cc:"chain Y" by simp
       from b have d:"front_tickFree tla \<Longrightarrow> \<exists>aa\<in>UNIV. ev aa \<notin> b \<Longrightarrow>(tla, b) \<in> \<F> (Y i)" for i 
         using F_LUB[OF cc] limproc_is_thelub[OF cc] by simp
       from Y_def have e:"\<F>(Mndetprefix UNIV (\<lambda>x. Y i) \<sqinter> SKIP) \<subseteq> \<F> (Y (Suc i))" for i by(simp)
       from a have f:"tla \<noteq> [] \<Longrightarrow> hda \<noteq> tick" "front_tickFree tla"
         apply (metis butlast.simps(2) butlast_snoc front_tickFree_charn 
                       list.distinct(1) tickFree_Cons)
         by (metis a append_Cons append_Nil front_tickFree_Nil front_tickFree_mono) 
       have g:"(hda#tla, b) \<in> \<F> (Y (Suc i))" for i
         using f c e[of i] d[of i] 
         by (auto simp: F_Mndetprefix write0_def F_Mprefix Y_def F_Ndet F_SKIP) (metis event.exhaust)+ 
       have h:"(hda#tla, b) \<in> \<F> (Y 0)"
         using NF_ND cc g po_class.chainE proc_ord2a by blast
       from a b c show "(hda#tla, b) \<in> \<F> (\<Squnion>i. Y i)"
         using F_LUB[OF cc] is_ub_thelub[OF cc] 
         by (metis D_LUB_2 cc g limproc_is_thelub po_class.chainE proc_ord2a process_charn) 
     qed   
   qed
   show "deadlock_free_v2 P"
   proof(auto simp add:deadlock_free_v2_def failure_refine_def)
     fix s b
     assume as3:"(s, b) \<in> \<F> P"
     hence a1:"s \<in> \<T> P" "front_tickFree s" 
        using F_T apply blast
       using as3 is_processT2 by blast
     show "(s, b) \<in> \<F> (DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P UNIV)" 
     proof(cases "tickFree s")
       case FT_True:True
       hence a2:"(s, UNIV) \<notin> \<F> P"
         using a1 as1 by blast
       then show ?thesis 
         by (metis FT_True UNIV_I UNIV_eq_I a1(2) as2 as3 emptyE event.exhaust 
                   is_processT6_S1 tickFree_implies_front_tickFree_single) 
     next
       case FT_False: False                                                                 
       then show ?thesis 
         by (meson T_F_spec UNIV_witness a1(2) append_single_T_imp_tickFree 
                   as2 emptyE is_processT5_S7)
     qed 
   qed
 qed  
 
 lemma deadlock_free_v2_implies_div_free: "deadlock_free_v2 P \<Longrightarrow> \<D> P = {}"
   by (metis F_T append_single_T_imp_tickFree deadlock_free_v2_is_right ex_in_conv 
             nonTickFree_n_frontTickFree process_charn)
 
 corollary deadlock_free_v2_FD: "deadlock_free_v2 P = DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P UNIV \<sqsubseteq>\<^sub>F\<^sub>D P"
   unfolding deadlock_free_v2_def 
   using deadlock_free_v2_implies_div_free leFD_imp_leF leF_leD_imp_leFD 
         deadlock_free_v2_def divergence_refine_def 
   by fastforce 
 
 lemma all_events_refusal: 
    "(s, {tick} \<union> ev ` (events_of P)) \<in> \<F> P \<Longrightarrow> (s, UNIV::'a event set) \<in> \<F> P"
 proof -
   assume a1:"(s, {tick} \<union> ev ` events_of P) \<in> \<F> P"
   { assume "(s, UNIV) \<notin> \<F> P"
     then obtain c where "c \<notin> {tick} \<union> ev ` events_of P \<and> s @ [c] \<in> \<T> P"
       using is_processT5_S1[of s "{tick} \<union> ev ` events_of P" P 
             "UNIV - ({tick} \<union> ev ` events_of P)", simplified] F_T a1 by auto
     hence False by (simp add:events_of_def, cases c) fastforce+
   }  
   with a1 show "(s, UNIV) \<in> \<F> P" by blast 
 qed
 
 corollary deadlock_free_v2_is_right_wrt_events:
   "deadlock_free_v2 (P::'a process) \<longleftrightarrow> 
       (\<forall>s\<in>\<T> P. tickFree s \<longrightarrow> (s, {tick} \<union> ev ` (events_of P)) \<notin> \<F> P)"
   unfolding deadlock_free_v2_is_right using all_events_refusal apply auto 
   using is_processT4 by blast 
 
 lemma deadlock_free_is_deadlock_free_v2:
   "deadlock_free P \<Longrightarrow> deadlock_free_v2 P"
   using DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_DF_refine_FD deadlock_free_def deadlock_free_v2_FD trans_FD by blast 
 
 
 
 section \<open>\<^const>\<open>deadlock_free\<close> and \<^const>\<open>deadlock_free_v2\<close> with \<^const>\<open>SKIP\<close> and \<^const>\<open>STOP\<close>\<close>
 
 lemma deadlock_free_v2_SKIP: "deadlock_free_v2 SKIP"
   unfolding deadlock_free_v2_FD by (subst DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_unfold) simp
  
 lemma non_deadlock_free_SKIP: \<open>\<not> deadlock_free SKIP\<close> 
   by (metis T_SKIP deadlock_free_implies_non_terminating insertCI non_tickFree_tick)
 
 lemma non_deadlock_free_v2_STOP: \<open>\<not> deadlock_free_v2 STOP\<close>
   by (simp add: F_STOP Nil_elem_T deadlock_free_v2_is_right)
 
 lemma non_deadlock_free_STOP: \<open>\<not> deadlock_free STOP\<close>
   using deadlock_free_is_deadlock_free_v2 non_deadlock_free_v2_STOP by blast
 
 
 
+section \<open>Non-terminating Runs\<close>
+
+definition non_terminating  :: "'a process \<Rightarrow> bool"
+  where   "non_terminating P \<equiv> RUN UNIV \<sqsubseteq>\<^sub>T P"
+
+corollary non_terminating_refine_DF: "non_terminating P = DF UNIV \<sqsubseteq>\<^sub>T P"
+  and non_terminating_refine_CHAOS: "non_terminating P = CHAOS UNIV \<sqsubseteq>\<^sub>T P"
+  by (simp_all add: DF_all_tickfree_traces1 RUN_all_tickfree_traces1 CHAOS_all_tickfree_traces1 
+                    non_terminating_def trace_refine_def)
+
+lemma non_terminating_is_right: "non_terminating (P::'a process) \<longleftrightarrow> (\<forall>s\<in>\<T> P. tickFree s)"
+  apply (rule iffI)
+  by (auto simp add:non_terminating_def trace_refine_def tickFree_def RUN_all_tickfree_traces1)[1]
+     (auto simp add:non_terminating_def trace_refine_def RUN_all_tickfree_traces2)
+
+lemma nonterminating_implies_div_free: "non_terminating P \<Longrightarrow> \<D> P = {}"
+  unfolding non_terminating_is_right
+  by (metis NT_ND equals0I front_tickFree_charn process_charn tickFree_Cons tickFree_append) 
+
+lemma non_terminating_implies_F: "non_terminating P \<Longrightarrow> CHAOS UNIV \<sqsubseteq>\<^sub>F P"
+  apply(auto simp add: non_terminating_is_right failure_refine_def)
+  using CHAOS_has_all_tickFree_failures F_T by blast 
+
+corollary non_terminating_F: "non_terminating P = CHAOS UNIV \<sqsubseteq>\<^sub>F P"
+  by (auto simp add:non_terminating_implies_F non_terminating_refine_CHAOS leF_imp_leT)
+
+corollary non_terminating_FD: "non_terminating P = CHAOS UNIV \<sqsubseteq>\<^sub>F\<^sub>D P"
+  unfolding non_terminating_F
+  using div_free_CHAOS nonterminating_implies_div_free leFD_imp_leF
+        leF_leD_imp_leFD divergence_refine_def non_terminating_F 
+  by fastforce 
+
+
+section \<open>Lifelock Freeness\<close>
+
+thm lifelock_free_def
+
+corollary lifelock_free_is_non_terminating: "lifelock_free P = non_terminating P"
+  unfolding lifelock_free_def non_terminating_FD by rule
+
+lemma div_free_divergence_refine:
+  "\<D> P = {} \<longleftrightarrow> CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P UNIV \<sqsubseteq>\<^sub>D P" 
+  "\<D> P = {} \<longleftrightarrow> CHAOS UNIV    \<sqsubseteq>\<^sub>D P" 
+  "\<D> P = {} \<longleftrightarrow> RUN UNIV      \<sqsubseteq>\<^sub>D P" 
+  "\<D> P = {} \<longleftrightarrow> DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P UNIV    \<sqsubseteq>\<^sub>D P" 
+  "\<D> P = {} \<longleftrightarrow> DF UNIV       \<sqsubseteq>\<^sub>D P" 
+  by (simp_all add: div_free_CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P div_free_CHAOS div_free_RUN div_free_DF 
+                    div_free_DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P divergence_refine_def)
+
+definition lifelock_free_v2 :: "'a process \<Rightarrow> bool"
+  where   "lifelock_free_v2 P \<equiv> CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P UNIV \<sqsubseteq>\<^sub>F\<^sub>D P"
+
+lemma div_free_is_lifelock_free_v2: "lifelock_free_v2 P \<longleftrightarrow> \<D> P = {}"
+  using CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P_has_all_failures_Un leFD_imp_leD leF_leD_imp_leFD
+        div_free_divergence_refine(1) lifelock_free_v2_def 
+  by blast
+  
+lemma lifelock_free_is_lifelock_free_v2: "lifelock_free P \<Longrightarrow> lifelock_free_v2 P"
+  by (simp add: leFD_imp_leD div_free_divergence_refine(2) div_free_is_lifelock_free_v2 lifelock_free_def)
+
+corollary deadlock_free_v2_is_lifelock_free_v2: "deadlock_free_v2 P \<Longrightarrow> lifelock_free_v2 P"
+  by (simp add: deadlock_free_v2_implies_div_free div_free_is_lifelock_free_v2)
+
+
+section \<open>New laws\<close>
+
+lemma non_terminating_Seq: 
+  "non_terminating P \<Longrightarrow> (P \<^bold>; Q) = P"
+  apply(auto simp add: non_terminating_is_right Process_eq_spec D_Seq F_Seq F_T is_processT7)
+      using process_charn apply blast
+    using process_charn apply blast
+   using F_T is_processT5_S2a by fastforce
+
+lemma non_terminating_Sync: 
+  "non_terminating P \<Longrightarrow> lifelock_free_v2 Q \<Longrightarrow> non_terminating (P \<lbrakk>A\<rbrakk> Q)"
+  apply(auto simp add: non_terminating_is_right div_free_is_lifelock_free_v2 T_Sync) 
+  apply (metis equals0D ftf_Sync1 ftf_Sync21 insertI1 tickFree_def)
+  apply (meson NT_ND is_processT7_S tickFree_append)
+  by (metis D_T empty_iff ftf_Sync1 ftf_Sync21 insertI1 tickFree_def)
+
+lemmas non_terminating_Par = non_terminating_Sync[where A = \<open>UNIV\<close>]
+   and non_terminating_Inter = non_terminating_Sync[where A = \<open>{}\<close>]
+
+
+
 
 end
\ No newline at end of file
diff --git a/thys/HOL-CSP/Bot.thy b/thys/HOL-CSP/Bot.thy
--- a/thys/HOL-CSP/Bot.thy
+++ b/thys/HOL-CSP/Bot.thy
@@ -1,100 +1,100 @@
 (*<*)
 \<comment>\<open> ********************************************************************
  * Project         : HOL-CSP - A Shallow Embedding of CSP in  Isabelle/HOL
  * Version         : 2.0
  *
- * Author          : Burkhart Wolff, Safouan Taha, Lina Ye.
+ * Author          : Burkhart Wolff, Safouan Taha.
  *                   (Based on HOL-CSP 1.0 by Haykal Tej and Burkhart Wolff)
  *
  * This file       : A Combined CSP Theory
  *
  * Copyright (c) 2009 Université Paris-Sud, France
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials provided
  *       with the distribution.
  *
  *     * Neither the name of the copyright holders nor the names of its
  *       contributors may be used to endorse or promote products derived
  *       from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  ******************************************************************************\<close>
 (*>*)
 
 chapter\<open> The CSP Operators \<close>
 
 section\<open>The Undefined Process\<close>
 
 theory     Bot
 imports    Process
 begin 
 
-definition BOT :: "'\<alpha> process"  
-where     "BOT \<equiv> Abs_process ({(s,X). front_tickFree s}, {d. front_tickFree d})"
-
-lemma is_process_REP_Bot : 
-  "is_process  ({(s,X). front_tickFree s}, {d. front_tickFree d})"
-by(auto simp: tickFree_implies_front_tickFree is_process_def 
-              FAILURES_def DIVERGENCES_def
-        elim: Process.front_tickFree_dw_closed 
-        elim: Process.front_tickFree_append)
+lift_definition BOT :: \<open>'\<alpha> process\<close> 
+  is \<open>({(s,X). front_tickFree s}, {d. front_tickFree d})\<close>
+  unfolding is_process_def FAILURES_def DIVERGENCES_def
+  by (auto simp: tickFree_implies_front_tickFree 
+           elim: front_tickFree_dw_closed front_tickFree_append)
 
 
-lemma Rep_Abs_Bot :"Rep_process (Abs_process ({(s,X). front_tickFree s},{d. front_tickFree d})) = 
-                    ({(s,X). front_tickFree s},{d. front_tickFree d})"
-by(subst Abs_process_inverse, simp_all only: CollectI Rep_process is_process_REP_Bot)
+lemma F_BOT: "\<F> BOT = {(s,X). front_tickFree s}"
+  by (simp add: BOT.rep_eq FAILURES_def Failures.rep_eq)
 
-lemma F_Bot: "\<F> BOT = {(s,X). front_tickFree s}"
-by(simp add: BOT_def FAILURES_def Failures_def Rep_Abs_Bot)
+lemma D_BOT: "\<D> BOT = {d. front_tickFree d}"
+  by (simp add: BOT.rep_eq DIVERGENCES_def Divergences.rep_eq)
 
-lemma D_Bot: "\<D> BOT = {d. front_tickFree d}"
-by(simp add: BOT_def DIVERGENCES_def D_def Rep_Abs_Bot)
+lemma T_BOT: "\<T> BOT = {s. front_tickFree s}"
+  by (simp add: Traces.rep_eq TRACES_def Failures.rep_eq[symmetric] F_BOT)
 
-lemma T_Bot: "\<T> BOT = {s. front_tickFree s}"
-by(simp add: BOT_def TRACES_def Traces_def FAILURES_def Rep_Abs_Bot)
 
 text\<open> This is the key result: @{term "\<bottom>"} --- which we know to exist 
-from the process instantiation --- is equal Bot .
+from the process instantiation --- is equal \<^const>\<open>BOT\<close> .
 \<close>
 
 lemma BOT_is_UU[simp]: "BOT = \<bottom>"
 apply(auto simp: Pcpo.eq_bottom_iff Process.le_approx_def Ra_def 
                  min_elems_Collect_ftF_is_Nil Process.Nil_elem_T 
-                 F_Bot D_Bot T_Bot
+                 F_BOT D_BOT T_BOT
            elim: D_imp_front_tickFree)
 apply(metis Process.is_processT2)
 done
 
 lemma F_UU: "\<F> \<bottom> = {(s,X). front_tickFree s}"
-  using F_Bot by auto
+  using F_BOT by auto
 
 lemma D_UU: "\<D> \<bottom> = {d. front_tickFree d}"
-  using D_Bot by auto
+  using D_BOT by auto
 
 lemma T_UU: "\<T> \<bottom> = {s. front_tickFree s}"
-  using T_Bot by auto
+  using T_BOT by auto
+
+
+lemma BOT_iff_D: \<open>P = \<bottom> \<longleftrightarrow> [] \<in> \<D> P\<close>
+  apply (intro iffI, simp add: D_UU)
+  apply (subst Process_eq_spec, safe)
+  by (simp_all add: F_UU D_UU is_processT2 D_imp_front_tickFree)
+     (metis append_Nil is_processT tickFree_Nil)+
 
 
 end
 
diff --git a/thys/HOL-CSP/CSP.thy b/thys/HOL-CSP/CSP.thy
--- a/thys/HOL-CSP/CSP.thy
+++ b/thys/HOL-CSP/CSP.thy
@@ -1,336 +1,430 @@
 (*<*)
 \<comment>\<open> ********************************************************************
  * Project         : CSP-RefTK - A Refinement Toolkit for HOL-CSP
  * Version         : 1.0
  *
- * Author          : Burkhart Wolff, Safouan Taha, Lina Ye, Benoît Ballenghien, Catherine Dubois
+ * Author          : Burkhart Wolff, Safouan Taha, Lina Ye, Benoît Ballenghien
  *
  * This file       : A Normalization Theory
  *
  * Copyright (c) 2022 Université Paris-Saclay, France
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials provided
  *       with the distribution.
  *
  *     * Neither the name of the copyright holders nor the names of its
  *       contributors may be used to endorse or promote products derived
  *       from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  ******************************************************************************\<close>
 (*>*)
 
 
-chapter\<open> Generalisation of Normalisation of Non Deterministic CSP Processes \<close>
+chapter\<open> The refinements laws \<close>
 
 theory CSP
-  imports CSP_Laws Process_Order (*Induction*)
+  imports Process_Order CSP_Laws CSP_Induct
 begin
 
 
 
 
 
 section \<open>Monotonicity\<close>
 
 lemma mono_Det_D[simp]: \<open>\<lbrakk>P \<sqsubseteq>\<^sub>D P'; S \<sqsubseteq>\<^sub>D S'\<rbrakk> \<Longrightarrow> (P \<box> S) \<sqsubseteq>\<^sub>D (P' \<box> S')\<close>
   by (metis D_Det Un_mono divergence_refine_def)
 
 lemma mono_Det_T[simp]: \<open>\<lbrakk>P \<sqsubseteq>\<^sub>T P'; S \<sqsubseteq>\<^sub>T S'\<rbrakk> \<Longrightarrow> (P \<box> S) \<sqsubseteq>\<^sub>T (P' \<box> S')\<close>
   by (metis T_Det Un_mono trace_refine_def)
 
 corollary mono_Det_DT[simp]: \<open>\<lbrakk>P \<sqsubseteq>\<^sub>D\<^sub>T P'; S \<sqsubseteq>\<^sub>D\<^sub>T S'\<rbrakk> \<Longrightarrow> (P \<box> S) \<sqsubseteq>\<^sub>D\<^sub>T (P' \<box> S')\<close>
   by (simp_all add: trace_divergence_refine_def)
 
 lemmas mono_Det_FD[simp]= mono_Det_FD[folded failure_divergence_refine_def]
 
 \<comment>\<open>Deterministic choice monotony doesn't hold for \<open>\<sqsubseteq>\<^sub>F\<close>\<close>
 
 
 
 lemma mono_Ndet_F_left[simp]: \<open>P \<sqsubseteq>\<^sub>F Q \<Longrightarrow> (P \<sqinter> S) \<sqsubseteq>\<^sub>F Q\<close>
   by (simp add: F_Ndet failure_refine_def order_trans) 
 
 lemma mono_Ndet_D_left[simp]: \<open>P \<sqsubseteq>\<^sub>D Q \<Longrightarrow> (P \<sqinter> S) \<sqsubseteq>\<^sub>D Q\<close>
   by (simp add: D_Ndet divergence_refine_def order_trans) 
 
 lemma mono_Ndet_T_left[simp]: \<open>P \<sqsubseteq>\<^sub>T Q \<Longrightarrow> (P \<sqinter> S) \<sqsubseteq>\<^sub>T Q\<close>
   by (simp add: T_Ndet trace_refine_def order_trans) 
 
 section \<open>Monotonicity\<close>
 
 lemma mono_Ndet_F[simp]: \<open>\<lbrakk>P \<sqsubseteq>\<^sub>F P'; S \<sqsubseteq>\<^sub>F S'\<rbrakk> \<Longrightarrow> (P \<sqinter> S) \<sqsubseteq>\<^sub>F (P' \<sqinter> S')\<close>
   by (metis F_Ndet Un_mono failure_refine_def) 
 
 lemma mono_Ndet_D[simp]: \<open>\<lbrakk>P \<sqsubseteq>\<^sub>D P'; S \<sqsubseteq>\<^sub>D S'\<rbrakk> \<Longrightarrow> (P \<sqinter> S) \<sqsubseteq>\<^sub>D (P' \<sqinter> S')\<close>
   by (metis D_Ndet Un_mono divergence_refine_def)
 
 lemma mono_Ndet_T[simp]: \<open>\<lbrakk>P \<sqsubseteq>\<^sub>T P'; S \<sqsubseteq>\<^sub>T S'\<rbrakk> \<Longrightarrow> (P \<sqinter> S) \<sqsubseteq>\<^sub>T (P' \<sqinter> S')\<close>
   by (metis T_Ndet Un_mono trace_refine_def) 
 
 
 corollary mono_Ndet_DT[simp]: \<open>\<lbrakk>P \<sqsubseteq>\<^sub>D\<^sub>T P'; S \<sqsubseteq>\<^sub>D\<^sub>T S'\<rbrakk> \<Longrightarrow> (P \<sqinter> S) \<sqsubseteq>\<^sub>D\<^sub>T (P' \<sqinter> S')\<close>
   by (auto simp add: trace_divergence_refine_def)
 
 lemmas mono_Ndet_FD[simp]= mono_Ndet_FD[folded failure_divergence_refine_def]
 
 
 corollary  mono_Ndet_DT_left[simp]: \<open>P \<sqsubseteq>\<^sub>D\<^sub>T Q \<Longrightarrow> (P \<sqinter> S) \<sqsubseteq>\<^sub>D\<^sub>T Q\<close>
       and  mono_Ndet_F_right[simp]: \<open>P \<sqsubseteq>\<^sub>F Q \<Longrightarrow> (S \<sqinter> P) \<sqsubseteq>\<^sub>F Q\<close>
       and  mono_Ndet_D_right[simp]: \<open>P \<sqsubseteq>\<^sub>D Q \<Longrightarrow> (S \<sqinter> P) \<sqsubseteq>\<^sub>D Q\<close>
       and  mono_Ndet_T_right[simp]: \<open>P \<sqsubseteq>\<^sub>T Q \<Longrightarrow> (S \<sqinter> P) \<sqsubseteq>\<^sub>T Q\<close>
       and mono_Ndet_DT_right[simp]: \<open>P \<sqsubseteq>\<^sub>D\<^sub>T Q \<Longrightarrow> (S \<sqinter> P) \<sqsubseteq>\<^sub>D\<^sub>T Q\<close>
   by (simp_all add: trace_divergence_refine_def Ndet_commute) 
   
 
 lemmas mono_Ndet_FD_left[simp] = mono_Ndet_FD_left[folded failure_divergence_refine_def]
    and mono_Ndet_FD_right[simp] = mono_Ndet_FD_right[folded failure_divergence_refine_def]
 
 lemma mono_Ndet_Det_FD[simp]: \<open>(P \<sqinter> S) \<sqsubseteq>\<^sub>F\<^sub>D (P \<box> S)\<close>
   by (metis Det_id failure_divergence_refine_def mono_Det_FD mono_Ndet_FD_left 
             mono_Ndet_FD_right order_refl) 
 
 
 corollary  mono_Ndet_Det_F[simp]: \<open>(P \<sqinter> S) \<sqsubseteq>\<^sub>F (P \<box> S)\<close>
       and  mono_Ndet_Det_D[simp]: \<open>(P \<sqinter> S) \<sqsubseteq>\<^sub>D (P \<box> S)\<close>
       and  mono_Ndet_Det_T[simp]: \<open>(P \<sqinter> S) \<sqsubseteq>\<^sub>T (P \<box> S)\<close>
       and mono_Ndet_Det_DT[simp]: \<open>(P \<sqinter> S) \<sqsubseteq>\<^sub>D\<^sub>T (P \<box> S)\<close> 
   by (simp_all add: leFD_imp_leF leFD_imp_leD leF_imp_leT leD_leT_imp_leDT) 
 
 
 lemma mono_Seq_F_right[simp]: \<open>S \<sqsubseteq>\<^sub>F S' \<Longrightarrow> (P \<^bold>; S) \<sqsubseteq>\<^sub>F (P \<^bold>; S')\<close>
-  apply (auto simp: failure_refine_def F_Seq append_single_T_imp_tickFree)
-  using NF_ND by fastforce+
+  by (auto simp: failure_refine_def F_Seq append_single_T_imp_tickFree)
 
 lemma mono_Seq_D_right[simp]: \<open>S \<sqsubseteq>\<^sub>D S' \<Longrightarrow> (P \<^bold>; S) \<sqsubseteq>\<^sub>D (P \<^bold>; S')\<close>
   by (auto simp: divergence_refine_def D_Seq)
 
 lemma  mono_Seq_T_right[simp]: \<open>S \<sqsubseteq>\<^sub>T S' \<Longrightarrow> (P \<^bold>; S) \<sqsubseteq>\<^sub>T (P \<^bold>; S')\<close>
-  apply (auto simp: trace_refine_def T_Seq append_single_T_imp_tickFree)
-  using D_T by fastforce+
+  by (auto simp: trace_refine_def T_Seq append_single_T_imp_tickFree)
 
 corollary mono_Seq_DT_right[simp]: \<open>S \<sqsubseteq>\<^sub>D\<^sub>T S' \<Longrightarrow> (P \<^bold>; S)  \<sqsubseteq>\<^sub>D\<^sub>T (P \<^bold>; S')\<close>
   by (simp add: trace_divergence_refine_def)
 
 lemma mono_Seq_DT_left[simp]: \<open>P \<sqsubseteq>\<^sub>D\<^sub>T P' \<Longrightarrow> (P \<^bold>; S)  \<sqsubseteq>\<^sub>D\<^sub>T (P' \<^bold>; S)\<close>
   apply (auto simp: trace_divergence_refine_def divergence_refine_def trace_refine_def D_Seq T_Seq)
   by (metis (no_types, lifting) Nil_elem_T Process.F_T T_F append.right_neutral 
             is_processT5_S3 subset_eq) 
 
 \<comment>\<open>left Sequence monotony doesn't hold for \<open>\<sqsubseteq>\<^sub>F\<close>, \<open>\<sqsubseteq>\<^sub>D\<close> and \<open>\<sqsubseteq>\<^sub>T\<close>\<close>
 
 corollary mono_Seq_DT[simp]: \<open>P \<sqsubseteq>\<^sub>D\<^sub>T P' \<Longrightarrow> S \<sqsubseteq>\<^sub>D\<^sub>T S' \<Longrightarrow> (P \<^bold>; S)  \<sqsubseteq>\<^sub>D\<^sub>T (P' \<^bold>; S')\<close>
   using mono_Seq_DT_left mono_Seq_DT_right trans_DT by blast
   
 lemmas mono_Seq_FD[simp]= mono_Seq_FD[folded failure_divergence_refine_def]
 
 
 lemma mono_Mprefix_F[simp]: \<open>\<forall>x \<in> A. P x \<sqsubseteq>\<^sub>F Q x \<Longrightarrow> Mprefix A P \<sqsubseteq>\<^sub>F Mprefix A Q\<close>
   by (auto simp: failure_refine_def F_Mprefix) blast+
 
 lemma mono_Mprefix_D[simp]: \<open>\<forall>x \<in> A. P x \<sqsubseteq>\<^sub>D Q x \<Longrightarrow> Mprefix A P \<sqsubseteq>\<^sub>D Mprefix A Q\<close>
   by (auto simp: divergence_refine_def D_Mprefix) blast+
 
 lemma mono_Mprefix_T[simp]: \<open>\<forall>x \<in> A. P x \<sqsubseteq>\<^sub>T Q x \<Longrightarrow> Mprefix A P \<sqsubseteq>\<^sub>T Mprefix A Q\<close>
   by (auto simp: trace_refine_def T_Mprefix)
 
 corollary mono_Mprefix_DT[simp]: \<open>\<forall>x \<in> A. P x \<sqsubseteq>\<^sub>D\<^sub>T Q x \<Longrightarrow> Mprefix A P \<sqsubseteq>\<^sub>D\<^sub>T Mprefix A Q\<close>
   by (simp add: trace_divergence_refine_def)
 
 lemmas mono_Mprefix_FD[simp] = mono_Mprefix_FD[folded failure_divergence_refine_def]
 
 lemma mono_Mprefix_DT_set[simp]: \<open>A \<subseteq> B \<Longrightarrow> Mprefix B P \<sqsubseteq>\<^sub>D\<^sub>T Mprefix A P\<close> (* rename this in mono_Mprefix_D_subset ? *)
   by (auto simp add:T_Mprefix D_Mprefix trace_divergence_refine_def 
                     trace_refine_def divergence_refine_def)
 
 corollary mono_Mprefix_D_set[simp]: \<open>A \<subseteq> B \<Longrightarrow> Mprefix B P \<sqsubseteq>\<^sub>D Mprefix A P\<close>
       and mono_Mprefix_T_set[simp]: \<open>A \<subseteq> B \<Longrightarrow> Mprefix B P \<sqsubseteq>\<^sub>T Mprefix A P\<close>
   by (simp_all add: leDT_imp_leD leDT_imp_leT)
 
 \<comment>\<open>Mprefix set monotony doesn't hold for \<open>\<sqsubseteq>\<^sub>F\<close> and \<open>\<sqsubseteq>\<^sub>F\<^sub>D\<close> where it holds for deterministic choice\<close>
 
 
 lemma mono_Hiding_F[simp]: \<open>P \<sqsubseteq>\<^sub>F Q \<Longrightarrow> (P \ A) \<sqsubseteq>\<^sub>F (Q \ A)\<close>
   apply(cases \<open>A = {}\<close>, simp_all add: Hiding_set_empty failure_refine_def F_Hiding, intro conjI, blast)
 proof(subst (2) Un_commute, rule subsetI, rule UnCI, auto, goal_cases)
   case (1 b t u)
   then obtain a where a:\<open>a \<in> A\<close> by blast
   define f where A: \<open>f = rec_nat t (\<lambda>i t. t @ [ev a])\<close> 
   hence AA: \<open>f (Suc i) = (f i) @ [ev a]\<close> for i by simp
   hence B: \<open>strict_mono f\<close> by (simp add:strict_mono_def lift_Suc_mono_less_iff)
   from A have C: \<open>t \<in> range f\<close> by (metis (mono_tags, lifting) old.nat.simps(6) range_eqI)
   { fix i
     have \<open>f i \<in> \<D> Q \<and> tickFree (f i) \<and> trace_hide (f i) (ev ` A) = (trace_hide t (ev ` A))\<close>
     proof(induct i)
       case 0
       then show ?case by (simp add: 1(4) 1(7) A)
     next
       case (Suc i)
       then show ?case 
         apply (simp add:AA a) 
         using is_processT7[rule_format, of \<open>f i\<close> Q \<open>[ev a]\<close>] front_tickFree_single by blast 
     qed
   } 
   with B C have \<open>isInfHiddenRun f P A \<and> t \<in> range f\<close> 
     by (metis 1(1) D_T F_subset_imp_T_subset subsetD)
   with 1 show ?case by metis
 next
   case (2 b u f x)
   then show ?case using F_subset_imp_T_subset by blast 
 qed 
 
 lemma mono_Hiding_T[simp]: \<open>P \<sqsubseteq>\<^sub>T Q \<Longrightarrow> (P \ A) \<sqsubseteq>\<^sub>T (Q \ A)\<close>
   apply(cases \<open>A={}\<close>, simp add: Hiding_set_empty, 
                       simp add:trace_refine_def T_Hiding, intro conjI)
 proof(goal_cases)
   case 1
   then show ?case
   proof(subst Un_commute, rule_tac subsetI, rule_tac UnCI, auto, goal_cases)
     case 11:(1 t a)
     hence tt: \<open>t \<in> \<T> P\<close> by (meson Process.F_T subset_eq) 
     with 11(1) inf_hidden[of A t P] obtain f where \<open>isInfHiddenRun f P A \<and> t \<in> range f\<close> by auto
     with 11(4)[rule_format, of t \<open>[]\<close>] show ?case
       by (metis 11(1) tt append_Nil2 front_tickFree_Nil is_processT2_TR 
                 nonTickFree_n_frontTickFree tick_T_F)
   qed
 next
   case 2
   then show ?case
   proof(subst Un_commute, auto, goal_cases)
     case 21:(1 t u a)
     define f where A: \<open>f = rec_nat t (\<lambda>i t. t @ [ev a])\<close> 
     hence AA: \<open>f (Suc i) = (f i) @ [ev a]\<close> for i by simp
     hence B: \<open>strict_mono f\<close> by (simp add:strict_mono_def lift_Suc_mono_less_iff)
     from A have C: \<open>t \<in> range f\<close> 
       by (metis (mono_tags, lifting) old.nat.simps(6) range_eqI)
     { fix i
       have \<open>f i \<in> \<D> Q \<and> tickFree (f i) \<and> trace_hide (f i) (ev ` A) = (trace_hide t (ev ` A))\<close>
       proof(induct i)
         case 0
         then show ?case by (simp add: 21(4) 21(7) A)
       next
         case (Suc i)
         then show ?case 
           apply (simp add:AA 21(6)) 
           using is_processT7[rule_format, of \<open>f i\<close> Q \<open>[ev a]\<close>] front_tickFree_single by blast 
       qed
     } 
     with B C have \<open>isInfHiddenRun f P A \<and> t \<in> range f\<close> by (metis 21(1) D_T subsetD)
     with 21 show ?case by metis
   next
     case 22:(2 b u f x)
     then show ?case by blast
   qed
 qed
 
 lemma mono_Hiding_DT[simp]: \<open>P \<sqsubseteq>\<^sub>D\<^sub>T Q \<Longrightarrow> (P \ A) \<sqsubseteq>\<^sub>D\<^sub>T (Q \ A)\<close>
 proof -
   assume as: \<open>P \<sqsubseteq>\<^sub>D\<^sub>T Q\<close>
   then have \<open>(P \ A) \<sqsubseteq>\<^sub>D (Q \ A)\<close>
     apply(auto simp:trace_divergence_refine_def divergence_refine_def 
                     trace_refine_def D_Hiding T_Hiding)
     by blast+
   with leDT_imp_leT[THEN mono_Hiding_T, OF as] show ?thesis by (simp add: trace_divergence_refine_def) 
 qed
 
 lemmas mono_Hiding_FD[simp] = mono_Hiding_FD[folded failure_divergence_refine_def]
 
 \<comment>\<open>Obviously, Hide monotony doesn't hold for \<open>\<sqsubseteq>\<^sub>D\<close>\<close>
 
 
 lemma mono_Sync_DT[simp]: \<open>P \<sqsubseteq>\<^sub>D\<^sub>T P' \<Longrightarrow> Q \<sqsubseteq>\<^sub>D\<^sub>T Q' \<Longrightarrow> (P \<lbrakk> A \<rbrakk> Q) \<sqsubseteq>\<^sub>D\<^sub>T (P' \<lbrakk> A \<rbrakk> Q')\<close>
   by (simp add:trace_divergence_refine_def divergence_refine_def trace_refine_def T_Sync D_Sync) 
      blast
 
 lemmas mono_Sync_FD[simp] = mono_Sync_FD[folded failure_divergence_refine_def]
 
 \<comment>\<open>Synchronization monotony doesn't hold for \<open>\<sqsubseteq>\<^sub>F\<close>, \<open>\<sqsubseteq>\<^sub>D\<close> and \<open>\<sqsubseteq>\<^sub>T\<close>\<close>
 
 
-(* choose between mono_Mndetprefix_F and mono_mndet_F *)
 lemma mono_Mndetprefix_F[simp]: \<open>\<forall>x\<in>A. P x \<sqsubseteq>\<^sub>F Q x \<Longrightarrow> Mndetprefix A P \<sqsubseteq>\<^sub>F Mndetprefix A Q\<close>
   by (cases \<open>A = {}\<close>, auto simp: failure_refine_def F_Mndetprefix write0_def F_Mprefix) 
 
 lemma mono_Mndetprefix_D[simp]: \<open>\<forall>x\<in>A. P x \<sqsubseteq>\<^sub>D Q x \<Longrightarrow> Mndetprefix A P \<sqsubseteq>\<^sub>D Mndetprefix A Q\<close>
   by (cases \<open>A = {}\<close>, auto simp: divergence_refine_def D_Mndetprefix write0_def D_Mprefix)
 
 lemma mono_Mndetprefix_T[simp]: \<open>\<forall>x\<in>A. P x \<sqsubseteq>\<^sub>T Q x \<Longrightarrow> Mndetprefix A P \<sqsubseteq>\<^sub>T Mndetprefix A Q\<close>
   by (cases \<open>A = {}\<close>, auto simp: trace_refine_def T_Mndetprefix write0_def T_Mprefix)
 
 corollary mono_Mndetprefix_DT[simp]: \<open>\<forall>x\<in>A. P x \<sqsubseteq>\<^sub>D\<^sub>T Q x \<Longrightarrow> Mndetprefix A P \<sqsubseteq>\<^sub>D\<^sub>T Mndetprefix A Q\<close>
   by (simp add: trace_divergence_refine_def)
   
 lemmas mono_Mndetprefix_FD[simp] = mono_Mndetprefix_FD[folded failure_divergence_refine_def]
 
 lemmas mono_Mndetprefix_FD_set[simp] = Mndetprefix_FD_subset[folded failure_divergence_refine_def]
 
 corollary mono_Mndetprefix_F_set[simp] : \<open>A \<noteq> {} \<Longrightarrow> A \<subseteq> B \<Longrightarrow> Mndetprefix B P \<sqsubseteq>\<^sub>F Mndetprefix A P\<close>
-      (* removed nonempty hypothesis in the 3 following propositions *)
       and mono_Mndetprefix_D_set[simp] : \<open>A \<subseteq> B \<Longrightarrow> Mndetprefix B P \<sqsubseteq>\<^sub>D  Mndetprefix A P\<close>
       and mono_Mndetprefix_T_set[simp] : \<open>A \<subseteq> B \<Longrightarrow> Mndetprefix B P \<sqsubseteq>\<^sub>T  Mndetprefix A P\<close>
       and mono_Mndetprefix_DT_set[simp]: \<open>A \<subseteq> B \<Longrightarrow> Mndetprefix B P \<sqsubseteq>\<^sub>D\<^sub>T Mndetprefix A P\<close>
   by (cases \<open>A = {}\<close>, simp_all add: leFD_imp_leF leFD_imp_leD leF_imp_leT leD_leT_imp_leDT)+
 
 lemmas Mprefix_refines_Mndetprefix_FD[simp] = 
        Mprefix_refines_Mndetprefix[folded failure_divergence_refine_def]
 
 corollary Mprefix_refines_Mndetprefix_F[simp] : \<open>Mndetprefix A P \<sqsubseteq>\<^sub>F  Mprefix A P\<close>
       and Mprefix_refines_Mndetprefix_D[simp] : \<open>Mndetprefix A P \<sqsubseteq>\<^sub>D  Mprefix A P\<close>
       and Mprefix_refines_Mndetprefix_T[simp] : \<open>Mndetprefix A P \<sqsubseteq>\<^sub>T  Mprefix A P\<close>
       and Mprefix_refines_Mndetprefix_DT[simp]: \<open>Mndetprefix A P \<sqsubseteq>\<^sub>D\<^sub>T Mprefix A P\<close>
   by (simp_all add: leFD_imp_leF leFD_imp_leD leF_imp_leT leD_leT_imp_leDT) 
 
 
 
-(* see where we put this *)
+
 
 
 lemma mono_read_FD[simp, elim]: "(\<And>x. P x \<sqsubseteq>\<^sub>F\<^sub>D Q x) \<Longrightarrow> (c\<^bold>?x \<rightarrow> (P x)) \<sqsubseteq>\<^sub>F\<^sub>D (c\<^bold>?x \<rightarrow> (Q x))"
   by (simp add: read_def)
 
 lemma mono_write_FD[simp, elim]: "(P \<sqsubseteq>\<^sub>F\<^sub>D Q) \<Longrightarrow>  (c\<^bold>!x \<rightarrow> P) \<sqsubseteq>\<^sub>F\<^sub>D (c\<^bold>!x \<rightarrow> Q)"
   by (simp add: write_def)
 
 lemma mono_write0_FD[simp, elim]: "P \<sqsubseteq>\<^sub>F\<^sub>D Q \<Longrightarrow> (a \<rightarrow> P) \<sqsubseteq>\<^sub>F\<^sub>D (a \<rightarrow> Q)"
   by (simp add: write0_def)
 
 (* make this with \<sqsubseteq>\<^sub>D \<sqsubseteq>\<^sub>T and \<sqsubseteq>\<^sub>F ? *)
 lemma mono_read_DT[simp, elim]: "(\<And>x. P x \<sqsubseteq>\<^sub>D\<^sub>T Q x) \<Longrightarrow> (c\<^bold>?x \<rightarrow> (P x)) \<sqsubseteq>\<^sub>D\<^sub>T (c\<^bold>?x \<rightarrow> (Q x))"
   by (simp add: read_def)
 
 lemma mono_write_DT[simp, elim]: "(P \<sqsubseteq>\<^sub>D\<^sub>T Q) \<Longrightarrow>  (c\<^bold>!x \<rightarrow> P) \<sqsubseteq>\<^sub>D\<^sub>T (c\<^bold>!x \<rightarrow> Q)"
   by (simp add: write_def)
 
 lemma mono_write0_DT[simp, elim]: "P \<sqsubseteq>\<^sub>D\<^sub>T Q \<Longrightarrow> (a \<rightarrow> P) \<sqsubseteq>\<^sub>D\<^sub>T (a \<rightarrow> Q)"
   by (simp add: write0_def)
 
 
 
-\<comment> \<open>The following result is very useful, but we are not sure about where is its place\<close>
+
+lemma mono_Renaming_D: \<open>P \<sqsubseteq>\<^sub>D Q \<Longrightarrow> Renaming P f \<sqsubseteq>\<^sub>D Renaming Q f\<close>
+  unfolding divergence_refine_def D_Renaming by blast
+
+
+lemma mono_Renaming_FD: \<open>P \<sqsubseteq>\<^sub>F\<^sub>D Q \<Longrightarrow> Renaming P f \<sqsubseteq>\<^sub>F\<^sub>D Renaming Q f\<close>
+  unfolding failure_divergence_refine_def le_ref_def
+  apply (simp add: mono_Renaming_D[unfolded divergence_refine_def])
+  unfolding F_Renaming D_Renaming by blast
+
+
+lemma mono_Renaming_DT: \<open>P \<sqsubseteq>\<^sub>D\<^sub>T Q \<Longrightarrow> Renaming P f \<sqsubseteq>\<^sub>D\<^sub>T Renaming Q f\<close>
+  unfolding trace_divergence_refine_def 
+  apply (simp add: mono_Renaming_D)
+  unfolding trace_refine_def divergence_refine_def T_Renaming by blast
+
+
+
+
+text \<open>Some new and very useful results\<close>
+
+lemma Ndet_is_STOP_iff: \<open>P \<sqinter> Q = STOP \<longleftrightarrow> P = STOP \<and> Q = STOP\<close>
+  using Nil_subset_T by (simp add: STOP_iff_T T_Ndet, blast)
+
+lemma Det_is_STOP_iff: \<open>P \<box> Q = STOP \<longleftrightarrow> P = STOP \<and> Q = STOP\<close>
+  using Nil_subset_T by (simp add: STOP_iff_T T_Det, blast)
+
+
+lemma Det_is_BOT_iff: \<open>P \<box> Q = \<bottom> \<longleftrightarrow> P = \<bottom> \<or> Q = \<bottom>\<close>
+  by (simp add: BOT_iff_D D_Det)
+
+lemma Ndet_is_BOT_iff: \<open>P \<sqinter> Q = \<bottom> \<longleftrightarrow> P = \<bottom> \<or> Q = \<bottom>\<close>
+  by (simp add: BOT_iff_D D_Ndet)
+
+lemma Sync_is_BOT_iff: \<open>P \<lbrakk>S\<rbrakk> Q = \<bottom> \<longleftrightarrow> P = \<bottom> \<or> Q = \<bottom>\<close>
+  by (rule HOL.sym, intro iffI, metis Sync_BOT Sync_commute)
+     (use empty_setinterleaving in \<open>auto simp add: BOT_iff_D D_Sync\<close>)
+
+
+lemma STOP_neq_BOT: \<open>STOP \<noteq> \<bottom>\<close>
+  by (simp add: D_STOP BOT_iff_D)
+
+lemma SKIP_neq_BOT: \<open>SKIP \<noteq> \<bottom>\<close>
+  by (simp add: D_SKIP BOT_iff_D)
+
+
+lemma Mprefix_neq_BOT: \<open>Mprefix A P \<noteq> \<bottom>\<close>
+  by (simp add: BOT_iff_D)
+
+lemma Mndetprefix_neq_BOT: \<open>Mndetprefix A P \<noteq> \<bottom>\<close>
+  by (cases \<open>A = {}\<close>) (simp_all add: D_STOP BOT_iff_D D_Mndetprefix write0_def)
+
+
+lemma STOP_T_iff: \<open>STOP \<sqsubseteq>\<^sub>T P \<longleftrightarrow> P = STOP\<close>
+  by auto (metis Nil_elem_T STOP_iff_T empty_iff subset_singletonD trace_refine_def)
+
+lemma STOP_F_iff: \<open>STOP \<sqsubseteq>\<^sub>F P \<longleftrightarrow> P = STOP\<close>
+  by auto (metis Nil_elem_T STOP_iff_T empty_iff leF_imp_leT subset_singletonD trace_refine_def)
+
+lemma STOP_FD_iff: \<open>STOP \<sqsubseteq>\<^sub>F\<^sub>D P \<longleftrightarrow> P = STOP\<close>
+  using STOP_F_iff idem_FD leFD_imp_leF by blast
+
+lemma SKIP_FD_iff: \<open>SKIP \<sqsubseteq>\<^sub>F\<^sub>D P \<longleftrightarrow> P = SKIP\<close>
+  apply (subst Process_eq_spec, auto simp add: failure_divergence_refine_def le_ref_def F_SKIP D_SKIP subset_iff)
+  by (metis F_T insertI1 is_processT5_S6 is_processT6_S2)
+     (metis F_T append.left_neutral insertI1 is_processT5_S6 tick_T_F)
+
+lemma SKIP_F_iff: \<open>SKIP \<sqsubseteq>\<^sub>F P \<longleftrightarrow> P = SKIP\<close>
+  apply (subst Process_eq_spec, auto simp add: failure_refine_def le_ref_def F_SKIP D_SKIP subset_iff)
+    apply (metis F_T insertI1 is_processT5_S6 is_processT6_S2)
+   apply (metis F_T append.left_neutral insertI1 is_processT5_S6 tick_T_F)
+  by (metis append_Nil insertI1 neq_Nil_conv process_charn)
+
+
+
+lemma Seq_is_SKIP_iff: \<open>P \<^bold>; Q = SKIP \<longleftrightarrow> P = SKIP \<and> Q = SKIP\<close>
+  apply (intro iffI, simp_all add: Seq_SKIP)
+  apply (simp add: SKIP_F_iff[symmetric])
+  unfolding failure_refine_def
+proof (auto simp add: F_Seq F_SKIP D_Seq D_SKIP subset_iff intro: T_F, goal_cases)
+  case (1 s X)
+  thus ?case
+    apply (cases \<open>tickFree s\<close>) 
+     apply (erule_tac x = s in allE, 
+            metis F_T append.right_neutral is_processT4_empty is_processT5_S4 process_charn)
+    by (erule_tac x = \<open>butlast s\<close> in allE,
+        metis F_T append.right_neutral append_butlast_last_id append_single_T_imp_tickFree
+        last_snoc nonTickFree_n_frontTickFree non_tickFree_tick process_charn self_append_conv2)
+next
+  case (2 s X)
+  thus ?case
+    by (metis F_T append_Nil2 append_self_conv2 butlast_snoc front_tickFree_butlast
+        insert_Diff insert_Diff_single nonTickFree_n_frontTickFree non_tickFree_tick process_charn)
+qed (metis F_T append.left_neutral insertI1 insert_absorb2 is_processT5_S6 tickFree_Nil)+
+ 
+
+
+
+\<comment> \<open>The following result is very useful (especially for ProcOmata).\<close>
 
 lemma cont_process_rec: \<open>P = (\<mu> X. f X) \<Longrightarrow> cont f \<Longrightarrow> P = f P\<close> by (simp add: def_cont_fix_eq)
 
 
 
 end
\ No newline at end of file
diff --git a/thys/HOL-CSP/CSP_Induct.thy b/thys/HOL-CSP/CSP_Induct.thy
new file mode 100644
--- /dev/null
+++ b/thys/HOL-CSP/CSP_Induct.thy
@@ -0,0 +1,145 @@
+(*<*)
+\<comment>\<open> ********************************************************************
+ * Project         : HOL-CSP - A Shallow Embedding of CSP in  Isabelle/HOL
+ * Version         : 2.0
+ *
+ * Author          : Burkhart Wolff, Safouan Taha, Lina Ye.
+ *
+ * This file       : More Fixpoint and k-Induction Schemata
+ *
+ * Copyright (c) 2020 Université Paris-Saclay, France
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *
+ *     * Neither the name of the copyright holders nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ ******************************************************************************\<close>
+(*>*)
+
+chapter \<open> Advanced Induction Schemata \<close>
+
+theory  CSP_Induct
+
+imports HOLCF
+
+begin
+
+
+default_sort type
+
+section \<open>k-fixpoint-induction\<close>
+
+lemma nat_k_induct [case_names base step]: 
+  fixes k::nat
+  assumes "\<forall>i<k. P i" and "\<forall>n\<^sub>0. (\<forall>i<k. P (n\<^sub>0+i)) \<longrightarrow> P (n\<^sub>0+k)"
+  shows "P (n::nat)"
+proof (induct rule: nat_less_induct)
+  case (1 n)
+  then show ?case 
+    apply(cases "n < k") 
+     using assms(1) apply blast
+    using assms(2)[rule_format, of "n-k"] by auto
+qed
+
+thm fix_ind fix_ind2 
+
+lemma fix_ind_k [case_names admissibility base_k_steps step]:
+  fixes k::nat
+  assumes adm: "adm P"
+  and base_k_steps: "\<forall>i<k. P (iterate i\<cdot>f\<cdot>\<bottom>)"
+  and step: "\<And>x. (\<forall>i<k.  P (iterate i\<cdot>f\<cdot>x)) \<Longrightarrow> P (iterate k\<cdot>f\<cdot>x)"
+  shows "P (fix\<cdot>f)"
+  unfolding fix_def2 apply (rule admD [OF adm chain_iterate])
+  apply(rule nat_k_induct[of k], simp add: base_k_steps) 
+  using step by (subst (1 2) add.commute, unfold iterate_iterate[symmetric]) blast 
+
+lemma nat_k_skip_induct [case_names lower_bound base_k step]:
+  fixes k::nat
+  assumes "k \<ge> 1" and "\<forall>i<k. P i" and "\<forall>n\<^sub>0. P (n\<^sub>0) \<longrightarrow> P (n\<^sub>0+k)"
+  shows "P (n::nat)"
+proof(induct rule:nat_less_induct)
+  case (1 n)
+  then show ?case 
+    apply(cases "n < k") 
+     using assms(2) apply blast
+    using assms(3)[rule_format, of "n-k"] assms(1) by auto
+qed
+
+lemma fix_ind_k_skip [case_names lower_bound admissibility base_k_steps step]:
+  fixes k::nat
+  assumes k_1: "k \<ge> 1"
+  and adm: "adm P"
+  and base_k_steps: "\<forall>i<k. P (iterate i\<cdot>f\<cdot>\<bottom>)"
+  and step: "\<And>x. P x \<Longrightarrow> P (iterate k\<cdot>f\<cdot>x)"
+  shows "P (fix\<cdot>f)"
+  unfolding fix_def2 apply (rule admD [OF adm chain_iterate])
+  apply(rule nat_k_skip_induct[of k]) 
+  using k_1 base_k_steps apply auto
+  using step by (subst add.commute, unfold iterate_iterate[symmetric]) blast
+
+thm parallel_fix_ind
+
+section\<open>Parallel fixpoint-induction\<close>
+
+lemma parallel_fix_ind_inc[case_names admissibility base_fst base_snd step]:
+  assumes adm: "adm (\<lambda>x. P (fst x) (snd x))"
+  and base_fst: "\<And>y. P \<bottom> y" and base_snd: "\<And>x. P x \<bottom>"
+  and step: "\<And>x y. P x y \<Longrightarrow> P (G\<cdot>x) y \<Longrightarrow> P x (H\<cdot>y) \<Longrightarrow> P (G\<cdot>x) (H\<cdot>y)"
+  shows "P (fix\<cdot>G) (fix\<cdot>H)"
+proof -
+  from adm have adm': "adm (case_prod P)"
+    unfolding split_def .
+  have "P (iterate i\<cdot>G\<cdot>\<bottom>) (iterate j\<cdot>H\<cdot>\<bottom>)" for i j
+  proof(induct "i+j" arbitrary:i j rule:nat_less_induct)
+    case 1
+    { fix i' j'
+      assume i:"i = Suc i'" and j:"j = Suc j'"
+      have "P (iterate i'\<cdot>G\<cdot>\<bottom>) (iterate j'\<cdot>H\<cdot>\<bottom>)" 
+       and "P (iterate i'\<cdot>G\<cdot>\<bottom>) (iterate j\<cdot>H\<cdot>\<bottom>)" 
+       and "P (iterate i\<cdot>G\<cdot>\<bottom>) (iterate j'\<cdot>H\<cdot>\<bottom>)"
+        using "1.hyps" add_strict_mono i j apply blast 
+        using "1.hyps" i apply auto[1] 
+        using "1.hyps" j by auto
+      hence ?case by (simp add: i j step)
+    }
+    thus ?case
+      apply(cases i, simp add:base_fst)
+      apply(cases j, simp add:base_snd)
+      by assumption
+  qed
+  then have "\<And>i. case_prod P (iterate i\<cdot>G\<cdot>\<bottom>, iterate i\<cdot>H\<cdot>\<bottom>)"
+    by simp
+  then have "case_prod P (\<Squnion>i. (iterate i\<cdot>G\<cdot>\<bottom>, iterate i\<cdot>H\<cdot>\<bottom>))"
+    by - (rule admD [OF adm'], simp, assumption)
+  then have "P (\<Squnion>i. iterate i\<cdot>G\<cdot>\<bottom>) (\<Squnion>i. iterate i\<cdot>H\<cdot>\<bottom>)"
+    by (simp add: lub_Pair)  
+  then show "P (fix\<cdot>G) (fix\<cdot>H)"
+    by (simp add: fix_def2)
+qed
+
+end
\ No newline at end of file
diff --git a/thys/HOL-CSP/CSP_Laws.thy b/thys/HOL-CSP/CSP_Laws.thy
--- a/thys/HOL-CSP/CSP_Laws.thy
+++ b/thys/HOL-CSP/CSP_Laws.thy
@@ -1,4605 +1,3918 @@
 (*<*)
 \<comment>\<open> ********************************************************************
  * Project         : HOL-CSP - A Shallow Embedding of CSP in  Isabelle/HOL
  * Version         : 2.0
  *
  * Author          : Burkhart Wolff, Safouan Taha, Lina Ye, Benoît Ballenghien.
  *                   (Based on HOL-CSP 1.0 by Haykal Tej and Burkhart Wolff)
  *
  * This file       : A Combined CSP Theory
  *
  * Copyright (c) 2009 Université Paris-Sud, France
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials provided
  *       with the distribution.
  *
  *     * Neither the name of the copyright holders nor the names of its
  *       contributors may be used to endorse or promote products derived
  *       from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  ******************************************************************************\<close>
 (*>*)
 
 
 chapter\<open> The "Laws" of CSP \<close>
 
 theory CSP_Laws                                               
-  imports Bot Skip Stop Det Ndet Mprefix Mndetprefix Seq Hiding Sync  
+  imports Bot Skip Stop Det Ndet Mprefix Mndetprefix Seq Hiding Sync Renaming
           "HOL-Eisbach.Eisbach"
 begin 
 
 method exI for y::'a = (rule_tac exI[where x = y])
 
 
 section\<open> General Laws\<close>
 
 lemma SKIP_Neq_STOP: "SKIP \<noteq> STOP"
   by (auto simp: Process_eq_spec F_SKIP F_STOP D_SKIP D_STOP Un_def)
 
 lemma BOT_less1[simp]: "\<bottom> \<le> (X::'a process)"
   by (simp add: le_approx_implies_le_ref)
 
 lemma BOT_less2[simp]: "BOT \<le> (X::'a process)"
   by simp
 
 section\<open> Deterministic Choice Operator Laws \<close>
 
 lemma mono_Det_FD_onside[simp]: " P \<le> P' \<Longrightarrow> (P \<box> S) \<le> (P' \<box> S)"
   unfolding le_ref_def F_Det D_Det using F_subset_imp_T_subset by blast
 
 lemma mono_Det_FD[simp]: " \<lbrakk>P \<le> P'; S \<le> S'\<rbrakk> \<Longrightarrow> (P \<box> S) \<le> (P' \<box> S')"
   by (metis Det_commute dual_order.trans mono_Det_FD_onside)
 
 lemma mono_Det_ref: " \<lbrakk>P \<sqsubseteq> P'; S \<sqsubseteq> S'\<rbrakk> \<Longrightarrow> (P \<box> S) \<sqsubseteq> (P' \<box> S')"
   using below_trans mono_Det mono_Det_sym by blast
 
 lemma Det_BOT : "(P \<box> \<bottom>) = \<bottom>"
   by (auto simp add:Process_eq_spec D_Det F_Det is_processT2 D_imp_front_tickFree F_UU D_UU) 
 
 lemma Det_STOP: "(P \<box> STOP) = P"
   by (auto simp add: Process_eq_spec D_Det F_Det D_STOP F_STOP T_STOP 
                       Un_def Sigma_def is_processT8 is_processT6_S2)  
 
 lemma Det_id: "(P \<box> P) = P"
   by (auto simp: Process_eq_spec D_Det F_Det Un_def Sigma_def is_processT8 is_processT6_S2)
 
 lemma Det_assoc: "((M \<box> P) \<box> Q) = (M \<box> (P \<box> Q))"
   by (auto simp add: Process_eq_spec D_Det F_Det Un_def Sigma_def T_Det)  
 
 
 section\<open> NonDeterministic Choice Operator Laws \<close>
 
 lemma mono_Ndet_FD[simp]: " \<lbrakk>P \<le> P'; S \<le> S'\<rbrakk> \<Longrightarrow> (P \<sqinter> S) \<le> (P' \<sqinter> S')"
   by (auto simp: le_ref_def F_Ndet D_Ndet)
 
 lemma mono_Ndet_FD_left[simp]: "P \<le> Q \<Longrightarrow> (P \<sqinter> S) \<le> Q" 
   by (metis D_Ndet F_Ndet dual_order.trans le_ref_def le_sup_iff order_refl)
 
 lemma mono_Ndet_FD_right[simp]: "P \<le> Q \<Longrightarrow> (S \<sqinter> P) \<le> Q" 
   by (metis D_Ndet F_Ndet dual_order.trans le_ref_def le_sup_iff order_refl)
 
 lemma mono_Ndet_ref: " \<lbrakk>P \<sqsubseteq> P'; S \<sqsubseteq> S'\<rbrakk> \<Longrightarrow> (P \<sqinter> S) \<sqsubseteq> (P' \<sqinter> S')"
   using below_trans mono_Ndet mono_Ndet_sym by blast
 
 lemma Ndet_BOT: "(P \<sqinter> \<bottom>) = \<bottom>"
   by (auto simp: Process_eq_spec D_Ndet F_Ndet is_processT2 D_imp_front_tickFree F_UU D_UU)
 
 lemma Ndet_id: "(P \<sqinter> P) = P"
   by (simp_all add: F_Ndet D_Ndet Process_eq_spec)  
 
 lemma Ndet_assoc: "((M \<sqinter> P) \<sqinter> Q) = (M \<sqinter> (P \<sqinter> Q))"
   by (simp_all add: F_Ndet D_Ndet  Process_eq_spec Un_assoc)  
 
 subsection\<open> Multi-Operators laws  \<close>
 
 lemma Det_distrib: "(M \<box> (P \<sqinter> Q)) = ((M \<box> P) \<sqinter> (M \<box> Q))"
   by (auto simp add:  Process_eq_spec F_Det D_Det F_Ndet D_Ndet Un_def T_Ndet)
 
 lemma Ndet_distrib: "(M \<sqinter> (P \<box> Q)) = ((M \<sqinter> P) \<box> (M \<sqinter> Q))"
   by (auto simp add:  Process_eq_spec F_Det D_Det F_Ndet 
                       D_Ndet Un_def T_Ndet is_processT8 is_processT6_S2)
 
 lemma Ndet_FD_Det: "(P \<sqinter> Q) \<le> (P \<box> Q)"
   apply(auto simp add:le_ref_def D_Ndet D_Det F_Ndet F_Det T_Ndet T_Det Ra_def min_elems_def) 
   using is_processT6_S2 NF_ND by blast+
 
 
 section\<open> Sequence Operator Laws \<close>
 
 subsection\<open>Preliminaries\<close>
 
 definition F_minus_D_Seq where 
     "F_minus_D_Seq P Q \<equiv> {(t, X). (t, X \<union> {tick}) \<in> \<F> P \<and> tickFree t} \<union>
                                 {(t, X). \<exists>t1 t2. t = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> P \<and> (t2, X) \<in> \<F> Q}"
 
 lemma F_minus_D_Seq_opt: "(a,b) \<in> \<F>(P \<^bold>; Q) = (a \<in> \<D>(P \<^bold>; Q) \<or> (a,b) \<in> F_minus_D_Seq P Q)"
-  by (auto simp add: F_Seq D_Seq F_minus_D_Seq_def)
+  using NF_ND by (auto simp add: F_Seq D_Seq F_minus_D_Seq_def) blast+
+  
 
 lemma Process_eq_spec_optimized_Seq : 
 "((P \<^bold>; Q) = (U \<^bold>; S)) = (\<D> (P \<^bold>; Q) = \<D> (U \<^bold>; S) \<and> 
                             F_minus_D_Seq P Q \<subseteq> \<F> (U \<^bold>; S) \<and> 
                             F_minus_D_Seq U S \<subseteq> \<F> (P \<^bold>; Q))"
   unfolding Process_eq_spec_optimized[of "(P \<^bold>; Q)" "(U \<^bold>; S)"] 
   by (auto simp:F_minus_D_Seq_opt)
 
 subsection\<open>Laws\<close>
 
 lemma mono_Seq_FD[simp]: " \<lbrakk>P \<le> P'; S \<le> S'\<rbrakk> \<Longrightarrow> (P \<^bold>; S) \<le> (P' \<^bold>; S')"
   apply (auto simp: le_ref_def F_Seq D_Seq)
   by (metis F_subset_imp_T_subset subsetCE)+
 
 lemma mono_Seq_ref: " \<lbrakk>P \<sqsubseteq> P'; S \<sqsubseteq> S'\<rbrakk> \<Longrightarrow> (P \<^bold>; S) \<sqsubseteq> (P' \<^bold>; S')"
   using below_trans mono_Seq mono_Seq_sym by blast
 
 lemma BOT_Seq: "(\<bottom> \<^bold>; P) = \<bottom>"
-  apply(auto simp add: Process_eq_spec D_Seq F_Seq front_tickFree_append F_UU D_UU T_UU)
-      using front_tickFree_append front_tickFree_implies_tickFree is_processT2 apply blast
-     using D_imp_front_tickFree front_tickFree_append front_tickFree_implies_tickFree apply blast
-    using front_tickFree_charn tickFree_Nil apply blast
-   using D_imp_front_tickFree front_tickFree_append front_tickFree_implies_tickFree apply blast 
-  using front_tickFree_Nil tickFree_Nil by blast
+  by (simp add: BOT_iff_D D_Seq D_UU)
+   
 
 lemma Seq_SKIP: "(P \<^bold>; SKIP) = P"
-  apply (auto simp add: Process_eq_spec F_Seq D_Seq F_SKIP D_SKIP is_processT7 is_processT8_S 
-                        T_F_spec is_processT6_S1)
-      apply (meson insertI2 is_processT4 subsetI)
-     apply (meson append_T_imp_tickFree is_processT5_S7 non_tickFree_tick not_Cons_self2 tickFree_append)
-    using T_F_spec insert_absorb is_processT5_S2 apply fastforce
-   apply (metis F_T is_processT nonTickFree_n_frontTickFree)
-  by (metis append_Nil2 front_tickFree_mono is_processT nonTickFree_n_frontTickFree not_Cons_self)
+  apply (auto simp add: Process_eq_spec F_Seq F_SKIP D_Seq D_SKIP T_F_spec is_processT6_S1)
+      apply (use is_processT4 in blast)
+     apply (meson append_single_T_imp_tickFree is_processT5_S7 non_tickFree_tick tickFree_append)
+    apply (meson is_processT8)
+   apply (use T_F_spec insert_absorb is_processT5_S2 in fastforce)
+  by (metis F_T is_processT nonTickFree_n_frontTickFree)
 
 lemma SKIP_Seq: "(SKIP \<^bold>; P) = P"
   by (auto simp add: Process_eq_spec D_Seq T_SKIP F_Seq F_SKIP D_SKIP is_processT8_Pair)
 
 lemma STOP_Seq: "(STOP \<^bold>; P) = STOP"
-  by (auto simp: Process_eq_spec F_Seq D_Seq F_STOP D_STOP T_STOP Un_def)
+  by (simp add: STOP_iff_T T_Seq T_STOP F_STOP D_STOP Collect_conv_if)
+
 
 subsection\<open> Multi-Operators laws  \<close>
 
 lemma Seq_Ndet_distrR: "((P \<sqinter> Q) \<^bold>; S) = ((P \<^bold>; S) \<sqinter> (Q \<^bold>; S))"
   by (auto simp add: Process_eq_spec D_Seq D_Ndet T_Ndet Un_def F_Seq T_Seq F_Ndet)
 
 lemma Seq_Ndet_distrL: "(P \<^bold>; (Q \<sqinter> S)) = ((P \<^bold>; Q) \<sqinter> (P \<^bold>; S))"
   by (auto simp add: Process_eq_spec D_Seq D_Ndet T_Ndet Un_def F_Seq F_Ndet)
 
 lemma Seq_assoc_D: "\<D> (P \<^bold>; (Q \<^bold>; S)) = \<D> ((P \<^bold>; Q) \<^bold>; S)"
 proof(safe, goal_cases)
-  case (1 x)
-  then show ?case 
-    apply(auto simp add:D_Seq T_Seq) 
-      using front_tickFree_Nil apply blast
-     apply (metis append.assoc append_single_T_imp_tickFree tickFree_append)
-    by (metis append.assoc)
+  show \<open>s \<in> \<D> (P \<^bold>; (Q \<^bold>; S)) \<Longrightarrow> s \<in> \<D> (P \<^bold>; Q \<^bold>; S)\<close> for s
+    by (simp add: D_Seq T_Seq) (metis append.assoc)
 next
-  case (2 x)
-  then show ?case 
+  fix s
+  assume \<open>s \<in> \<D> (P \<^bold>; Q \<^bold>; S)\<close>
+  thus \<open>s \<in> \<D> (P \<^bold>; (Q \<^bold>; S))\<close>
   proof(auto simp add:D_Seq T_Seq, goal_cases)
-    case (1 t2 t1a t2a)
-    then show ?case using front_tickFree_append by fastforce 
+    case (1 t1 t2 t1a t2a)
+    from "1"(1)[rule_format, OF "1"(5)] show ?case
+      apply (cases \<open>tickFree t2a\<close>)
+       apply (metis "1"(4) "1"(5) append_single_T_imp_tickFree non_tickFree_tick tickFree_append)
+      by (metis "1"(3) "1"(4) "1"(6) T_nonTickFree_imp_decomp append.assoc butlast_snoc)
   next
-    case (2 t1 t2 t1a t2a)
-    then obtain t2b where  "t2a = t2b@[tick]"
-      by (metis T_nonTickFree_imp_decomp append_single_T_imp_tickFree non_tickFree_tick tickFree_append)
-    with 2 show ?case by auto
-  next
-    case (3 t1 t2 t1a t2a)
-    then show ?case by (metis front_tickFree_implies_tickFree process_charn)
-  next
-    case (4 t1 t2 t1a t2a)
-    then obtain t2b where  "t2a = t2b@[tick]" 
-      by (metis D_T T_nonTickFree_imp_decomp append_single_T_imp_tickFree non_tickFree_tick tickFree_append)
-    with 4 show ?case 
-      by (metis D_imp_front_tickFree append.assoc butlast_snoc front_tickFree_implies_tickFree process_charn)
-  next
-    case (5 t1 t2 t1a t2a)
-    then show ?case by (metis front_tickFree_implies_tickFree process_charn)
-  next
-    case (6 t1 t2 t1a t2a)
-    then obtain t2b where  "t2a = t2b@[tick]"
-      by (metis D_T T_nonTickFree_imp_decomp append_single_T_imp_tickFree non_tickFree_tick tickFree_append)
-    with 6 show ?case
-      by (metis D_imp_front_tickFree append.assoc butlast_snoc front_tickFree_implies_tickFree process_charn)
+    case (2 t1 t2)
+    then show ?case 
+      by (meson D_imp_front_tickFree front_tickFree_implies_tickFree is_processT7 is_processT9_S_swap)
   qed
 qed
   
 lemma Seq_assoc: "(P \<^bold>; (Q \<^bold>; S)) = ((P \<^bold>; Q) \<^bold>; S)"
 proof (auto simp: Process_eq_spec_optimized_Seq Seq_assoc_D, goal_cases)
   case (1 a b)
   then show ?case
-  proof(auto simp add:F_minus_D_Seq_def Seq_assoc_D F_minus_D_Seq_opt append_single_T_imp_tickFree del:conjI, 
+  proof(auto simp add:F_minus_D_Seq_def Seq_assoc_D F_minus_D_Seq_opt append_single_T_imp_tickFree 
+             del:conjI, 
         goal_cases 11 12)
     case (11 t1 t2)
     then show ?case by (metis (mono_tags, lifting) D_Seq Seq_assoc_D UnCI mem_Collect_eq)
   next
     case (12 t1 t1a t2a)
     hence "(t1 @ t1a) @ [tick] \<in> \<T> (P \<^bold>; Q)" by (auto simp:T_Seq)
     then show ?case
       using 12(2)[rule_format, of "t1@t1a" t2a] 12(4,5,6) by simp
   qed
 next
   case (2 a b)
   then show ?case
-  proof(auto simp add:F_minus_D_Seq_def Seq_assoc_D F_minus_D_Seq_opt append_single_T_imp_tickFree T_Seq del:conjI, 
-      goal_cases 21 22 23 24 25 26)
+  proof(auto simp add:F_minus_D_Seq_def Seq_assoc_D F_minus_D_Seq_opt 
+                       append_single_T_imp_tickFree T_Seq del:conjI, 
+      goal_cases 21 22 23)
     case 21
-    then show ?case 
-      by (metis (mono_tags, lifting) D_Seq UnCI append_Nil2 front_tickFree_Nil mem_Collect_eq)
+    then show ?case
+      using D_Seq by force
   next
     case (22 t1 t2 t1a t2a)
     then obtain t2b where  "t2a = t2b@[tick]"
       by (metis T_nonTickFree_imp_decomp append_single_T_imp_tickFree non_tickFree_tick tickFree_append)
     with 22 show ?case using append.assoc butlast_snoc by auto
   next
-    case (23 t1 t2 t1a t2a)
+    case (23 t1 t2)
     hence "t1 \<in> \<D> (P \<^bold>; (Q \<^bold>; S))" 
-      by (simp add:D_Seq) (metis append_Nil2 front_tickFree_implies_tickFree process_charn)
+      by (simp add: D_Seq) (meson is_processT9_S_swap)
     with 23 Seq_assoc_D show ?case by (metis front_tickFree_implies_tickFree process_charn)
-  next
-    case (24 t1 t2 t1a t2a)
-    then obtain t2b where  "t2a = t2b@[tick]"
-      by (metis D_T T_nonTickFree_imp_decomp append_single_T_imp_tickFree non_tickFree_tick tickFree_append)
-    with 24 show ?case by (metis D_T append.assoc butlast_snoc)
-  next 
-    case (25 t1 t2 t1a t2a)
-    hence "t1 \<in> \<D> (P \<^bold>; (Q \<^bold>; S))" 
-      by (simp add:D_Seq) (metis append_Nil2 front_tickFree_implies_tickFree process_charn)
-    with 25 Seq_assoc_D show ?case by (metis front_tickFree_implies_tickFree process_charn)
-  next
-    case (26 t1 t2 t1a t2a)
-    then obtain t2b where  "t2a = t2b@[tick]"
-      by (metis D_T T_nonTickFree_imp_decomp append_single_T_imp_tickFree non_tickFree_tick tickFree_append)
-    with 26 show ?case by (metis D_T append.assoc butlast_snoc)
   qed
 qed
 
 
 section\<open> The Multi-Prefix Operator Laws \<close>
 
 lemma mono_Mprefix_FD[simp]: "\<forall>x \<in> A. P x \<le> P' x \<Longrightarrow> Mprefix A P \<le> Mprefix A P'"
   by (auto simp: le_ref_def F_Mprefix D_Mprefix) blast+
 
 lemmas mono_Mprefix_ref =  mono_Mprefix0
 
 lemma Mprefix_STOP: "(Mprefix {} P) = STOP"
   by (auto simp:Process_eq_spec F_Mprefix D_Mprefix D_STOP F_STOP)
 
 subsection\<open> Multi-Operators laws  \<close>
 
 lemma Mprefix_Un_distrib: "(Mprefix (A \<union> B) P) = ((Mprefix A P) \<box> (Mprefix B P))"
   apply (unfold Process_eq_spec, rule conjI)
   apply (auto, (elim disjE conjE | simp_all add: F_Det F_Mprefix Un_def image_def)+, auto)
   by (auto simp add: D_Det D_Mprefix Un_def)
 
 lemma Mprefix_Seq: "((Mprefix A P) \<^bold>; Q) = (Mprefix A (\<lambda>x. (P x) \<^bold>; Q))"
 proof (unfold Process_eq_spec, rule conjI, rule subset_antisym, goal_cases)
   case 1
   then show ?case   
     apply(unfold split_def F_Seq D_Seq F_Mprefix T_Mprefix D_Mprefix)
     apply(rule subsetI, simp_all, elim disjE conjE exE)
         apply(rule disjI1, simp, meson tickFree_tl)
        apply (rule disjI2, rule conjI, simp) apply auto[1]
       apply (auto simp add:hd_append)[1]
-   using tickFree_tl apply fastforce
-  by (auto simp add: hd_append)[1]
+   using tickFree_tl by fastforce
 next
   case 2
   then show ?case 
     apply(unfold split_def F_Seq D_Seq F_Mprefix T_Mprefix D_Mprefix)
     apply(rule subsetI, simp_all, elim disjE conjE exE)
         apply(rule disjI1, simp, blast)
        apply(rule disjI1, metis event.simps(3) list.exhaust_sel tickFree_Cons)
   proof(goal_cases)
     case (1 x a t1 t2)
     then show ?case 
       apply(rule_tac disjI2, rule_tac disjI1, rule_tac x="(ev a)#t1" in exI) 
       using hd_Cons_tl image_iff by fastforce
   next
-    case (2 x a t1 t2)
-    then show ?case       
-      apply(rule_tac disjI2, rule_tac disjI2, rule_tac disjI1, rule_tac x="(ev a)#t1" in exI) 
-      using hd_Cons_tl image_iff by fastforce
-  next
-    case (3 x a t1 t2)
-    then show ?case 
-      apply(rule_tac disjI2, rule_tac disjI2, rule_tac disjI2, rule_tac x="(ev a)#t1" in exI) 
-      using hd_Cons_tl image_iff by fastforce
+    case (2 x a)
+    then show ?case     
+      by (metis prod.collapse)
   qed
 next
   case 3
   then show ?case     
     apply (auto simp add: D_Mprefix D_Seq T_Mprefix)
-        using tickFree_tl apply blast
-       apply (metis event.distinct(1) hd_append image_iff list.sel(1))
-      apply (metis event.distinct(1) hd_append list.sel(1) tl_append2)
-     apply (metis (no_types, opaque_lifting) append_Cons event.distinct(1) image_eqI list.distinct(1) 
-                      list.exhaust_sel list.sel(1) list.sel(3) tickFree_Cons)
-    by (metis append_Cons list.exhaust_sel list.sel(1) list.sel(3))
+      apply (metis event.distinct(1) hd_append image_iff list.sel(1))
+     apply (metis event.distinct(1) hd_append list.sel(1) tl_append2)
+    by (metis Cons_eq_appendI hd_Cons_tl list.sel(1) list.sel(3))
 qed
 
 subsection\<open> Derivative Operators laws  \<close>
 
 lemma Mprefix_singl: "(Mprefix {a} P) = (a \<rightarrow> (P a))"
   by (simp add:write0_def Mprefix_def, rule arg_cong[of _ _ "\<lambda>x. Abs_process x"]) fastforce
 
 lemma mono_read_FD: "(\<And>x. P x \<le> Q x) \<Longrightarrow>  (c\<^bold>?x \<rightarrow> (P x)) \<le> (c\<^bold>?x \<rightarrow> (Q x))"
   by (simp add: read_def)
 
 lemma mono_write_FD: "(P \<le> Q) \<Longrightarrow>  (c\<^bold>!x \<rightarrow> P) \<le> (c\<^bold>!x \<rightarrow> Q)"
   by (simp add: write_def)
 
 lemma mono_write0_FD: "P \<le> Q \<Longrightarrow> (a \<rightarrow> P) \<le> (a \<rightarrow> Q)"
   by (simp add: write0_def)
 
 lemma mono_read_ref: "(\<And>x. P x \<sqsubseteq> Q x) \<Longrightarrow>  (c\<^bold>?x \<rightarrow> (P x)) \<sqsubseteq> (c\<^bold>?x \<rightarrow> (Q x))"
   by (simp add: mono_Mprefix0 read_def)
                                          
 lemma mono_write_ref: "(P \<sqsubseteq> Q) \<Longrightarrow>  (c\<^bold>!x \<rightarrow> P) \<sqsubseteq> (c\<^bold>!x \<rightarrow> Q)"
   by (simp add: mono_Mprefix0 write_def)
 
 lemma mono_write0_ref: "P \<sqsubseteq> Q \<Longrightarrow> (a \<rightarrow> P) \<sqsubseteq> (a \<rightarrow> Q)"
   by (simp add: mono_Mprefix0 write0_def)
 
 lemma write0_Ndet: "(a \<rightarrow> (P \<sqinter> Q)) = ((a \<rightarrow> P) \<sqinter> (a \<rightarrow> Q))"
   by (auto simp: Process_eq_spec write0_def D_Ndet F_Ndet F_Mprefix D_Mprefix Un_def)
 
 lemma write0_Det_Ndet: "((a \<rightarrow> P) \<box> (a \<rightarrow> Q)) = ((a \<rightarrow> P) \<sqinter> (a \<rightarrow> Q))"
   by (auto simp: Process_eq_spec write0_def D_Ndet F_Ndet F_Det D_Det) (simp add: F_Mprefix)+
 
 lemma Mprefix_Det: \<open>(\<box>e\<in>A \<rightarrow> P e) \<box> (\<box>e\<in>A \<rightarrow> Q e) = \<box>e\<in>A \<rightarrow> (P e \<sqinter> Q e)\<close>
   by (auto simp: Process_eq_spec F_Det D_Det) (auto simp: D_Ndet F_Ndet F_Mprefix D_Mprefix)
 
 section\<open> The Hiding Operator Laws \<close>
 
 subsection\<open> Preliminaries \<close>
 
 lemma elemDIselemHD: \<open>t \<in> \<D> P \<Longrightarrow> trace_hide t (ev ` A) \<in> \<D> (P \ A)\<close>
 proof (cases "tickFree t")
   case True
   assume "t \<in> \<D> P"
   with True show ?thesis by (simp add:D_Hiding, rule_tac x=t in exI, rule_tac x="[]" in exI, simp)
 next
   case False
   assume a:"t \<in> \<D> P"
   with False obtain t' where "t = t'@[tick]" using D_imp_front_tickFree nonTickFree_n_frontTickFree by blast
   with a show ?thesis apply (auto simp add:D_Hiding, rule_tac x=t' in exI, rule_tac x="[tick]" in exI)  
     by (meson front_tickFree_implies_tickFree front_tickFree_single is_processT)
 qed
 
 lemma length_strict_mono: "strict_mono (f::nat \<Rightarrow> 'a list) \<Longrightarrow> length (f i) \<ge> i + length (f 0)"
   apply(induct i, simp)
   by (metis dual_order.trans lessI less_length_mono not_less not_less_eq_eq plus_nat.simps(2) strict_mono_def)
 
 lemma mono_trace_hide: "a \<le> b \<Longrightarrow> trace_hide a (ev ` A) \<le> trace_hide b (ev ` A)"
   by (metis filter_append le_list_def)
 
 lemma mono_constant: 
   assumes "mono (f::nat \<Rightarrow> 'a event list)" and "\<forall>i. f i \<le> a"
   shows "\<exists>i. \<forall>j\<ge>i. f j = f i"
 proof -
   from assms(2) have "\<forall>i. length (f i) \<le> length a"
     by (simp add: le_length_mono)
   hence aa:"finite {length (f i)|i. True}" 
     using finite_nat_set_iff_bounded_le by auto
   define lm where l2:"lm = Max {length (f i)|i. True}"
   with aa obtain im where "length (f im) = lm" using Max_in by fastforce
   with l2 assms(1) show ?thesis 
     apply(rule_tac x=im in exI, intro impI allI)
     by (metis (mono_tags, lifting) Max_ge aa antisym le_length_mono le_neq_trans less_length_mono 
               mem_Collect_eq mono_def order_less_irrefl)
 qed
   
 lemma elemTIselemHT: \<open>t \<in> \<T> P \<Longrightarrow> trace_hide t (ev ` A) \<in> \<T> (P \ A)\<close>
 proof (cases "tickFree t")
   case True
   assume a:"t \<in> \<T> P"
   with True show ?thesis
   proof (cases "(\<exists>ta. trace_hide t (ev ` A) = trace_hide ta (ev ` A) \<and> (ta, ev ` A) \<in> \<F> P)")
     case True
     thus ?thesis by (simp add:T_Hiding)
   next
     case False
     with a False inf_hidden[of A t P] obtain f where "isInfHiddenRun f P A \<and> t \<in> range f" by auto
     with True show ?thesis 
       by (simp add:T_Hiding, rule_tac disjI2, rule_tac x=t in exI, rule_tac x="[]" in exI, auto)
   qed
 next
   case False
   assume a:"t \<in> \<T> P"
   with False obtain t' where tt:"t = t'@[tick]" using T_nonTickFree_imp_decomp by auto
   with a show ?thesis 
   proof (cases "(\<exists>ta. trace_hide t (ev ` A) = trace_hide ta (ev ` A) \<and> (ta, ev ` A) \<in> \<F> P)")
     case True
     thus ?thesis by (simp add:T_Hiding)
   next
     case False
     assume "t \<in> \<T> P"
     with False inf_hidden[of A t P] obtain f where "isInfHiddenRun f P A \<and> t \<in> range f" by auto
     then show ?thesis 
       apply (simp add:T_Hiding, rule_tac disjI2, rule_tac x=t' in exI, rule_tac x="[tick]" in exI, auto)
         apply (metis append_T_imp_tickFree list.distinct(1) tt)
        using tt apply force
       by (metis False append_T_imp_tickFree is_processT5_S7 non_tickFree_tick not_Cons_self2 tickFree_append tt)
   qed
 qed
 
 lemma Hiding_Un_D1: \<open>\<D> (P \ (A \<union> B)) \<subseteq> \<D> ((P \ A) \ B)\<close>
 proof (simp add:conj_commute D_Hiding, intro conjI subset_antisym subsetI, simp_all, goal_cases)
   case (1 x)
-  then obtain t u where B1:"x = trace_hide t (ev ` (A \<union> B)) @ u" and B2:"tickFree t" and B3:"front_tickFree u" and 
-             B4:"(t \<in> \<D> P \<or> (\<exists>(f:: nat \<Rightarrow> 'a event list). isInfHiddenRun f P (A \<union> B) \<and> t \<in> range f))" by auto
+  then obtain t u where B1:"x = trace_hide t (ev ` (A \<union> B)) @ u" 
+                    and B2:"tickFree t" and B3:"front_tickFree u" 
+                    and B4:"(t \<in> \<D> P \<or> (\<exists>(f:: nat \<Rightarrow> 'a event list). isInfHiddenRun f P (A \<union> B) 
+                                                                      \<and> t \<in> range f))" by auto
   thus ?case
     apply(erule_tac  disjE)
     apply(rule_tac x="trace_hide t (ev ` A)" in exI, rule_tac x=u in exI)
     apply(simp add:Hiding_tickFree tickFree_def)
     apply(rule disjI1, rule_tac x=t in exI, rule_tac x="[]" in exI, simp) 
   proof(goal_cases)
     case 1
     then obtain f n where fc:"isInfHiddenRun f P (A \<union> B) \<and> t = f n" by auto
     define ff where "ff = (\<lambda>i. take (i + length (f 0)) (f i))"
     with fc have ffc:"isInfHiddenRun ff P (A \<union> B) \<and> t \<in> range ff" 
     proof (auto, goal_cases)
       case 1
       { fix x
         from length_strict_mono[of f "Suc x ", OF 1(2)]
         have a:"take (x + length (f 0)) (f (Suc x)) < take ((Suc x) + length (f 0)) (f (Suc x))"
           by (simp add: take_Suc_conv_app_nth)
         from 1(2)[THEN strict_monoD, of x "Suc x", simplified] 
           obtain t where "f (Suc x) = (f x @ t)" by (metis le_list_def less_imp_le)
         with length_strict_mono[of f x, OF 1(2)]
           have "take (x + length (f 0)) (f x) = take (x + length (f 0)) (f (Suc x))" by simp
         with a have "take (x + length (f 0)) (f x) < take (Suc x + length (f 0)) (f (Suc x))" by simp
       }
       thus ?case by (meson lift_Suc_mono_less strict_mono_def)
     next
       case (2 i)
       have "take (i + length (f 0)) (f i) \<le> f i"
         using append_take_drop_id le_list_def by blast
       also have "\<forall>x y. x \<le> y \<and> y \<in> \<T> P \<longrightarrow> x \<in> \<T> P" using is_processT3_ST_pref by blast
       ultimately show ?case using "2"(3) by blast 
     next
       case (3 i)
       hence "(f i) \<ge> (f 0)" using strict_mono_less_eq by blast
       hence "take (i + length (f 0)) (f i) \<ge> (f 0)"
         by (metis add.commute append_eq_conv_conj le_list_def take_add)
-      hence a:"[x\<leftarrow>take (i + length (f 0)) (f i) . x \<notin> ev ` A \<and> x \<notin> ev ` B] \<ge> [x\<leftarrow>f 0 . x \<notin> ev ` A \<and> x \<notin> ev ` B]"
+      hence a:"   [x\<leftarrow>take (i + length (f 0)) (f i) . x \<notin> ev ` A \<and> x \<notin> ev ` B] 
+                \<ge> [x\<leftarrow>f 0 . x \<notin> ev ` A \<and> x \<notin> ev ` B]"
         by (metis (no_types, lifting) filter_append le_list_def)
       have "take (i + length (f 0)) (f i) \<le> f i"
         using append_take_drop_id le_list_def by blast
-      hence "[x\<leftarrow>take (i + length (f 0)) (f i) . x \<notin> ev ` A \<and> x \<notin> ev ` B] \<le> [x\<leftarrow>f i . x \<notin> ev ` A \<and> x \<notin> ev ` B]"
+      hence "  [x\<leftarrow>take (i + length (f 0)) (f i) . x \<notin> ev ` A \<and> x \<notin> ev ` B] 
+             \<le> [x\<leftarrow>f i . x \<notin> ev ` A \<and> x \<notin> ev ` B]"
         by (metis (no_types, lifting) filter_append le_list_def)
       with a 3(4) show ?case by (metis (no_types, lifting) dual_order.antisym)
     next
       case 4
       have "f (length (f n) - length (f 0)) \<ge> f n"
         by (simp add: "4"(2) add_le_imp_le_diff length_strict_mono strict_mono_less_eq)
       hence "f n = (\<lambda>i. take (i + length (f 0)) (f i)) (length (f n) - length (f 0))" 
         by (metis "4"(2) add.commute append_eq_conv_conj diff_is_0_eq' 
                   le_add_diff_inverse le_list_def le_zero_eq nat_le_linear strict_mono_less_eq)
       then show ?case by blast
     qed
     thus ?case proof(cases "\<exists>m. (\<forall>i>m. last (ff i) \<in> (ev ` A))")
       case True
       then obtain m where mc:"\<forall>i>m. last (ff i) \<in> (ev ` A)" by blast
       hence mc2:"tickFree (ff m)" 
         by (metis (no_types, lifting) B2 event.distinct(1) ffc 
                                       image_iff mem_Collect_eq set_filter tickFree_def)
       with mc mc2 1 ffc show ?thesis 
         apply(rule_tac x="trace_hide (ff m) (ev ` A)" in exI, rule_tac x=u in exI, simp, intro conjI)    
         apply (metis (no_types, lifting) mem_Collect_eq set_filter tickFree_def)
         apply (metis (no_types, lifting) rangeE)
         apply(rule disjI1, rule_tac x="ff m" in exI, rule_tac x="[]" in exI, intro conjI, simp_all)
         apply(rule disjI2, rule_tac x="\<lambda>i. ff(i + m)" in exI, intro conjI)
            apply (metis (no_types, lifting) add.commute add.right_neutral rangeI) 
           apply (simp add: strict_mono_def)
          apply blast
         proof(rule allI, goal_cases)
           case (1 i)
           from ffc ff_def True have "\<exists>t. (ff (i + m)) = (ff m) @ t \<and> set t \<subseteq> (ev ` A)" 
           proof(induct i)
             case 0
             then show ?case by fastforce
           next
             case (Suc i)
             then obtain tt where tc:"(ff (i + m)) = (ff m) @ tt \<and> set tt \<subseteq> (ev ` A)" by blast
-            from ffc ff_def length_strict_mono[of ff] have lc:"length (ff (Suc i + m)) = Suc (length (ff (i + m)))" 
+            from ffc ff_def length_strict_mono[of ff] have lc:"length (ff (Suc i + m)) 
+                                                              = Suc (length (ff (i + m)))" 
               by (metis (no_types, lifting) add_Suc fc length_strict_mono length_take min.absorb2)
             from True obtain l where lc2:"l = last (ff (Suc i + m)) \<and> l \<in> (ev ` A)"
               by (meson less_add_same_cancel2 mc zero_less_Suc)
             from ffc obtain r where rc:"ff (Suc i + m) = ff (i + m)@r"
               by (metis add.commute add_Suc_right le_list_def lessI less_imp_le strict_mono_less_eq)
             with lc have "length r = 1" by (metis Suc_eq_plus1 add_left_cancel length_append)
             with rc lc2 have "r = [l]"
               by (metis (no_types, lifting) Nil_is_append_conv Suc_eq_plus1 append_butlast_last_id 
                         append_eq_append_conv append_eq_append_conv2 length_Cons length_append)
             with Suc lc2 tc rc show ?case by (rule_tac x="tt@[l]" in exI, auto) 
           qed
           then show ?case using filter_empty_conv by fastforce
         qed
     next
       case False
       { fix i
         assume as:"(i::nat) > 0"
         with ffc obtain tt where ttc:"ff i = ff 0 @ tt \<and> set tt \<subseteq> ev ` (A \<union> B)" 
           unfolding isInfHiddenRun_1 by blast
         with ffc as have "tt \<noteq> []" using strict_mono_eq by fastforce
         with ttc have "last (ff i) \<in> ev ` (A \<union> B)" by auto
       }
       hence as2:"\<forall>i. \<exists>j>i. last(ff j) \<in> ((ev ` B) - (ev ` A))"
         by (metis DiffI False UnE gr_implies_not_zero gr_zeroI image_Un)
       define ffb where "ffb = rec_nat t (\<lambda>i t. (let j = SOME j. ff j > t \<and> 
                               last(ff j) \<in> ((ev ` B) - (ev ` A)) in ff j))"
       with as2 have ffbff:"\<And>n. ffb n \<in> range ff"
         by (metis (no_types, lifting) ffc old.nat.exhaust old.nat.simps(6) old.nat.simps(7) rangeI)
       from 1 ffb_def show ?thesis
         apply(rule_tac x="trace_hide t (ev ` A)" in exI, rule_tac x=u in exI, simp, intro conjI)
          apply (meson filter_is_subset set_rev_mp tickFree_def)        
       proof(rule disjI2, rule_tac x="\<lambda>i. trace_hide (ffb i) (ev ` A)" in exI, intro conjI, goal_cases)
         case 1
         then show ?case by (metis (no_types, lifting) old.nat.simps(6) rangeI) 
       next
         case 2
         { fix n
           have a0:"(ffb (Suc n)) = ff (SOME j. ff j > ffb n \<and> last(ff j) \<in> ((ev ` B) - (ev ` A)))" 
             by (simp add: ffb_def)
           from ffbff obtain i where a1:"ffb n = ff i" by blast
           with as2 have "\<exists>j. ff j > ffb n \<and> last(ff j) \<in> ((ev ` B) - (ev ` A))"
             by (metis ffc strict_mono_def)
           with a0 a1 have a:"(ffb (Suc n)) > (ffb n) \<and> last (ffb (Suc n)) \<notin> (ev ` A)"
             by (metis (no_types, lifting) Diff_iff tfl_some) 
           then obtain r where  "ffb (Suc n) =  (ffb n)@r \<and> last r \<notin> (ev ` A)"
             by (metis append_self_conv last_append le_list_def less_list_def) 
           hence "trace_hide (ffb (Suc n)) (ev ` A) > trace_hide (ffb n) (ev ` A)"
             by (metis (no_types, lifting) a append_self_conv filter_append filter_empty_conv 
                                           last_in_set le_list_def less_list_def)
         }
         then show ?case by (metis (mono_tags, lifting) lift_Suc_mono_less_iff strict_monoI)
       next
         case 3
         then show ?case by (metis (mono_tags) elemTIselemHT ffbff ffc rangeE)  
       next
         case 4
         from ffbff ffc show ?case by (metis rangeE trace_hide_union)
       qed
     qed
   qed
 qed
 
 lemma Hiding_Un_D2: \<open>finite A \<Longrightarrow> \<D> ((P \ A) \ B) \<subseteq> \<D> (P \ (A \<union> B))\<close>
 proof (simp add:conj_commute D_Hiding, intro conjI subset_antisym subsetI, simp_all, goal_cases)
   case (1 x)
   then obtain t u where B1:"x = trace_hide t (ev ` B) @ u" 
                    and  B2:"tickFree t" 
                    and  B3:"front_tickFree u" 
-                   and  B4:"(t \<in> \<D> (P \\ A) \<or> 
-                            (\<exists>(f:: nat \<Rightarrow> 'a event list). isInfHiddenRun f (P \\ A) B \<and> t \<in> range f))" 
+                   and  B4:\<open>(t \<in> \<D> (P \ A) \<or> 
+                            (\<exists>(f:: nat \<Rightarrow> 'a event list). isInfHiddenRun f (P \ A) B \<and> t \<in> range f))\<close>
     by (simp add:D_Hiding) blast
   thus ?case
   proof(erule_tac disjE, auto simp add:D_Hiding, goal_cases)
     case (1 ta ua)
     then show ?case 
       by (rule_tac x=ta in exI, rule_tac x = "trace_hide ua (ev ` B) @ u" in exI, 
           auto simp add: front_tickFree_append tickFree_def)
   next
     case (2 ua f xa)
     then show ?case 
       apply(rule_tac x="f xa" in exI, rule_tac x="trace_hide ua (ev ` B) @ u" in exI, 
             intro conjI disjI2)
          apply(auto simp add: front_tickFree_append tickFree_def)
       by (rule_tac x="f" in exI) (metis (no_types) filter_filter rangeI)
   next
     case (3 f xx)
     note "3a" = 3
     then show ?case
-    proof(cases "\<exists>i. f i \<in> \<D> (P \\ A)")
+    proof(cases \<open>\<exists>i. f i \<in> \<D> (P \ A)\<close>)
       case True
       with 3 show ?thesis 
       proof(auto simp add:D_Hiding, goal_cases)
         case (1 i ta ua)
         then show ?case 
         apply (rule_tac x=ta in exI, rule_tac x="trace_hide ua (ev ` B) @ u" in exI, intro conjI)
            apply (metis (full_types) front_tickFree_append Hiding_tickFree tickFree_append)
           apply(subgoal_tac "trace_hide (f xx) (ev ` B) = trace_hide (f i) (ev ` B)", auto)
          apply (metis (full_types) filter_append filter_filter)
         by (metis (full_types) filter_append filter_filter)
       next
         case (2 i ua fa xa)
         hence "trace_hide (f xx) (ev ` B) = trace_hide (f i) (ev ` B)" by metis
         with 2 show ?case
           apply (rule_tac x="fa xa" in exI, rule_tac x="trace_hide ua (ev ` B) @ u" in exI, intro conjI)
              apply (metis (full_types) front_tickFree_append Hiding_tickFree tickFree_append)
             apply (simp_all) 
           apply(rule_tac disjI2, rule_tac x=fa in exI, auto)
           by (metis (no_types) filter_filter)      
       qed
     next
       case False
-      with 3 have Falsebis:"\<forall>i. (f i \<in> \<T> (P \\ A) \<and> f i \<notin> \<D> (P \\ A))" by blast
+      with 3 have Falsebis:\<open>\<forall>i. (f i \<in> \<T> (P \ A) \<and> f i \<notin> \<D> (P \ A))\<close> by blast
       with T_Hiding[of P A] D_Hiding[of P A] 
       have "\<forall>i. (f i \<in> {trace_hide t (ev ` A) |t. (t, ev ` A) \<in> \<F> P})" 
         by (metis (no_types, lifting) UnE)
       hence ff0:"\<forall>i. (\<exists>t. f i = trace_hide t (ev ` A) \<and> t \<in> \<T> P)" using F_T by fastforce
       define ff where ff1:"ff = (\<lambda>i. SOME t. f i = trace_hide t (ev ` A) \<and> t \<in> \<T> P)"
       hence "inj ff" unfolding inj_def by (metis (mono_tags, lifting) "3"(4) ff0 strict_mono_eq tfl_some)
       hence ff2:"infinite (range ff)" using finite_imageD by blast
       { fix tt i
         assume "tt \<in> range ff"
         then obtain k where "ff k = tt" using finite_nat_set_iff_bounded_le by blast
         hence kk0:"f k = trace_hide tt (ev ` A) \<and> tt \<in> \<T> P" using ff1 
           by (metis (mono_tags, lifting) ff0 someI_ex)
         hence "set (take i tt) \<subseteq> set (f i) \<union> (ev ` A)"
         proof(cases "k \<le> i")
           case True
           hence "set (f k) \<subseteq> set (f i)" 
             by (metis "3"(4) le_list_def set_append strict_mono_less_eq sup.cobounded1)
           moreover from kk0 have "set (take i tt) \<subseteq> set (f k) \<union> (ev ` A)" using in_set_takeD by fastforce
           ultimately show ?thesis by blast
         next
           case False
           have a:"length (f i) \<ge> i" by (meson "3"(4) dual_order.trans le_add1 length_strict_mono)
           have b:"f i \<le> f k" using "3"(4) False nat_le_linear strict_mono_less_eq by blast
           with a have c:"take i (f k) \<le> (f i)"
             by (metis append_eq_conv_conj le_add_diff_inverse le_list_def take_add)
           from kk0[THEN conjunct1] have c1:"f k = (trace_hide (take i tt) (ev ` A)) @
                                                   (trace_hide (drop i tt) (ev ` A))"
             by (metis append_take_drop_id filter_append)
           have "length (trace_hide (take i tt) (ev ` A)) \<le> i"
             by (metis length_filter_le length_take min.absorb2 nat_le_linear order.trans take_all)
           with c1 have "take i (f k) \<ge> (trace_hide (take i tt) (ev ` A))" by (simp add: le_list_def)
           with c obtain t where d:"f i = (trace_hide (take i tt) (ev ` A))@t"
             by (metis append.assoc le_list_def)
           then show ?thesis using in_set_takeD by fastforce
         qed
       } note ee=this
       { fix i
         have "finite {(take i t)|t. t \<in> range ff}" 
         proof(induct i, simp)
           case (Suc i)
           have ff:"{take (Suc i) t|t. t \<in> range ff} \<subseteq> {(take i t)|t. t \<in> range ff} \<union>
                       (\<Union>e\<in>(set (f (Suc i)) \<union> (ev ` A)). {(take i t)@[e]|t. t \<in> range ff})" (is "?AA \<subseteq> ?BB")
             proof
               fix t
               assume "t \<in> ?AA"
               then obtain t' where hh:"t' \<in> range ff \<and> t = take (Suc i) t'" 
                 using finite_nat_set_iff_bounded_le by blast
               with ee[of t'] show "t \<in> ?BB"
                 proof(cases "length t' > i")
                   case True
                   hence ii:"take (Suc i) t' = take i t' @ [t'!i]" by (simp add: take_Suc_conv_app_nth)
                   with ee[of t' "Suc i"] have "t'!i \<in> set (f (Suc i)) \<union> (ev ` A)" by (simp add: hh)
                   with ii hh show ?thesis by blast
                 next
                   case False
                   hence "take (Suc i) t' = take i t'" by fastforce
                   with hh show ?thesis by auto
                 qed
             qed
           { fix e 
             have "{x @ [e] |x. \<exists>t. x = take i t \<and> t \<in> range ff} = {take i t' @ [e] |t'. t' \<in> range ff}"
               by auto
             hence "finite({(take i t') @ [e] |t'. t'\<in>range ff})"
               using finite_image_set[of _ "\<lambda>t. t@[e]", OF Suc] by auto 
           } note gg=this
           have "finite(set (f (Suc i)) \<union> (ev ` A))" using 1(1) by simp
           with ff gg Suc show ?case by (metis (no_types, lifting) finite_UN finite_Un finite_subset)
         qed
       } note ff=this
       hence "\<forall>i. {take i t |t. t \<in> range ff} = {t. \<exists>t'. t = take i (ff t')}" by auto
       with KoenigLemma[of "range ff"] ff ff2
       obtain f' where gg:"strict_mono (f':: nat \<Rightarrow> 'a event list) \<and> 
                                             range f' \<subseteq> {t. \<exists>t'\<in>range ff. t \<le> t'}" by auto
       { fix i
         from gg obtain n where aa:"f' i \<le> ff n" by blast
         have "\<exists>t. f n = f 0 @ t" by (metis "3a"(4) le0 le_list_def strict_mono_less_eq)
         with mono_trace_hide[OF aa, of A] ff0 ff1 have "\<exists>t. trace_hide (f' i) (ev ` A) \<le> f 0 @ t" 
           by (metis (mono_tags, lifting) someI_ex)
       } note zz=this
       {
         define ff' where "ff' = (\<lambda>i. trace_hide (f' i) (ev ` A))"
         with gg have "mono ff'"
           by (rule_tac monoI, simp add: mono_trace_hide strict_mono_less_eq)
         assume aa:"\<forall>i. trace_hide (f' i) (ev ` A) \<le> f 0"
         with aa mono_constant have "\<exists>i. \<forall>j\<ge>i. ff' j = ff' i" using \<open>mono ff'\<close> ff'_def by blast
         then obtain m where bb:"\<forall>j\<ge>m. ff' j = ff' m" by blast
-        have "ff' m \<in> \<D> (P \\ A)" 
-        proof(simp add:D_Hiding, rule_tac x="f' m" in exI, rule_tac x="[]" in exI, intro conjI, simp, goal_cases)
+        have \<open>ff' m \<in> \<D> (P \ A)\<close> 
+        proof(simp add:D_Hiding, rule_tac x="f' m" in exI, rule_tac x="[]" in exI, 
+              intro conjI, simp, goal_cases)
           case 1
           from gg have "f' m < f' (Suc m)" by (meson lessI strict_monoD)
           moreover from gg obtain k where "f' (Suc m) \<le> ff k" by blast
           moreover have "ff k \<in> \<T> P" by (metis (mono_tags, lifting) ff0 ff1 someI_ex)
           ultimately show ?case
           by (metis NF_NT append_Nil2 front_tickFree_mono is_processT le_list_def less_list_def)
         next
           case 2
           then show ?case unfolding ff'_def by simp
         next
           case 3
           then show ?case
           proof(rule disjI2, rule_tac x="\<lambda>i. f' (m + i)" in exI, simp_all, intro conjI allI, goal_cases)
             case 1
             show ?case using gg[THEN conjunct1] 
               by (rule_tac strict_monoI, simp add: strict_monoD) 
           next
             case (2 i)
             from gg obtain k where "f' (m + i) \<le> ff k" by blast
             moreover from ff0 ff1 have "ff k \<in> \<T> P" by (metis (mono_tags, lifting) someI_ex)
             ultimately have "f' (m + i) \<in> \<T> P" using is_processT3_ST_pref by blast
             then show ?case by (simp add: add.commute)
           next
             case (3 i)
             then show ?case using bb[THEN spec, of "m+i", simplified] unfolding ff'_def by assumption
           next
             case 4
             then show ?case by (metis Nat.add_0_right rangeI) 
           qed
         qed 
         with gg False have "False"
           by (metis (no_types, lifting) Falsebis aa append_Nil2 ff'_def front_tickFree_mono 
                                         is_processT is_processT2_TR le_list_def) 
       }
       with zz obtain m where hh:"trace_hide (f' m) (ev ` A) \<ge> f 0"
         unfolding le_list_def by (metis append_eq_append_conv2)
       from ff0 ff1 gg show ?thesis
       proof(auto simp add:T_Hiding, rule_tac x="f' m" in exI, rule_tac x=u in exI, 
                           intro conjI, simp_all add:3(3), goal_cases)
         case 1
         hence "f' m < f' (Suc m)" by (meson lessI strict_monoD)
         moreover from gg obtain k where "f' (Suc m) \<le> ff k" by blast
         moreover have "ff k \<in> \<T> P" by (metis (mono_tags, lifting) ff0 ff1 someI_ex)
         ultimately show ?case
           by (metis NF_NT append_Nil2 front_tickFree_mono is_processT le_list_def less_list_def)
       next
         case 2
         from gg obtain k where "f' m \<le> ff k" by blast
         with ff0 ff1 mono_trace_hide[of "f' m"] have "trace_hide (f' m) (ev ` A) \<le> f k" 
           by (metis (mono_tags, lifting) someI_ex)
         with mono_trace_hide[OF this, of B] mono_trace_hide[OF hh, of B] 3(6)[THEN spec, of k] 3(6)
         show ?case by (metis (full_types) dual_order.antisym filter_filter)
       next
         case 3 show ?case 
         proof(rule disjI2, rule_tac x="\<lambda>i. f' (m + i)" in exI, simp_all, intro conjI allI, goal_cases)
           case 1
           then show ?case by (metis Nat.add_0_right rangeI) 
         next
           case 2 with 3(4) show ?case 
             by (rule_tac strict_monoI, simp add: strict_monoD)
         next
           case (3 i)
           from gg obtain k where "f' (m + i) \<le> ff k" by blast
           moreover from ff0 ff1 have "ff k \<in> \<T> P" by (metis (mono_tags, lifting) someI_ex)
           ultimately have "f' (m + i) \<in> \<T> P" using is_processT3_ST_pref by blast
           then show ?case by (simp add: add.commute)
         next
           case (4 i)
           from gg obtain k where "f' (m + i) \<le> ff k" by blast
           with ff0 ff1 mono_trace_hide[of "f' (m + i)"] have ll:"trace_hide (f' (m + i)) (ev ` A) \<le> f k" 
             by (metis (mono_tags, lifting) someI_ex)
           { fix a b c assume "(a::'a event list) \<le> b" and "b \<le> c" and "c \<le> a" hence "b = c" by auto}
           note jj=this
           from jj[OF mono_trace_hide[OF hh, of B],
                   OF mono_trace_hide[THEN mono_trace_hide, of "f' m" "f' (m + i)" B A, 
                                OF gg[THEN conjunct1, THEN strict_mono_mono, 
                                THEN monoD, of "m" "m+i", simplified]]]
                mono_trace_hide[OF ll, of B]
           show ?case unfolding "3a"(6) [THEN spec, of k] by simp
         qed
       qed
     qed
   qed
 qed
 
 lemma Hiding_Un_D: \<open>finite A \<Longrightarrow> \<D> ((P \ A) \ B) = \<D> (P \ (A \<union> B))\<close>
   using Hiding_Un_D1 Hiding_Un_D2 by blast
  
 subsection\<open> Laws \<close>
 
 lemma mono_Hiding_FD[simp]: \<open>P \<le> Q \<Longrightarrow> P \ A \<le> Q \ A\<close>
   apply (auto simp: le_ref_def F_Hiding D_Hiding) 
   using F_subset_imp_T_subset by blast+
 
 lemmas mono_Hiding_ref = mono_Hiding
 
 lemma Hiding_Un: \<open>finite A \<Longrightarrow> P \ (A \<union> B) = (P \ A) \ B\<close>
 proof (simp add:Process_eq_spec, intro conjI, unfold F_Hiding, goal_cases)
   case 1
   thus ?case (is "{(s, X). ?A s X} \<union> {(s, X). ?B s} = 
                   {(s, X). (\<exists>t. (?C1 s t \<and> (t, X \<union> ev ` B) \<in> ?C2 \<union> ?C3))} \<union> {(s, X). ?D s}")
   proof(unfold F_Hiding set_eq_subset Un_subset_iff, intro conjI, goal_cases)
     case 1
     then show ?case
       by (auto, metis (no_types) filter_filter image_Un sup_commute sup_left_commute)
   next
     case 2
     then show ?case 
       by (rule_tac Un_mono[of "{}", simplified], insert Hiding_Un_D[of A P B], simp add: D_Hiding)
   next
     case 3
     have "{(s, X). (\<exists>t. (?C1 s t \<and> (t, X \<union> ev ` B) \<in> ?C2))} \<subseteq> {(s, X). ?A s X}" 
       by (auto, metis (no_types) filter_filter image_Un sup_commute sup_left_commute)
     moreover have "{(s, X). (\<exists>t. (?C1 s t \<and> (t, X \<union> ev ` B) \<in> ?C3))} \<subseteq> {(s, X). ?B s}"
     proof(auto,goal_cases)
       case (1 ta u)
       then show ?case using Hiding_fronttickFree by blast
     next
       case (2 u f x)
       then show ?case 
          apply(rule_tac x="f x" in exI, rule_tac x="trace_hide u (ev ` B)" in exI, auto)
          using Hiding_fronttickFree apply blast
         apply(erule_tac x=f in allE) by (metis (no_types) filter_filter rangeI)
     qed
     moreover have "{(s, X). (\<exists>t. (?C1 s t \<and> (t, X \<union> ev ` B) \<in> ?C2 \<union> ?C3))} = 
                                   {(s, X). (\<exists>t. (?C1 s t \<and> (t, X \<union> ev ` B) \<in> ?C2 ))} \<union> 
                                   {(s, X). (\<exists>t. (?C1 s t \<and> (t, X \<union> ev ` B) \<in> ?C3))}" by blast 
     ultimately show ?case by (metis (no_types, lifting) Un_mono) 
   next
     case 4
     then show ?case  
       by (rule_tac Un_mono[of "{}", simplified], insert Hiding_Un_D[of A P B], simp add:D_Hiding)
   qed
 next
   case 2
   then show ?case by (simp add: Hiding_Un_D)
 qed
 
-lemma Hiding_set_BOT: "(\<bottom> \\ A) = \<bottom>"
+lemma Hiding_set_BOT: \<open>(\<bottom> \ A) = \<bottom>\<close>
   apply(auto simp add:Process_eq_spec D_Hiding F_Hiding F_UU D_UU)
         using Hiding_fronttickFree apply blast
        using front_tickFree_append Hiding_tickFree apply blast
       using front_tickFree_append Hiding_tickFree apply blast
      apply (metis (full_types) append_Nil filter.simps(1) tickFree_Nil tickFree_implies_front_tickFree)
     using front_tickFree_append Hiding_tickFree apply blast 
    using front_tickFree_append Hiding_tickFree apply blast
   using tickFree_Nil by fastforce 
 
-lemma Hiding_set_STOP: "(STOP \\ A) = STOP"
+lemma Hiding_set_STOP: \<open>(STOP \ A) = STOP\<close>
   apply(auto simp add:Process_eq_spec D_Hiding F_Hiding F_STOP D_STOP T_STOP)
   by (metis (full_types) lessI less_irrefl strict_mono_eq) +
 
-lemma Hiding_set_SKIP: "(SKIP \\ A) = SKIP"  
+lemma Hiding_set_SKIP: \<open>(SKIP \ A) = SKIP\<close> 
   apply(auto simp add:Process_eq_spec D_Hiding F_Hiding F_SKIP D_SKIP T_SKIP split:if_splits)
        apply (metis filter.simps(1) non_tickFree_tick)
       apply (metis (full_types) Hiding_tickFree n_not_Suc_n non_tickFree_tick strict_mono_eq)
      apply (metis (full_types) Hiding_tickFree n_not_Suc_n non_tickFree_tick strict_mono_eq)
     apply (metis event.distinct(1) filter.simps(1) imageE)
    apply (metis event.distinct(1) filter.simps(1) filter.simps(2) imageE)
   by (metis (full_types) Hiding_tickFree n_not_Suc_n non_tickFree_tick strict_mono_eq)
 
-lemma Hiding_set_empty: "(P \\ {}) = P"
+lemma Hiding_set_empty: \<open>(P \ {}) = P\<close>
   apply(auto simp add:Process_eq_spec D_Hiding F_Hiding is_processT7 is_processT8_S strict_mono_eq)
   by (metis append_Nil2 front_tickFree_implies_tickFree front_tickFree_single is_processT 
             nonTickFree_n_frontTickFree)
 
 subsection\<open> Multi-Operators laws  \<close>
 
-lemma Hiding_Ndet: "(P \<sqinter> Q) \\ A = ((P \\ A) \<sqinter> (Q \\ A))"  
+lemma Hiding_Ndet: \<open>(P \<sqinter> Q) \ A = ((P \ A) \<sqinter> (Q \ A))\<close>  
 proof(auto simp add:Process_eq_spec D_Hiding F_Hiding, 
       simp_all add: F_Ndet T_Ndet D_Ndet D_Hiding F_Hiding, goal_cases)
   case (1 b t)
   then show ?case by blast
 next
   case (2 b t u)
   then show ?case by blast
 next
   case (3 b u f x)
   from 3(4) have A:"infinite ({i. f i \<in> \<T> P}) \<or> infinite ({i. f i \<in> \<T> Q})"
     using finite_nat_set_iff_bounded by auto
   hence "(\<forall>i. f i \<in> \<T> P) \<or> (\<forall>i. f i \<in> \<T> Q)" 
     by (metis (no_types, lifting) 3(3) finite_nat_set_iff_bounded 
             is_processT3_ST_pref mem_Collect_eq not_less strict_mono_less_eq)
   with A show ?case by (metis (no_types, lifting) 3(1,2,3,5) rangeI)
 next
   case (4 a b)
   then show ?case by blast
 next
   case (5 t u)
   then show ?case by blast
 next
   case (6 u f x)
   from 6(4) have A:"infinite ({i. f i \<in> \<T> P}) \<or> infinite ({i. f i \<in> \<T> Q})"
     using finite_nat_set_iff_bounded by auto
   hence "(\<forall>i. f i \<in> \<T> P) \<or> (\<forall>i. f i \<in> \<T> Q)" 
     by (metis (no_types, lifting) 6(3) finite_nat_set_iff_bounded 
             is_processT3_ST_pref mem_Collect_eq not_less strict_mono_less_eq)
   with A show ?case by (metis (no_types, lifting) 6(1,2,3,5) rangeI)
 next
   case (7 x)
   then show ?case by blast
 qed
 
 lemma Hiding_Mprefix_distr: 
-  "(B \<inter> A) = {} \<Longrightarrow> ((Mprefix A P) \\ B) = (Mprefix A (\<lambda>x. ((P x) \\ B)))"
+  \<open>(B \<inter> A) = {} \<Longrightarrow> ((Mprefix A P) \ B) = (Mprefix A (\<lambda>x. ((P x) \ B)))\<close>
 proof (auto simp add: Process_eq_spec, 
      simp_all add: F_Mprefix T_Mprefix D_Mprefix D_Hiding F_Hiding,
      goal_cases)
   case (1 x b) then show ?case
   proof(elim exE disjE conjE, goal_cases)
     case (1 t)
     then show ?case by (simp add: inf_sup_distrib2)
   next
     case (2 t a)
     then show ?case 
       by (metis (no_types, lifting) disjoint_iff_not_equal event.inject filter.simps(2) 
                                     imageE list.sel(1) list.sel(3) list.collapse neq_Nil_conv)
   next
     case (3 t u a)    
     hence "hd t \<notin> ev ` B" by force
     with 3 have"x = hd t # trace_hide (tl t) (ev ` B) @ u"
       by (metis append_Cons filter.simps(2) list.exhaust_sel)
     with 3 show ?case by (metis list.distinct(1) list.sel(1) list.sel(3) tickFree_tl) 
   next
     case (4 t u f)
     then obtain k where kk:"t = f k" by blast
     from 4 obtain a where "f 1 \<noteq> [] \<and> ev a = hd (f 1)" and aa:"a \<in> A"
       by (metis less_numeral_extra(1) nil_le not_less strict_mono_less_eq) 
     with 4(1) 4(6)[THEN spec, of 0] 4(7)[THEN spec, of 1] have "f 0 \<noteq> [] \<and> hd (f 0) = ev a" 
       apply auto 
         apply (metis (no_types, lifting) disjoint_iff_not_equal event.inject 
                                          filter.simps(2) hd_Cons_tl imageE list.distinct(1))
        apply (metis (no_types, lifting) disjoint_iff_not_equal event.inject filter.simps(2) 
                                         hd_Cons_tl imageE list.distinct(1)) 
       by (metis (no_types, lifting) disjoint_iff_not_equal event.inject filter.simps(2)
                                     hd_Cons_tl imageE list.sel(1))
     with 4(1, 7) aa have nf: "\<forall>i. f i \<noteq> [] \<and> hd (f i) = ev a"    
       by (metis (mono_tags, opaque_lifting) "4"(5) append_Cons le_list_def le_simps(2) list.distinct(1) 
                 list.exhaust_sel list.sel(1) neq0_conv old.nat.distinct(1) strict_mono_less_eq) 
     with 4(5) have sm:"strict_mono (tl \<circ> f)" by (simp add: less_tail strict_mono_def)
     with 4 aa kk nf show ?case
       apply(rule_tac disjI2, intro conjI) 
         apply (metis (no_types, lifting) Nil_is_append_conv disjoint_iff_not_equal event.inject 
                                           filter.simps(2) hd_Cons_tl imageE list.distinct(1))
        apply (metis (no_types, lifting) disjoint_iff_not_equal event.inject filter.simps(2) 
                                         hd_Cons_tl hd_append2 image_iff list.distinct(1) list.sel(1))
       apply(rule_tac x=a in exI, intro conjI disjI2) 
        apply (metis disjoint_iff_not_equal event.inject filter.simps(2) 
                     hd_Cons_tl hd_append2 image_iff list.distinct(1) list.sel(1))
      apply(rule_tac x="tl t" in exI, rule_tac x="u" in exI, intro conjI, simp_all) 
         apply (metis tickFree_tl)
        apply (metis (no_types, lifting) disjoint_iff_not_equal event.inject filter.simps(2) 
                                         hd_Cons_tl imageE list.distinct(1) list.sel(3) tl_append2)
       apply(subst disj_commute, rule_tac disjCI)
       apply(rule_tac x="tl \<circ> f" in exI, intro conjI)
          apply auto         
       apply (metis (no_types, lifting) filter.simps(2) hd_Cons_tl list.sel(3))
       done
   qed
 next
   case (2 x b)
   then show ?case proof(elim exE disjE conjE, goal_cases)
     case 1 then show ?case 
       apply(rule_tac disjI1, rule_tac x="[]" in exI) 
       by (simp add: disjoint_iff_not_equal inf_sup_distrib2)
   next
     case (2 a t) then show ?case 
       apply(rule_tac disjI1, rule_tac  x="(ev a)#t" in exI) 
       using list.collapse by fastforce
   next
     case (3 a t u)
     then show ?case 
       apply(rule_tac disjI2, rule_tac  x="(ev a)#t" in exI, rule_tac x=u in exI) 
       using list.collapse by fastforce
   next
     case (4 a t u f)
     then show ?case 
       apply(rule_tac disjI2)        
       apply(rule_tac x="(ev a) # t" in exI, rule_tac x="u" in exI, intro conjI, simp)
         apply auto[1]
        using hd_Cons_tl apply fastforce
       apply(rule_tac disjI2, rule_tac x="\<lambda>i. (ev a) # (f i)" in exI)
       by (auto simp add: less_cons strict_mono_def)
   qed
 next
   case (3 x) then show ?case
   proof(elim exE disjE conjE, goal_cases)
     case (1 t u a)
     hence aa: "hd (trace_hide t (ev ` B)) = ev a \<and> trace_hide t (ev ` B) \<noteq> []"
       by (metis (no_types, lifting) disjoint_iff_not_equal event.inject filter.simps(2) hd_Cons_tl 
                                     imageE list.distinct(1) list.sel(1))
     with 1 have  "hd x = ev a \<and> x \<noteq> []" by simp 
     with 1 show ?case 
       apply(intro conjI, simp_all, rule_tac x=a in exI, simp)
       apply(rule_tac x="tl t" in exI, rule_tac x="u" in exI, intro conjI, simp_all)
        using tickFree_tl apply blast
        using aa by (metis (no_types, lifting) disjoint_iff_not_equal event.inject filter.simps(2) 
                           hd_Cons_tl imageE list.sel(3) tl_append2)
   next
     case (2 t u f)
     then obtain k where kk:"t = f k" by blast
     from 2 obtain a where "f 1 \<noteq> [] \<and> ev a = hd (f 1)" and aa:"a \<in> A"
       by (metis less_numeral_extra(1) nil_le not_less strict_mono_less_eq) 
     with 2(1) 2(6)[THEN spec, of 0] 2(7)[THEN spec, of 1] have "f 0 \<noteq> [] \<and> hd (f 0) = ev a" 
       apply auto 
         apply (metis (no_types, lifting) disjoint_iff_not_equal event.inject 
                                          filter.simps(2) hd_Cons_tl imageE list.distinct(1))
        apply (metis (no_types, lifting) disjoint_iff_not_equal event.inject filter.simps(2) 
                                         hd_Cons_tl imageE list.distinct(1)) 
       by (metis (no_types, lifting) disjoint_iff_not_equal event.inject filter.simps(2)
                                     hd_Cons_tl imageE list.sel(1))
     with 2(1, 7) aa have nf: "\<forall>i. f i \<noteq> [] \<and> hd (f i) = ev a"    
       by (metis (mono_tags, opaque_lifting) 2(5) append_Cons le_list_def le_simps(2) list.distinct(1) 
                 list.exhaust_sel list.sel(1) neq0_conv old.nat.distinct(1) strict_mono_less_eq) 
     with 2(5) have sm:"strict_mono (tl \<circ> f)" by (simp add: less_tail strict_mono_def)
     from 2(1,4) nf aa kk have x1:"x \<noteq> []"
       by (metis Nil_is_append_conv disjoint_iff_not_equal event.inject filter.simps(2) 
                 hd_Cons_tl imageE list.distinct(1))
     with 2(1,4) nf aa kk have x2: "hd (trace_hide t (ev ` B)) = ev a \<and> trace_hide t (ev ` B) \<noteq> []"
       by (metis (no_types, lifting) disjoint_iff_not_equal event.inject filter.simps(2) hd_Cons_tl 
                                     imageE list.distinct(1) list.sel(1))
     with 2(1,4) nf aa kk x1 have x3:"hd x = ev a" by simp    
     with 2 aa kk nf sm x1  show ?case
       apply(intro conjI, simp_all)
      apply(rule_tac x="tl t" in exI, rule_tac x="u" in exI, intro conjI, simp_all) 
         apply (metis tickFree_tl)
        apply (metis (no_types, lifting) disjoint_iff_not_equal event.inject filter.simps(2) 
                                         hd_Cons_tl imageE list.distinct(1) list.sel(3) tl_append2)
       apply(subst disj_commute, rule_tac disjCI)
       apply(rule_tac x="tl \<circ> f" in exI, intro conjI)
          apply auto         
        apply (metis (no_types, lifting) filter.simps(2) hd_Cons_tl list.sel(3))
       by (metis (no_types, lifting) filter.simps(2) hd_Cons_tl list.sel(3))
   qed
 next
   case (4 x) then show ?case
   proof(elim exE disjE conjE, goal_cases)
     case (1 a t u)
     then show ?case
       apply(rule_tac  x="(ev a)#t" in exI, rule_tac x=u in exI) 
       using list.collapse by fastforce
   next
     case (2 a t u f) 
     then show ?case 
       apply(rule_tac x="(ev a) # t" in exI, rule_tac x="u" in exI, intro conjI, simp_all)
         apply auto[1]
        using hd_Cons_tl apply fastforce
       apply(rule_tac disjI2, rule_tac x="\<lambda>i. (ev a) # (f i)" in exI)
       by (auto simp add: less_cons strict_mono_def)
   qed
 qed
 
-lemma no_Hiding_read: "(\<forall>y. c y \<notin> B) \<Longrightarrow> ((c\<^bold>?x \<rightarrow> (P x)) \\ B) = (c\<^bold>?x \<rightarrow> ((P x) \\ B))"
+lemma no_Hiding_read: \<open>(\<forall>y. c y \<notin> B) \<Longrightarrow> ((c\<^bold>?x \<rightarrow> (P x)) \ B) = (c\<^bold>?x \<rightarrow> ((P x) \ B))\<close>
   by (simp add: read_def o_def, subst Hiding_Mprefix_distr, auto)
 
-lemma no_Hiding_write0: "a \<notin> B \<Longrightarrow> ((a \<rightarrow> P) \\ B) = (a \<rightarrow> (P \\ B))"
+lemma no_Hiding_write0: \<open>a \<notin> B \<Longrightarrow> ((a \<rightarrow> P) \ B) = (a \<rightarrow> (P \ B))\<close>
   by (simp add: Hiding_Mprefix_distr write0_def)
 
-lemma Hiding_write0: "a \<in> B  \<Longrightarrow> ((a \<rightarrow> P) \\ B) = (P \\ B)"
+lemma Hiding_write0: \<open>a \<in> B  \<Longrightarrow> ((a \<rightarrow> P) \ B) = (P \ B)\<close>
 proof (auto simp add: write0_def Process_eq_spec, 
        simp_all add: F_Mprefix T_Mprefix D_Mprefix D_Hiding F_Hiding,
        goal_cases)
   case (1 x b)
   then show ?case
     apply(elim exE disjE conjE)
       apply (metis filter.simps(2) hd_Cons_tl image_eqI)
      apply (metis (no_types, lifting) filter.simps(2) image_eqI list.sel(1) 
                                       list.sel(3) neq_Nil_conv tickFree_tl)
   proof(goal_cases)
     case (1 t u f)
     have fS: "strict_mono (f \<circ> Suc)" by (metis "1"(5) Suc_mono comp_def strict_mono_def)
     from  1 have aa:"\<forall>i. f (Suc i) \<noteq> []"
       by (metis (full_types) less_Suc_eq_le less_irrefl nil_le strict_mono_less_eq)      
     with fS have sm:"strict_mono (tl \<circ> f \<circ> Suc)" by (simp add: less_tail strict_mono_def)
     with 1 aa show ?case
       apply(subst disj_commute, rule_tac disjCI, simp)        
       apply(rule_tac x="tl (f 1)" in exI, rule_tac x="u" in exI, intro conjI, simp_all) 
         apply (metis Hiding_tickFree imageE tickFree_tl)
       apply (metis (no_types, lifting) filter.simps(2) hd_Cons_tl image_eqI rangeE)
       apply(subst disj_commute, rule_tac disjCI)        
       apply(rule_tac x="tl \<circ> f \<circ> Suc" in exI, intro conjI)
          apply auto
          apply (metis (no_types, lifting) filter.simps(2) hd_Cons_tl list.sel(3))
       done
   qed
 next
   case (2 aa b)
   then show ?case     
     apply(elim exE disjE conjE)
       apply (metis (no_types, lifting) filter.simps(2) image_eqI list.distinct(1) 
                                         list.sel(1) list.sel(3))
   proof(goal_cases)
     case (1 t u)
     then show ?case by (rule_tac disjI2, rule_tac x="(ev a)#t" in exI, auto)
   next
     case (2 t u f)
     then show ?case
       apply(rule_tac disjI2)         
       apply(rule_tac x="(ev a) # t" in exI, rule_tac x="u" in exI, intro conjI, simp_all)
       apply(rule_tac disjI2)       
       apply(rule_tac x="\<lambda>i. (ev a) # (f i)" in exI, intro conjI)
       by (auto simp add: less_cons strict_mono_def)
   qed
 next
   case (3 x)
   then show ?case 
     apply(elim exE disjE conjE)
      apply(rule_tac x="tl t" in exI, rule_tac x="u" in exI, intro conjI, simp_all)
     using tickFree_tl apply blast
      apply (metis filter.simps(2) hd_Cons_tl image_eqI)
   proof(goal_cases)
     case (1 t u f)
     have fS: "strict_mono (f \<circ> Suc)" by (metis "1"(5) Suc_mono comp_def strict_mono_def)
     from  1 have aa:"\<forall>i. f (Suc i) \<noteq> []"
       by (metis (full_types) less_Suc_eq_le less_irrefl nil_le strict_mono_less_eq)      
     with fS have sm:"strict_mono (tl \<circ> f \<circ> Suc)" by (simp add: less_tail strict_mono_def)
     with 1 aa show ?case
       apply(rule_tac x="tl (f 1)" in exI, rule_tac x="u" in exI, intro conjI, simp_all) 
         apply (metis Hiding_tickFree imageE tickFree_tl)
       apply (metis (no_types, lifting) filter.simps(2) hd_Cons_tl image_eqI rangeE)
       apply(subst disj_commute, rule_tac disjCI)        
       apply(rule_tac x="tl \<circ> f \<circ> Suc" in exI, intro conjI)
          apply auto
          apply (metis (no_types, lifting) filter.simps(2) hd_Cons_tl list.sel(3))
       done
   qed
 next
   case (4 x)
   then show ?case
     apply(elim exE disjE conjE)
   proof(goal_cases)
     case (1 t u)
     then show ?case by (rule_tac x="(ev a)#t" in exI, auto)
   next
     case (2 t u f)
     then show ?case
       apply(rule_tac x="(ev a) # t" in exI, rule_tac x="u" in exI, intro conjI, simp_all)
       apply(rule_tac disjI2)       
       apply(rule_tac x="\<lambda>i. (ev a) # (f i)" in exI, intro conjI)
       by (auto simp add: less_cons strict_mono_def)
   qed
 qed
 
-lemma no_Hiding_write: "(\<forall>y. c y \<notin> B) \<Longrightarrow> ((c\<^bold>!a \<rightarrow> P) \\ B) = (c\<^bold>!a \<rightarrow> (P \\ B))"
+lemma no_Hiding_write: \<open>(\<forall>y. c y \<notin> B) \<Longrightarrow> ((c\<^bold>!a \<rightarrow> P) \ B) = (c\<^bold>!a \<rightarrow> (P \ B))\<close>
   by(simp add: write_def, subst Hiding_Mprefix_distr, auto)
 
-lemma Hiding_write: "(c a) \<in> B ==> ((c\<^bold>!a \<rightarrow> P) \\ B) = (P \\ B)"
+lemma Hiding_write: \<open>(c a) \<in> B \<Longrightarrow> ((c\<^bold>!a \<rightarrow> P) \ B) = (P \ B)\<close>
   by (simp add: write_def Hiding_write0 Mprefix_singl)
 
 
 section\<open> The Sync Operator Laws \<close>  
 
 subsection\<open> Preliminaries \<close>
 
 lemma SyncTlEmpty:"a setinterleaves (([], u), A) \<Longrightarrow> tl a setinterleaves (([], tl u), A)"
   by (case_tac u, simp, case_tac a, simp_all split:if_splits)
 
 lemma SyncHd_Tl: 
    "a setinterleaves ((t, u), A) \<and> hd t \<in> A \<and> hd u \<notin> A
     \<Longrightarrow> hd a = hd u \<and> tl a setinterleaves ((t, tl u), A)"
   by (case_tac u) (case_tac t, auto split:if_splits)+
  
 lemma SyncHdAddEmpty: 
    "(tl a) setinterleaves (([], u), A) \<and> hd a \<notin> A \<and> a \<noteq> [] 
     \<Longrightarrow> a setinterleaves (([], hd a # u), A)"  
   using hd_Cons_tl by fastforce 
 
 lemma SyncHdAdd: 
   "(tl a) setinterleaves ((t, u), A) \<and> hd a \<notin> A \<and> hd t \<in> A \<and> a \<noteq> [] 
    \<Longrightarrow> a setinterleaves ((t, hd a # u), A)" 
   by (case_tac a, simp, case_tac t, auto) 
 
 lemmas SyncHdAdd1 = SyncHdAdd[of "a#r", simplified] for a r
 
 lemma SyncSameHdTl:
   "a setinterleaves ((t, u), A) \<and> hd t \<in> A \<and> hd u \<in> A
    \<Longrightarrow> hd t = hd u \<and> hd a = hd t \<and> (tl a) setinterleaves ((tl t, tl u), A)"
   by (case_tac u) (case_tac t, auto split:if_splits)+
 
 lemma SyncSingleHeadAdd: 
    "a setinterleaves ((t, u), A) \<and> h \<notin> A
     \<Longrightarrow> (h#a) setinterleaves ((h#t, u), A)"
   by (case_tac u, auto split:if_splits)
 
 lemma TickLeftSync:
    "tick \<in> A \<and> front_tickFree t \<and> s setinterleaves (([tick], t), A) \<Longrightarrow> s = t \<and> last t = tick"
 proof(induct t arbitrary: s)
   case Nil
   then show ?case by (simp add: Nil.prems)
 next
   case (Cons a t)
   then show ?case
     apply (auto split:if_splits)
       using emptyLeftProperty apply blast
      apply (metis last_ConsR last_snoc nonTickFree_n_frontTickFree tickFree_Cons)
     by (metis append_Cons append_Nil front_tickFree_mono)+
 qed  
   
 lemma EmptyLeftSync:"s setinterleaves (([], t), A) \<Longrightarrow> s = t \<and> set t \<inter> A = {}"
   by (meson Int_emptyI emptyLeftNonSync emptyLeftProperty)
 
 lemma tick_T_F:"t@[tick] \<in> \<T> P \<Longrightarrow> (t@[tick], X) \<in> \<F> P"
   using append_T_imp_tickFree is_processT5_S7 by force
 
 lemma event_set: "(e::'a event) \<in> insert tick (range ev)"
   by (metis event.exhaust insert_iff rangeI)
 
 lemma Mprefix_Sync_distr1_D: 
   " A \<subseteq> S 
     \<Longrightarrow> B \<subseteq> S 
     \<Longrightarrow>  \<D> (Mprefix A P \<lbrakk>S\<rbrakk> Mprefix B Q) =  \<D> (\<box> x \<in>  A \<inter> B \<rightarrow> (P x \<lbrakk>S\<rbrakk> Q x))"  
   apply(auto,simp_all add:D_Sync F_Sync F_Mprefix T_Mprefix D_Mprefix)  
    apply(elim exE disjE conjE)  
           apply (metis (no_types, lifting) Sync.sym empty_iff image_iff insertI2 
                        list.exhaust_sel setinterleaving.simps(2) subsetCE)
 proof(goal_cases)
   case (1 x t u r v a aa)
   from 1(1,2,6,8,11,13) have aa1: "hd t\<in>insert tick (ev ` S)\<and>hd u\<in>insert tick (ev ` S)"   
     by blast
   from 1(5,6,7,8,11,13) aa1 have aa2: " hd x \<in> ev ` (A \<inter> B)"  
-    by (metis (no_types, lifting) IntI empty_setinterleaving event.inject hd_append2 image_iff SyncSameHdTl)
+    by (metis (no_types, lifting) IntI empty_setinterleaving event.inject 
+                                  hd_append2 image_iff SyncSameHdTl)
   then show ?case  
     using 1(3,4,5,6,7,9,10,13,14) by (metis (no_types, lifting)  Nil_is_append_conv aa1 
                                             empty_setinterleaving event.inject hd_append2 
                                             SyncSameHdTl tickFree_tl tl_append2)
 next
   case (2 x t u r v a)
   then show ?case      
     by (metis (no_types, lifting) Sync.si_empty3 equals0D imageE image_eqI insertI2 list.exhaust_sel subsetCE) 
 next
   case (3 x t u r v a aa)
   from 3(1,2,6,8,11,13) have aa1: "hd t\<in>insert tick (ev ` S)\<and>hd u\<in>insert tick (ev ` S)"   
     by blast
   from 3(5,6,7,8,11,13) aa1 have aa2: " hd x \<in> ev ` (A \<inter> B)"  
     by (metis (no_types, lifting) IntI empty_setinterleaving event.inject hd_append2 image_iff SyncSameHdTl)
   then show ?case 
     using 3(3,4,5,6,7,9,10,13,14) 
     by (metis (no_types, lifting)  Nil_is_append_conv aa1 empty_setinterleaving event.inject 
                                    hd_append2 SyncSameHdTl  tickFree_tl tl_append2) 
 next
   case (4 x t u r v a)
   then show ?case        
     by (metis (no_types, lifting) Sync.si_empty3 equals0D imageE image_eqI insertI2 list.exhaust_sel subsetCE)  
 next
   case (5 x t u r v a aa)
   from 5(1,2,6,8,11,13) have aa1: "hd t\<in>insert tick (ev ` S)\<and>hd u\<in>insert tick (ev ` S)"   
     by blast
   from 5(5,6,7,8,11,13) aa1 have aa2: " hd x \<in> ev ` (A \<inter> B)"  
     by (metis (no_types, lifting) IntI empty_setinterleaving event.inject hd_append2 image_iff SyncSameHdTl)
   then show ?case 
     using 5(3,4,5,6,7,9,10,13,14) by (metis  aa1 append_Nil2 empty_setinterleaving event.inject SyncSameHdTl)   
 next
   case (6 x t u r v a)
   then show ?case       
     by (metis (no_types, lifting) Sync.si_empty3 equals0D imageE image_eqI insertI2 list.exhaust_sel subsetCE) 
 next
   case (7 x t u r v a aa)
   from 7(1,2,6,8,11,13) have aa1: "hd t\<in>insert tick (ev ` S)\<and>hd u\<in>insert tick (ev ` S)"   
     by blast
   from 7(5,6,7,8,11,13) aa1 have aa2: " hd x \<in> ev ` (A \<inter> B)"  
     by (metis (no_types, lifting) IntI empty_setinterleaving event.inject hd_append2 image_iff SyncSameHdTl)
   then show ?case  
       using 7(3,4,5,6,7,9,10,13,14) by (metis  aa1 append_Nil2 empty_setinterleaving event.inject SyncSameHdTl) 
 next
   case (8 x)
   then show ?case 
     apply(elim exE disjE conjE)  
   proof(goal_cases)
     case (1 a t u r v)
     obtain r1 t1 u1 where aa0: "r1=hd x#r\<and>t1=hd x#t\<and>u1=hd x#u" 
       by auto
     from 1(3,4,5,7,8,9) have aa1: "tickFree r1\<and>x = r1 @ v" 
       by (metis  Cons_eq_appendI aa0 event.distinct(1) list.exhaust_sel tickFree_Cons)
     from 1(2,4,9) have aa2: "r1 setinterleaves ((t1, u1), insert tick (ev ` S))\<and>t1 \<noteq> []"   
       using aa0 subsetCE by auto
     from 1(4,5,10,11) aa0 
     have aa3: "(tl t1) \<in> \<D> (P a) \<and> (tl u1) \<in> \<T> (Q a) \<and> ev a = hd t1 \<and> ev a = hd u1 \<and> 
                hd t1 \<in> ev ` A\<and> hd u1 \<in> ev ` B"  
        by auto
     then show ?case      
       using "1"(6) aa1 aa2 by fastforce 
   next
     case (2 a t u r v)
     obtain r1 t1 u1 where aa0: "r1=hd x#r\<and>t1=hd x#t\<and>u1=hd x#u" 
       by auto
     from 2(3,4,5,7,8,9) have aa1: "tickFree r1\<and>x = r1 @ v" 
       by (metis  Cons_eq_appendI aa0 event.distinct(1) list.exhaust_sel tickFree_Cons)
     from 2(2,4,9) have aa2: "r1 setinterleaves ((t1, u1), insert tick (ev ` S))\<and>t1 \<noteq> []"   
       using aa0 subsetCE by auto
     from 2(4,5,10,11) aa0 
     have aa3: "(tl t1) \<in> \<D> (Q a) \<and> (tl u1) \<in> \<T> (P a) \<and> ev a = hd t1 \<and> ev a = hd u1 \<and> 
                hd t1 \<in> ev ` A\<and> hd u1 \<in> ev ` B"  
        by auto
     then show ?case      
       using "2"(6) aa1 aa2 by fastforce
   next
     case (3 a t u r v)
     obtain r1 t1 u1 where aa0: "r1=hd x#r\<and>t1=hd x#t\<and>u1=hd x#u" 
       by auto
     from 3(2,4,9) have aa2: "r1 setinterleaves ((t1, u1), insert tick (ev ` S))\<and>t1 \<noteq> []"   
       using aa0 subsetCE by auto
     from 3(3,4,5,7,8,10,11) aa0 
     have aa3: "(tl t1) \<in> \<D>(P a)\<and>(tl u1) \<in> \<T> (Q a)\<and> ev a = hd t1\<and>ev a = hd u1 \<and> 
                hd t1 \<in> ev ` A\<and> hd u1 \<in> ev ` B\<and>x = r1 @ v"  
       by (metis (no_types, lifting)  Int_lower1 Int_lower2 append_Nil2 imageE image_eqI 
                                      list.exhaust_sel list.sel(1) list.sel(3) subsetCE)    
     then show ?case   
       by (metis (no_types, lifting) "3"(6) "3"(7) aa2 event.inject imageE)     
   next
     case (4 a t u r v)
     obtain r1 t1 u1 where aa0: "r1=hd x#r\<and>t1=hd x#t\<and>u1=hd x#u" 
       by auto
     from 4(2,4,9) have aa2: "r1 setinterleaves ((t1, u1), insert tick (ev ` S))\<and>t1 \<noteq> []"   
       using aa0 subsetCE by auto
     from 4(3,4,5,7,8,10,11) aa0 
     have aa3: "(tl t1) \<in> \<D> (Q a)\<and>(tl u1) \<in> \<T> (P a) \<and> ev a = hd t1\<and>ev a = hd u1\<and> 
                hd t1 \<in> ev ` A\<and> hd u1 \<in> ev ` B\<and>x = r1 @ v"  
       by (metis (no_types, lifting)  Int_lower1 Int_lower2 append_Nil2 imageE image_eqI 
                 list.exhaust_sel list.sel(1) list.sel(3) subsetCE)    
     then show ?case   
       by (metis (no_types, lifting) "4"(6) "4"(7) aa2 event.inject imageE)  
   qed
 qed
 
 lemma Hiding_interleave: 
   "A \<inter> C = {} 
   \<Longrightarrow> r setinterleaves ((t, u), C) 
   \<Longrightarrow> (trace_hide r A) setinterleaves ((trace_hide t A, trace_hide u A), C)"
 proof(induct r arbitrary:t u)
   case Nil
   then show ?case
     using EmptyLeftSync empty_setinterleaving by fastforce
 next
   case (Cons a r)
   then show ?case
     apply(cases t) using EmptyLeftSync apply fastforce
     apply(cases u) apply fastforce
   proof(simp split:if_splits, goal_cases)
     case (1 a list lista)
     then show ?case by fastforce
   next
     case (2 a list aa lista)
     then show ?case 
       apply(erule_tac disjE)
        using Cons(1)[of list u] 
        apply (metis (no_types, lifting) filter.simps(2) SyncSingleHeadAdd)
       using Cons(1)[of t lista]
       by (metis (no_types, lifting) Sync.sym filter.simps(2) SyncSingleHeadAdd)
   next
     case (3 a list lista)
     then show ?case by fastforce
   qed
 qed
 
 lemma non_Sync_interleaving: 
   "(set t \<union> set u) \<inter> C = {} \<Longrightarrow> setinterleaving (t, C, u) \<noteq> {}" (* FINALLY NON-USED*)
 proof(induct t arbitrary:u)
   case Nil
   then show ?case 
     by (metis Un_empty_left disjoint_iff_not_equal emptyLeftSelf empty_iff empty_set)
 next
   case (Cons a t)
   then show ?case 
   proof(induct u)
     case Nil
     then show ?case using Sync.sym by auto
   next
     case (Cons a u)
     then show ?case by auto
   qed
 qed
   
 lemma interleave_Hiding: 
   "A \<inter> C = {} 
   \<Longrightarrow> ra setinterleaves ((trace_hide t A, trace_hide u A), C) 
   \<Longrightarrow> \<exists>r. ra = trace_hide r A \<and> r setinterleaves ((t, u), C)"
 proof(induct "length t + length u" arbitrary:ra t u rule:nat_less_induct)
   case Ind:1
   then show ?case
   proof (cases t)
     case Nilt: Nil
     from Ind(2) have a:"set (trace_hide u A) \<inter> C = {} \<Longrightarrow> set u \<inter> C = {}" by auto
     hence b: "u setinterleaves ((t, u), C)"
       by (metis (no_types, lifting) Ind(3) EmptyLeftSync Nilt disjoint_iff_not_equal 
                 emptyLeftSelf filter.simps(1))
     then show ?thesis 
       apply(rule_tac x=u in exI)
       using EmptyLeftSync[of "ra" C "trace_hide u A"] a b Cons Nilt Ind(3) by auto
   next  
     case Const: (Cons ta tlist)
     then show ?thesis
     proof(cases u)
       case Nilu: Nil
       from Ind(2) have a:"set (trace_hide t A) \<inter> C = {} \<Longrightarrow> set t \<inter> C = {}" by auto
       hence b: "t setinterleaves ((t, u), C)" 
         by (metis Ind(3) Nilu EmptyLeftSync disjoint_iff_not_equal emptyLeftSelf filter.simps(1) Sync.sym)
       then show ?thesis 
         apply(rule_tac x=t in exI)
         using EmptyLeftSync[of "ra" C "trace_hide t A"] a b Ind Nilu by (metis Sync.sym filter.simps(1))
     next
       case Consu: (Cons ua ulist)
       with Const Ind(2,3) show ?thesis
       proof(auto split:if_splits simp del:setinterleaving.simps, goal_cases)
         case 1
         then show ?case
         proof (auto, goal_cases)
           case (1 raa)
           with Ind(1)[THEN spec, of "length tlist + length u", simplified Const, simplified, 
                         THEN spec, THEN spec, of tlist u, simplified Ind, simplified, 
                         THEN spec, of raa] obtain r where 
             "raa = trace_hide r A \<and> r setinterleaves ((tlist, u), C)" by auto  
           then show ?case using "1"(4) Consu by force
         next
           case (2 raa)
           with Ind(1)[THEN spec, of "length t + length ulist", simplified Consu, simplified, 
                     THEN spec, THEN spec, of t ulist, simplified Ind, simplified, 
                     THEN spec, of raa] obtain r where 
             "raa = trace_hide r A \<and> r setinterleaves ((t, ulist), C)" by auto
           then show ?case using "2"(2) "2"(4) by force
         next
           case (3 raa)
             with Ind(1)[THEN spec, of "length tlist + length ulist", simplified Const Consu, simplified, 
                       THEN spec, THEN spec, of tlist ulist, simplified Ind, simplified, 
                       THEN spec, of raa] obtain r where 
             "raa = trace_hide r A \<and> r setinterleaves ((tlist, ulist), C)" by auto
           then show ?case using "3"(4) by force
         next
           case (4 raa)
           with Ind(1)[THEN spec, of "length t + length ulist", simplified Consu, simplified, 
                     THEN spec, THEN spec, of t ulist, simplified Ind, simplified, 
                     THEN spec, of raa] obtain r where 
             "raa = trace_hide r A \<and> r setinterleaves ((t, ulist), C)" by auto
           then show ?case using "4"(5) Const by force
         next
           case (5 raa)
           with Ind(1)[THEN spec, of "length tlist + length u", simplified Const, simplified, 
                         THEN spec, THEN spec, of tlist u, simplified Ind, simplified, 
                         THEN spec, of raa] obtain r where 
             "raa = trace_hide r A \<and> r setinterleaves ((tlist, u), C)" by auto  
           then show ?case using "5"(4) Consu by force
         next
           case (6 raa)
           with Ind(1)[THEN spec, of "length t + length ulist", simplified Consu, simplified, 
                     THEN spec, THEN spec, of t ulist, simplified Ind, simplified, 
                     THEN spec, of raa] obtain r where 
             "raa = trace_hide r A \<and> r setinterleaves ((t, ulist), C)" by auto
           then show ?case using "6"(5) Const by force
         next
           case (7 raa)
           with Ind(1)[THEN spec, of "length tlist + length u", simplified Const, simplified, 
                         THEN spec, THEN spec, of tlist u, simplified Ind, simplified, 
                         THEN spec, of raa] obtain r where 
             "raa = trace_hide r A \<and> r setinterleaves ((tlist, u), C)" by auto  
           then show ?case using "7"(4) Consu by force
         qed
       next
         case 2
         with Ind(1)[THEN spec, of "length t + length ulist", simplified Consu, simplified, 
                       THEN spec, THEN spec, of t ulist, simplified Ind, simplified, 
                       THEN spec, of ra] obtain r where 
           "ra = trace_hide r A \<and> r setinterleaves ((t, ulist), C)" by auto   
         then show ?case 
           apply(rule_tac x="ua#r" in exI)
           using "2"(5) Const Ind.prems(1) by auto
       next
         case 3
         with Ind(1)[THEN spec, of "length tlist + length u", simplified Const, simplified, 
                       THEN spec, THEN spec, of tlist u, simplified Ind, simplified, 
                       THEN spec, of ra] obtain r where 
           "ra = trace_hide r A \<and> r setinterleaves ((tlist, u), C)" by auto   
         then show ?case
           apply(rule_tac x="ta#r" in exI)
           using "3"(4) Consu Ind.prems(1) by auto
       next
         case 4
         with Ind(1)[THEN spec, of "length tlist + length ulist", simplified Const Consu, simplified, 
                       THEN spec, THEN spec, of tlist ulist, simplified Ind, simplified, 
                       THEN spec, of ra] obtain r where 
           "ra = trace_hide r A \<and> r setinterleaves ((tlist, ulist), C)" by auto
         then show ?case
           apply(rule_tac x="ta#ua#r" in exI)
           using "4"(4,5) Consu Const Ind.prems(1) apply auto
            using SyncSingleHeadAdd apply blast 
           by (metis Sync.sym SyncSingleHeadAdd)
       qed
     qed
   qed
 qed
 
 lemma interleave_size: 
   "s setinterleaves ((t,u), C) \<Longrightarrow> length s = length t + length u - length(filter (\<lambda>x. x\<in>C) t)"
 proof(induct s arbitrary:t u)
   case Nil
   then show ?case using EmptyLeftSync empty_setinterleaving by fastforce
 next
   case (Cons a list)
   then show ?case
     apply(cases t) using emptyLeftProperty apply fastforce
     apply(cases u) 
      apply (metis (no_types, lifting) Sync.sym add_diff_cancel_right' emptyLeftNonSync 
                   emptyLeftProperty filter_empty_conv)
     proof(auto split:if_splits, goal_cases 11 12 13 14 15)
       case (11 tlist ulist)
       then show ?case 
         by (metis (no_types, lifting) Suc_diff_le le_add1 length_filter_le order_trans)
     next
       case (12 ta tlist ulist)
       with 12(3)[rule_format, of "ta#tlist" ulist] show ?case 
         by simp (metis Suc_diff_le le_add1 length_filter_le order_trans)
     next
       case (13 tlist ua ulist)
       with 13(3)[rule_format, of tlist "ua#ulist"] show ?case 
         by simp (metis Suc_diff_le le_less_trans length_filter_le less_SucI less_Suc_eq_le less_add_Suc1)
     next
       case (14 ta tlist ulist)
       with 14(3)[rule_format, of "ta#tlist" ulist] show ?case 
         by simp (metis Suc_diff_le le_less_trans length_filter_le less_SucI less_Suc_eq_le less_add_Suc1)
     next
       case (15 tlist ua ulist)
       with 15(3)[rule_format, of tlist "ua#ulist"] show ?case
         by simp (metis Suc_diff_le le_less_trans length_filter_le less_SucI less_Suc_eq_le less_add_Suc1)
     qed
 qed 
 
 lemma interleave_eq_size: 
   "s setinterleaves ((t,u), C) \<Longrightarrow> s' setinterleaves ((t,u), C) \<Longrightarrow> length s = length s'"
   by (simp add: interleave_size)
 
 lemma interleave_set: "s setinterleaves ((t,u), C) \<Longrightarrow> set t \<union> set u \<subseteq> set s"
 proof(induct s arbitrary: t u)
   case Nil
   then show ?case using EmptyLeftSync empty_setinterleaving by blast
 next
   case (Cons a s)
   then show ?case
     apply(cases t) using emptyLeftProperty apply fastforce
     apply(cases u) apply (metis Sync.sym Un_empty_right emptyLeftProperty empty_set eq_refl)
     by (auto simp add: subset_iff split:if_splits) 
 qed 
 
 lemma interleave_order: "s setinterleaves ((t1@t2,u), C) \<Longrightarrow> set(t2) \<subseteq> set(drop (length t1) s)"
 proof(induct s arbitrary: t1 t2 u)
   case Nil
   then show ?case using empty_setinterleaving by auto
 next
   case (Cons a s)
   then show ?case
   apply(cases t1) using append_self_conv2 interleave_set apply fastforce
   apply(cases u) apply (metis EmptyLeftSync Sync.sym append_eq_conv_conj order_refl) 
   proof (auto simp add: subset_iff split:if_splits, goal_cases)
     case (1 a list lista t)
     then show ?case using Cons(1)[of "a#list" "t2" "lista", simplified, OF 1(6)]
       by (meson Suc_n_not_le_n contra_subsetD nat_le_linear set_drop_subset_set_drop)
   next
     case (2 a list lista t)
     then show ?case using Cons(1)[of "a#list" "t2" "lista", simplified, OF 2(7)]
       by (meson Suc_n_not_le_n contra_subsetD nat_le_linear set_drop_subset_set_drop)
   qed
 qed 
 
 lemma interleave_append: 
   "s setinterleaves ((t1@t2,u), C) 
    \<Longrightarrow> \<exists> u1 u2 s1 s2. u = u1@u2 \<and> s = s1@s2 \<and> 
                       s1 setinterleaves ((t1,u1), C) \<and> s2 setinterleaves ((t2,u2), C)"
 proof(induct s arbitrary: t1 t2 u)
   case Nil
   then show ?case using empty_setinterleaving by fastforce
 next
   case (Cons a s)
   then show ?case
   apply(cases t1) using append_self_conv2 interleave_set apply fastforce
   apply(cases u) apply(exI "[]", exI "[]") apply auto[1]
     apply (metis (no_types, opaque_lifting) Nil_is_append_conv append_Cons)
   proof (auto simp add: subset_iff split:if_splits, goal_cases)
     case (1 list lista)
     with Cons(1)[of "list" "t2" "lista", simplified, OF 1(5)] show ?case
     proof(elim exE conjE, goal_cases)
       case (1 u1 u2 s1 s2)
       then show ?case 
         by (exI "a#u1", exI "u2", simp) (metis append_Cons)
     qed      
   next
     case (2 aa list lista)
     with Cons(1)[of "aa#list" "t2" "lista", simplified, OF 2(6)] show ?case
     proof(elim exE conjE, goal_cases)
       case (1 u1 u2 s1 s2)
       then show ?case 
         by (exI "a#u1", exI "u2", simp) (metis append_Cons)
     qed  
   next
     case (3 list aa lista)
     with Cons(1)[of "list" "t2" "aa#lista", simplified, OF 3(6)] show ?case
     proof(elim exE conjE, goal_cases)
       case (1 u1 u2 s1 s2)
       then show ?case 
         apply (exI "u1", exI "u2", simp) by (metis append_Cons SyncSingleHeadAdd)
     qed  
   next
     case (4 aa list lista)
     with Cons(1)[of "aa#list" "t2" "lista", simplified, OF 4(6)] show ?case
     proof(elim exE conjE, goal_cases)
       case (1 u1 u2 s1 s2)
       then show ?case 
         by (exI "a#u1", exI "u2", simp) (metis append_Cons)
     qed 
   next
     case (5 list aa lista)
     with Cons(1)[of "list" "t2" "aa#lista", simplified, OF 5(6)] show ?case
     proof(elim exE conjE, goal_cases)
       case (1 u1 u2 s1 s2)
       then show ?case 
         apply (exI "u1", exI "u2", simp) by (metis append_Cons SyncSingleHeadAdd)
     qed
   qed
 qed 
 
 lemma interleave_append_sym: 
   "s setinterleaves ((t,u1@u2), C) 
    \<Longrightarrow> \<exists> t1 t2 s1 s2. t = t1@t2 \<and> s = s1@s2 \<and> 
                       s1 setinterleaves ((t1,u1), C) \<and> s2 setinterleaves ((t2,u2), C)"
   by (metis (no_types) Sync.sym interleave_append)
 
 lemma interleave_append_tail: 
   "s setinterleaves ((t1,u), C) \<Longrightarrow> (set t2) \<inter> C = {} \<Longrightarrow> (s@t2) setinterleaves ((t1@t2,u), C)"
 proof(induct s arbitrary: t1 t2 u)
   case Nil
   then show ?case by (metis Set.set_insert Sync.sym append_Nil disjoint_insert(2) 
                             emptyLeftSelf empty_setinterleaving)
 next
   case (Cons a s)
   then show ?case
     apply(cases u) using EmptyLeftSync Sync.sym apply fastforce 
     apply(cases t1, cases t2) apply simp apply fastforce 
   proof(auto, goal_cases)
     case (1 list lista)
     with 1(1)[OF 1(7) 1(2)] show ?case by simp
   next
     case (2 list aa lista)
     with 2(1)[OF 2(2)] show ?case by simp  
   next
     case (3 list aa lista)
     with 3(1)[OF 3(9) 3(2)] show ?case by simp
   next
     case (4 list aa lista)
     with 4(1)[OF 4(9) 4(2)] show ?case by simp
   qed
 qed
 
 lemma interleave_append_tail_sym: 
   "s setinterleaves ((t,u1), C) \<Longrightarrow> (set u2) \<inter> C = {} \<Longrightarrow> (s@u2) setinterleaves ((t,u1@u2), C)"
   by (metis (no_types) Sync.sym interleave_append_tail)
 
 lemma interleave_assoc_1: 
   "tu setinterleaves ((t, u), A) 
    \<Longrightarrow> tuv setinterleaves ((tu, v), A) 
    \<Longrightarrow> \<exists>uv. uv setinterleaves ((u, v), A) \<and> tuv setinterleaves ((t, uv), A)"
 proof(induct tuv arbitrary: t tu u v)
   case Nil
   then show ?case using EmptyLeftSync empty_setinterleaving by blast
 next
   case Cons_tuv:(Cons a tuv)
   then show ?case
   proof(cases t)
     case Nil_t:Nil
     with Cons_tuv(2) have *:"tu = u" using EmptyLeftSync by blast
     show ?thesis
     proof(cases u)
       case Nil_u:Nil
       with Nil_t Cons_tuv show ?thesis using EmptyLeftSync by fastforce
     next
       case Cons_u:(Cons ua ulist)
       with Nil_t Cons_tuv(2) have "ua \<notin> A" by force  
       show ?thesis 
       proof(cases v)
         case Nil_v:Nil
         with * Nil_t Cons_tuv(2,3) Cons_u show ?thesis using Sync.sym by blast
       next
         case Cons_v:(Cons va vlist)
         with * Nil_t Cons_tuv(2,3) Cons_u show ?thesis apply(exI "a#tuv", auto split:if_splits) 
           using Cons_tuv.hyps Cons_tuv.prems(1) emptyLeftProperty by blast+
       qed
     qed
   next
     case Cons_t:(Cons ta tlist)
     show ?thesis
     proof(cases u)
       case Nil_u:Nil
       with Cons_t Cons_tuv show ?thesis
         by (metis Sync.sym emptyLeftProperty emptyLeftSelf empty_set equals0D ftf_Sync21)
     next
       case Cons_u:(Cons ua ulist)
       show ?thesis 
       proof(cases v)
         case Nil_v:Nil
         with Cons_tuv(3) have "a # tuv = tu" by (simp add: Nil_v EmptyLeftSync Sync.sym)
         with Nil_v Cons_u Cons_t Cons_tuv show ?thesis apply(exI u, auto split:if_splits)
            apply (metis Cons_t Nil_v Sync.sym emptyLeftNonSync list.set_intros(1))
           using Cons_tuv(1)[of tuv tlist u] 
             apply(metis (no_types, lifting) Sync.sym emptyLeftNonSync emptyLeftSelf list.sel(3) SyncTlEmpty)
         by (metis Cons_t Sync.sym emptyLeftProperty) fastforce+  
       next
         case Cons_v:(Cons va vlist)
         with Cons_t Cons_u Cons_tuv(2,3) show ?thesis 
         proof(auto split:if_splits, goal_cases)
           case (1 tulist)
           from Cons_tuv(1)[OF 1(5) 1(10)] obtain uvlist 
-            where "uvlist setinterleaves ((ulist, vlist), A) \<and> tuv setinterleaves ((tlist, uvlist), A)" by blast
+            where "  uvlist setinterleaves ((ulist, vlist), A) 
+                   \<and> tuv setinterleaves ((tlist, uvlist), A)" by blast
           with 1 show ?case by(exI "va#uvlist", simp)
         next
           case (2 u)
           then show ?case by (metis Cons_tuv.hyps Cons_tuv.prems(1) Sync.sym SyncSingleHeadAdd)
         next
           case (3 u)
           then show ?case by (metis Cons_tuv.hyps Sync.sym SyncSingleHeadAdd) 
         next
           case (4 u)
           then show ?case by (metis Cons_tuv.hyps Cons_tuv.prems(1) Sync.sym SyncSingleHeadAdd)
         next
           case (5 u)
           then show ?case by (metis Cons_tuv.hyps Sync.sym SyncSingleHeadAdd)
         next
           case (6 u)
           then show ?case by (metis Cons_tuv.hyps Cons_tuv.prems(1) Sync.sym SyncSingleHeadAdd)
         next
           case (7 u)
           then show ?case by (metis Cons_tuv.hyps Sync.sym SyncSingleHeadAdd)
         next
           case (8 tulist)
           from Cons_tuv(1)[OF 8(5) 8(9)] obtain uvlist 
             where "uvlist setinterleaves ((va#ulist, va#vlist), A) \<and> 
                    tuv setinterleaves ((tlist, uvlist), A)" by blast
           with 8 show ?case using SyncSingleHeadAdd by (exI "uvlist", simp) blast
         next
           case (9 u)
           then show ?case by (metis Cons_tuv.hyps Cons_tuv.prems(1) Sync.sym SyncSingleHeadAdd)
         next
           case (10 tulist)
           from Cons_tuv(1)[OF 10(6) 10(10)] obtain uvlist 
             where "uvlist setinterleaves ((ua#ulist, va#vlist), A) \<and> 
                    tuv setinterleaves ((tlist, uvlist), A)" by blast
           with 10 show ?case using SyncSingleHeadAdd by (exI "uvlist", simp) blast
         next
           case (11 u)
           then show ?case by (metis Cons_tuv.hyps Cons_tuv.prems(1) Sync.sym SyncSingleHeadAdd)
         next
           case (12 u)
           then show ?case using Cons_tuv.hyps by fastforce
         next
           case (13 u)
           then show ?case by (metis Cons_tuv.hyps Sync.sym SyncSingleHeadAdd)
         next
           case (14 u)
           then show ?case by (metis Cons_tuv.hyps Sync.sym SyncSingleHeadAdd)
         next
           case (15 u)
           then show ?case by (metis Cons_tuv.hyps Sync.sym SyncSingleHeadAdd)
         next
           case (16 u)
           then show ?case by (metis Cons_tuv.hyps Cons_tuv.prems(1) Sync.sym SyncSingleHeadAdd)
         next
           case (17 u)
           then show ?case by (metis Cons_tuv.hyps Sync.sym SyncSingleHeadAdd)
         next
           case (18 u)
           then show ?case using Cons_tuv.hyps by fastforce
         next
           case (19 u)
           then show ?case using Cons_tuv.hyps by fastforce
         next
           case (20 u)
           then show ?case by (metis Cons_tuv.hyps Cons_tuv.prems(1) Sync.sym SyncSingleHeadAdd)
         next
           case (21 u)
           then show ?case using Cons_tuv.hyps by fastforce
         qed
       qed
     qed
   qed 
 qed
 
 lemma interleave_assoc_2:
   assumes  *:"uv setinterleaves ((u, v), A)" and 
          **:"tuv setinterleaves ((t, uv), A)"
   shows "\<exists>tu. tu setinterleaves ((t, u), A) \<and> tuv setinterleaves ((tu, v), A)"
   using "*" "**" Sync.sym interleave_assoc_1 by blast
 
 subsection\<open> Laws \<close>
 
 lemma Sync_commute: "(P \<lbrakk> S \<rbrakk> Q) = (Q \<lbrakk> S \<rbrakk> P)"
   by (simp add: Process_eq_spec mono_D_Sync mono_F_Sync)
 
 lemma mono_Sync_FD_oneside[simp]: "P \<le> P' \<Longrightarrow> (P \<lbrakk> S \<rbrakk> Q) \<le> (P' \<lbrakk> S \<rbrakk> Q)"
   apply(auto simp:le_ref_def F_Sync D_Sync) 
   using F_subset_imp_T_subset front_tickFree_Nil by blast+
 
 lemma mono_Sync_FD[simp]: "\<lbrakk>P \<le> P'; Q \<le> Q'\<rbrakk> \<Longrightarrow> (P \<lbrakk> S \<rbrakk> Q) \<le> (P' \<lbrakk> S \<rbrakk> Q')"
   using mono_Sync_FD_oneside[of P P' S Q] mono_Sync_FD_oneside[of Q Q' S P]
   by (simp add: order_trans Sync_commute)
 
 lemma mono_Sync_ref: "\<lbrakk>P \<sqsubseteq> P'; Q \<sqsubseteq> Q'\<rbrakk> \<Longrightarrow> (P \<lbrakk> S \<rbrakk> Q) \<sqsubseteq> (P' \<lbrakk> S \<rbrakk> Q')"
   using mono_Sync_sym[of Q Q' P S] mono_Sync[of P P' S Q'] below_trans by blast
 
 lemma Sync_BOT: "(P \<lbrakk> S \<rbrakk> \<bottom>) = \<bottom>"
   apply(auto simp add:Process_eq_spec, simp_all add:D_Sync F_Sync F_UU D_UU)
      apply (metis D_imp_front_tickFree append_Nil2 front_tickFree_append ftf_Sync is_processT is_processT2_TR)
     apply (metis Nil_elem_T Sync.si_empty1 append_Nil front_tickFree_Nil insertI1 non_tickFree_implies_nonMt)
    apply (metis D_imp_front_tickFree append_Nil2 front_tickFree_append ftf_Sync is_processT2_TR)
   by (metis Nil_elem_T Sync.si_empty1 append_Nil front_tickFree_Nil insertI1 non_tickFree_implies_nonMt)
 
 lemma Sync_SKIP_SKIP: "(SKIP \<lbrakk> S \<rbrakk> SKIP) = SKIP"
   apply(auto simp add:Process_eq_spec, simp_all add:D_Sync F_Sync F_SKIP D_SKIP)
   apply(elim exE conjE disjE, auto)
    apply (metis Sync.si_empty1 inf.idem insertI1 sup_commute sup_inf_absorb)
   apply(exI "[tick]", exI "[tick]", simp) 
   by blast
 
 lemma Sync_SKIP_STOP: "(SKIP \<lbrakk>S\<rbrakk> STOP) = STOP"
 proof(auto simp add:Process_eq_spec, simp_all add:D_Sync F_Sync F_SKIP D_SKIP F_STOP D_STOP, goal_cases)
   case (1 a b)
   then show ?case by (elim exE conjE disjE, auto)
 next
   case (2 a b)
   then show ?case
     apply(rule_tac x="[]" in exI, simp, rule_tac x="b-{tick}" in exI, simp, rule_tac x="b" in exI) 
     by blast  
 qed
 
 
 
 subsection\<open> Multi-Operators laws  \<close>
 
-lemma Mprefix_Sync_distr: 
-  "\<lbrakk>A \<inter> S = {}; A' \<subseteq> S; B \<inter> S = {}; B' \<subseteq> S\<rbrakk> \<Longrightarrow> 
-       (\<box> x \<in> A \<union> A' \<rightarrow> P x) \<lbrakk> S \<rbrakk> (\<box> y \<in> B \<union> B' \<rightarrow> Q y) = (\<box> x \<in> A       \<rightarrow> (                 P x  \<lbrakk> S \<rbrakk> (\<box> y \<in> B \<union> B' \<rightarrow> Q y)))
-                                                         \<box> (\<box> y \<in> B       \<rightarrow> ((\<box> x \<in> A \<union> A' \<rightarrow> P x) \<lbrakk> S \<rbrakk>                  Q y))
-                                                         \<box> (\<box> x \<in> A' \<inter> B' \<rightarrow> (                 P x  \<lbrakk> S \<rbrakk>                  Q x))"    
-proof(auto simp add:Process_eq_spec, simp_all add:D_Sync F_Sync D_Mprefix F_Mprefix T_Mprefix D_Det F_Det T_Det,
-      elim exE disjE conjE, goal_cases)
-  case (1 a b t u X Y)
-  then show ?case by auto
-next
-  case (2 a b t u X Y aa)
-  have 21:\<open>a = u\<close> 
-    using 2(5,7) EmptyLeftSync by blast
-  hence 22:\<open>hd a \<in> ev ` B\<close>  
-    using emptyLeftNonSync[rule_format, of a \<open>insert tick (ev ` S)\<close> u \<open>hd u\<close>, simplified]
-          2(10,4,5,7,9) by auto
-   with 2 show ?case 
-     apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, simp add:21)
-     apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, simp add:21) 
-     apply(intro disjI2 conjI, simp_all add:21 22) 
-     apply(exI aa, simp add:21) 
-     apply(rule_tac disjI1, exI t, exI \<open>tl u\<close>, exI X, rule_tac conjI, simp, exI Y, simp) 
-     by (meson SyncTlEmpty)
-next
-  case (3 a b t u X Y aa)
-  have 31:\<open>a = t\<close>
-     using "3"(6) "3"(8) EmptyLeftSync Sync.sym by blast
-  hence 32:\<open>hd a \<in> ev ` A\<close>  
-    using emptyLeftNonSync[rule_format, of a \<open>insert tick (ev ` S)\<close> t \<open>hd t\<close>] 
-          3(10,2,5,6,8) Sync.sym by auto blast
-  with 3 show ?case 
-    apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, simp add:31)
-    apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, simp add:31) 
-    apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, simp_all add:31 32) 
-    apply(exI aa, simp) 
-    apply(rule_tac disjI1, exI \<open>tl t\<close>, exI u, exI X, rule_tac conjI, simp, exI Y, simp) 
-    by (simp add: Sync.sym SyncTlEmpty)
-next
-  case (4 a b t u X Y aa ab)
-  hence \<open>   (hd a = ev aa \<and> hd a \<in> ev ` A \<and> tl a setinterleaves ((tl t, u), insert tick (ev ` S))) 
-             \<or> (hd a = ev ab \<and> hd a \<in> ev ` B \<and> tl a setinterleaves ((t, tl u), insert tick (ev ` S)))
-             \<or> (hd a = ev ab \<and> aa = ab \<and> hd a \<in> ev ` (A' \<inter> B') \<and> tl a setinterleaves ((tl t, tl u), insert tick (ev ` S)))\<close> 
-    using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>hd u\<close> \<open>tl u\<close>]
-    apply (simp del:si_neq split:if_splits) 
-    apply (metis (no_types, lifting) IntI UnE disjoint_iff event.simps(1) event.simps(3) imageE imageI list.sel(1) list.sel(3))
-    by(metis (no_types, opaque_lifting) UnE image_Un list.sel(1) list.sel(3) subset_eq subset_image_iff)+
-  with 4 show ?case 
-  proof(elim disjE conjE, goal_cases)
-    case 41:1
-    then show ?case
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis empty_setinterleaving)
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis empty_setinterleaving, simp_all)
-      apply(exI aa, simp) 
-      apply(rule_tac disjI1, exI \<open>tl t\<close>, exI u, exI X, rule_tac conjI, simp, exI Y, simp) 
-      by blast
-  next
-    case 42:2
-    then show ?case
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis empty_setinterleaving)
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI2, rule_tac disjI2, rule_tac conjI, metis empty_setinterleaving, simp_all)
-      apply(exI ab, simp) 
-      apply(rule_tac disjI1, exI t, exI \<open>tl u\<close>, exI X, rule_tac conjI)
-      by blast+
-  next
-    case 43:3
-    then show ?case
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis empty_setinterleaving)
-      apply(rule_tac disjI2, rule_tac disjI2, rule_tac disjI2, rule_tac disjI2, rule_tac conjI, metis empty_setinterleaving, simp) 
-      by(exI aa, simp, rule_tac disjI1, exI \<open>tl t\<close>, exI \<open>tl u\<close>, exI X, rule_tac conjI, simp, exI Y, simp)
-  qed
-next
-  case (5 a b t u r v aa)
-  have 51:\<open>a = t@v\<close>
-     using 5(7,8,11) EmptyLeftSync Sync.sym by blast
-  hence 52:\<open>hd a \<in> ev ` A\<close>  
-    using emptyLeftNonSync[rule_format, of r \<open>insert tick (ev ` S)\<close> t \<open>hd t\<close>] 
-          5(10,11,2,8,9) Sync.sym by auto blast
-  with 5 show ?case 
-    apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, simp add:51)
-    apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, simp_all add:51) 
-    apply(rule_tac disjI1, exI aa, simp)
-    apply(rule_tac disjI2, exI \<open>tl t\<close>, exI u, exI \<open>tl r\<close>, exI v, simp)
-    by (simp add: Sync.sym SyncTlEmpty tickFree_tl)
-next
-  case (6 a b t u r v aa ab)
-  hence \<open>(hd r = ev aa \<and> hd r \<in> ev ` A \<and> tl r setinterleaves ((tl t, u), insert tick (ev ` S))) 
-         \<or> (hd r = ev ab \<and> hd r \<in> ev ` B \<and> tl r setinterleaves ((t, tl u), insert tick (ev ` S)))\<close>  
-    using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>hd u\<close> \<open>tl u\<close>]
-    apply(simp del:si_neq split:if_splits, blast, metis empty_iff list.collapse) 
-      apply(metis (no_types, lifting) event.simps(3) image_eqI insert_iff SyncHd_Tl)
-     defer
-     apply blast
-
-  proof -
-    assume a1: \<open>hd t \<notin> ev ` S\<close>
-       and a2: \<open>setinterleaving (t, insert tick (ev ` S), ev ab # tl u) =
-                {hd t # ua |ua. ua setinterleaves ((tl t, ev ab # tl u), insert tick (ev ` S))}
-                \<union> {ev ab # ua |ua. ua setinterleaves ((t, tl u), insert tick (ev ` S))}\<close>
-    have f3: "ev ab \<in> ev ` B"
-      using "6"(13) by blast
-    have f4: "hd t \<in> ev ` A"
-      using a1 "6"(10) "6"(2) by blast
-    show \<open>hd r = hd t \<and> hd r \<in> ev ` A \<and> tl r setinterleaves ((tl t, u), insert tick (ev ` S)) \<or>
-          hd r = ev ab \<and> hd r \<in> ev ` B \<and> tl r setinterleaves ((t, tl u), insert tick (ev ` S))\<close>
-      apply auto
-      using "6"(8) a2 "6"(14) "6"(15) hd_Cons_tl apply fastforce
-      using "6"(8) a2 "6"(14) "6"(15) f4 hd_Cons_tl apply fastforce
-      using "6"(8) a2 "6"(14) "6"(15) hd_Cons_tl apply fastforce
-      using "6"(8) a2 "6"(14) "6"(15) f3 hd_Cons_tl apply fastforce
-      using "6"(8) a2 "6"(14) "6"(15) f3 hd_Cons_tl apply fastforce
-      using "6"(8) a2 "6"(14) "6"(15) f4 f3 hd_Cons_tl apply fastforce
-      using "6"(13) "6"(8) a2 "6"(14) "6"(15) hd_Cons_tl apply fastforce
-      using "6"(8) a2 "6"(14) "6"(15) f4 hd_Cons_tl apply fastforce
-      using "6"(8) a2 "6"(14) "6"(15) hd_Cons_tl by fastforce
-  qed
-  with 6 show ?case
-  proof(elim disjE conjE, goal_cases)
-    case 61:1
-    then show ?case
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving, simp_all)
-      apply(rule_tac conjI, metis empty_setinterleaving hd_append2)
-      apply(exI aa, rule_tac conjI, metis empty_setinterleaving hd_append2)   
-      apply(rule_tac disjI2, exI \<open>tl t\<close>, exI u, exI \<open>tl r\<close>, exI v) 
-      by (metis empty_setinterleaving tickFree_tl tl_append2)    
-  next
-    case 62:2
-    then show ?case
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving)
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI2, rule_tac disjI2, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving)
-      apply(rule_tac conjI, metis empty_setinterleaving hd_append2)
-      apply(exI ab, rule_tac conjI, metis empty_setinterleaving hd_append2) 
-      apply(rule_tac disjI2, exI t, exI \<open>tl u\<close>, exI \<open>tl r\<close>, exI v)       
-      by (metis empty_setinterleaving tickFree_tl tl_append2)    
-  qed
-next
-  case (7 a b t u r v aa ab)
-  hence \<open>   (hd r = ev aa \<and> hd r \<in> ev ` A \<and> tl r setinterleaves ((tl t, u), insert tick (ev ` S))) 
-             \<or> (hd r = ev ab \<and> aa = ab \<and> hd r \<in> ev ` (A' \<inter> B') \<and> tl r setinterleaves ((tl t, tl u), insert tick (ev ` S)))\<close> 
-    using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>hd u\<close> \<open>tl u\<close>]
-    apply (simp del:si_neq split:if_splits)
-    apply (metis (no_types, opaque_lifting) IntI UnE empty_iff event.inject imageE imageI insert_iff SyncSameHdTl) 
-       apply (metis empty_iff hd_Cons_tl, blast, blast) 
-  proof
-    assume a1: "ev ab \<in> ev ` S"
-    assume a2: "hd t \<notin> ev ` S"
-    assume a3: "hd t \<noteq> tick"
-    assume a4: "hd u = ev ab"
-    assume a5: "hd t \<in> ev ` (A \<union> A')"
-    assume a7: "A' \<subseteq> S"
-    show \<open>hd r = hd t \<and> hd r \<in> ev ` A \<and> tl r setinterleaves ((tl t, u), insert tick (ev ` S))\<close>
-      apply safe
-        apply (metis "7"(8) Sync.sym a1 a2 a3 a4 insertCI insertE SyncHd_Tl)
-       apply (metis "7"(8) Sync.sym Un_iff a1 a2 a4 a5 a7 image_Un insert_iff sup.absorb_iff2 SyncHd_Tl SyncSameHdTl)
-      by (metis "7"(8) Sync.sym a1 a2 a3 a4 insertCI insertE SyncHd_Tl)
-  qed
-  with 7 show ?case 
-  proof(elim disjE conjE, goal_cases)
-    case 71:1
-    then show ?case
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving, simp_all)
-      apply(rule_tac conjI, metis empty_setinterleaving hd_append2)
-      apply(exI aa, rule_tac conjI, metis empty_setinterleaving hd_append2)   
-      apply(rule_tac disjI2, exI \<open>tl t\<close>, exI u, exI \<open>tl r\<close>, exI v) 
-      by (metis empty_setinterleaving tickFree_tl tl_append2)    
+lemma Mprefix_Sync_distr:
+  \<open>(\<box> x \<in> A \<union> A' \<rightarrow> P x) \<lbrakk> S \<rbrakk> (\<box> y \<in> B \<union> B' \<rightarrow> Q y) =     
+   (\<box> x \<in> A       \<rightarrow> (                 P x  \<lbrakk> S \<rbrakk> (\<box> y \<in> B \<union> B' \<rightarrow> Q y))) \<box>
+   (\<box> y \<in> B       \<rightarrow> ((\<box> x \<in> A \<union> A' \<rightarrow> P x) \<lbrakk> S \<rbrakk>                  Q y))  \<box> 
+   (\<box> x \<in> A' \<inter> B' \<rightarrow> (                 P x  \<lbrakk> S \<rbrakk>                  Q x))\<close>
+  (is \<open>?lhs A A' P B B' Q = ?rhs A A' P B B' Q\<close>) 
+  if sets_assms: \<open>A \<inter> S = {}\<close> \<open>A' \<subseteq> S\<close> \<open>B \<inter> S = {}\<close> \<open>B' \<subseteq> S\<close>
+  (* new proof by Benoît Ballenghien *)
+proof (subst Process_eq_spec_optimized, safe)
+  fix s X
+  assume \<open>(s, X) \<in> \<F> (?lhs A A' P B B' Q)\<close>
+     and same_div : \<open>\<D> (?lhs A A' P B B' Q) = \<D> (?rhs A A' P B B' Q)\<close>
+  from this(1) consider 
+    \<open>\<exists>s_P s_Q X_P X_Q. (s_P, X_P) \<in> \<F> (Mprefix (A \<union> A') P) \<and>
+                       (s_Q, X_Q) \<in> \<F> (Mprefix (B \<union> B') Q) \<and>
+                       s setinterleaves ((s_P, s_Q), insert tick (ev ` S)) \<and> 
+                       X = (X_P \<union> X_Q) \<inter> insert tick (ev ` S) \<union> X_P \<inter> X_Q\<close>
+    | \<open>s \<in> \<D> (?lhs A A' P B B' Q)\<close>
+    by (simp add: F_Sync D_Sync) blast
+  thus \<open>(s, X) \<in> \<F> (?rhs A A' P B B' Q)\<close>
+  proof cases
+    case 1
+    then obtain s_P s_Q X_P X_Q 
+      where * : \<open>(s_P, X_P) \<in> \<F> (Mprefix (A \<union> A') P)\<close> \<open>(s_Q, X_Q) \<in> \<F> (Mprefix (B \<union> B') Q)\<close>
+                \<open>s setinterleaves ((s_P, s_Q), insert tick (ev ` S))\<close>
+                \<open>X = (X_P \<union> X_Q) \<inter> insert tick (ev ` S) \<union> X_P \<inter> X_Q\<close> by blast
+    thus \<open>(s, X) \<in> \<F> (?rhs A A' P B B' Q)\<close>
+    proof (cases \<open>s = [] \<or> hd s = tick\<close>)
+      case True
+      with *(1, 2, 3) have ** : \<open>s = [] \<and> s_P = [] \<and> s_Q = []\<close>
+        by (cases s_P; cases s_Q; force simp add: F_Mprefix subset_iff split: if_split_asm)
+      with *(1, 2, 4) sets_assms(1, 3) show \<open>(s, X) \<in> \<F> (?rhs A A' P B B' Q)\<close>
+        by (auto simp add: subset_iff F_Det D_Det T_Det F_Mprefix image_Un)[1]
+    next
+      case False
+      then obtain e where *** : \<open>s \<noteq> []\<close> \<open>hd s = ev e\<close> by (meson event.exhaust)
+      from *(1, 2, 3) *** sets_assms consider
+        \<open>e \<in> A \<and> s_P \<noteq> [] \<and> hd s_P = ev e \<and> (tl s_P, X_P) \<in> \<F> (P e) \<and> 
+         tl s setinterleaves ((tl s_P, s_Q), insert tick (ev ` S))\<close> | 
+        \<open>e \<in> B \<and> s_Q \<noteq> [] \<and> hd s_Q = ev e \<and> (tl s_Q, X_Q) \<in> \<F> (Q e) \<and> 
+         tl s setinterleaves ((s_P, tl s_Q), insert tick (ev ` S))\<close> | 
+        \<open>e \<in> A' \<and> e \<in> B' \<and> s_P \<noteq> [] \<and> s_Q \<noteq> [] \<and> hd s_P = ev e \<and> hd s_Q = ev e \<and> (tl s_P, X_P) \<in> \<F> (P e) \<and> 
+         (tl s_Q, X_Q) \<in> \<F> (Q e) \<and> tl s setinterleaves ((tl s_P, tl s_Q), insert tick (ev ` S))\<close>
+        by (cases s_P; cases s_Q; auto simp add: F_Mprefix split: if_split_asm)
+      thus \<open>(s, X) \<in> \<F> (?rhs A A' P B B' Q)\<close>
+        apply cases
+          apply (simp_all add: F_Det ***(1))
+          apply (rule disjI1, simp add: F_Mprefix ***, simp add: F_Sync, rule disjI1)
+          apply (rule_tac x = \<open>tl s_P\<close> in exI, rule_tac x = s_Q in exI, rule_tac x = X_P in exI,
+                 simp, rule_tac x = X_Q in exI, simp add: *(2, 4))
+          apply (rule disjI2, rule disjI1, simp add: F_Mprefix ***, simp add: F_Sync, rule disjI1)
+         apply (rule_tac x = s_P in exI, rule_tac x = \<open>tl s_Q\<close> in exI, rule_tac x = X_P in exI,
+                simp add: *(1), rule_tac x = X_Q in exI, simp add: *(4))
+        apply (rule disjI2, rule disjI2, simp add: F_Mprefix *** F_Sync, rule disjI1)
+        by (rule_tac x = \<open>tl s_P\<close> in exI, rule_tac x = \<open>tl s_Q\<close> in exI, rule_tac x = X_P in exI, 
+            simp, rule_tac x = X_Q in exI, simp add: *(4))
+    qed
   next
-    case 72:2
-    then show ?case
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving)
-      apply(rule_tac disjI2, rule_tac disjI2, rule_tac disjI2, rule_tac disjI2, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac conjI, metis empty_setinterleaving hd_append2)
-      apply (exI aa, rule_tac conjI, metis empty_setinterleaving hd_append2)
-      apply (rule_tac disjI2, exI \<open>tl t\<close>, exI \<open>tl u\<close>, exI \<open>tl r\<close>, exI v) 
-      by (metis empty_setinterleaving tickFree_tl tl_append2)    
-  qed    
-next
-  case (8 a b u t r v aa)
-  have 81:\<open>r = u\<close>
-     using 8 EmptyLeftSync Sync.sym by blast
-  hence 82:\<open>hd r \<in> ev ` B\<close>  
-    using emptyLeftNonSync[rule_format, of r \<open>insert tick (ev ` S)\<close> u \<open>hd u\<close>] 
-          8 Sync.sym by auto blast
-  with 8 show ?case 
-     apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, simp add:81) 
-     apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-     apply(intro disjI2 conjI, simp_all add:81 82) 
-     apply(exI aa, simp add:81) 
-     apply(rule_tac disjI2,  exI \<open>tl u\<close>, exI t, exI \<open>tl r\<close>, exI v) 
-    by (simp add: "81" Sync.sym SyncTlEmpty tickFree_tl)
-next
-  case (9 a b u t r v ab aa)
-  hence \<open>(hd r = ev aa \<and> hd r \<in> ev ` A \<and> tl r setinterleaves ((tl t, u), insert tick (ev ` S))) 
-         \<or> (hd r = ev ab \<and> hd r \<in> ev ` B \<and> tl r setinterleaves ((t, tl u), insert tick (ev ` S)))\<close>  
-    using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>hd u\<close> \<open>tl u\<close>]
-    apply(simp del:si_neq split:if_splits, metis disjoint_iff event.inject image_iff, blast, blast) 
-     apply (simp add: Sync.sym image_Un list.exhaust_sel rev_image_eqI sup.absorb_iff2)
-     defer
-    apply (metis (no_types, lifting) Sync.sym event.simps(3) imageI insertE insertI2 SyncHd_Tl) 
-  proof -
-    assume a1: "hd u \<in> ev ` B \<or> hd u \<in> ev ` B'"
-    assume a2: "r setinterleaves ((t, u), insert tick (ev ` S))"
-    assume a3: "setinterleaving (u, insert tick (ev ` S), ev aa # tl t) = 
-                {ev aa # ua |ua. ua setinterleaves ((u, tl t), insert tick (ev ` S))} \<union> 
-                {hd u # ua |ua. ua setinterleaves ((tl u, ev aa # tl t), insert tick (ev ` S))}"
-    assume a4: "hd t = ev aa"
-    assume a5: "t \<noteq> []"
-    assume a6: "aa \<in> A"
-    assume a7: "hd u \<notin> ev ` S"
-    assume a8: "B' \<union> S = S"
-    obtain ees :: "'a event list \<Rightarrow> 'a event list" where
-      f9: "((\<nexists>es. r = hd u # es \<and> es setinterleaves ((tl u, ev aa # tl t), insert tick (ev ` S))) \<or> 
-           r = hd u # ees r \<and> ees r setinterleaves ((tl u, ev aa # tl t), insert tick (ev ` S))) \<and> 
-          ((\<exists>es. r = hd u # es \<and> es setinterleaves ((tl u, ev aa # tl t), insert tick (ev ` S))) \<or> 
-          (\<forall>es. r \<noteq> hd u # es \<or> es \<notin> setinterleaving (tl u, insert tick (ev ` S), ev aa # tl t)))"
-      by fastforce
-    have f10: "ev aa # tl t = t"
-      using a5 a4 hd_Cons_tl by fastforce
-    then have f11: "r \<in> {ev aa # es |es. es setinterleaves ((u, tl t), insert tick (ev ` S))} \<union> 
-                        {hd u # es |es. es setinterleaves ((tl u, ev aa # tl t), insert tick (ev ` S))}"
-      using a3 a2 by (simp add: Sync.sym)
-    have f12: "\<forall>e f a A. (e::'a event) \<noteq> f (a::'a) \<or> a \<notin> A \<or> e \<in> f ` A"
-      by (meson image_eqI)
-    moreover
-    { assume "r \<noteq> hd u # ees r \<or> ees r \<notin> setinterleaving (tl u, insert tick (ev ` S), ev aa # tl t)"
-      then obtain eesa :: "'a event list \<Rightarrow> 'a event list" where
-        "r = ev aa # eesa r \<and> eesa r setinterleaves ((u, tl t), insert tick (ev ` S))"
-        using f11 f9 by fast
-      then have "hd r = ev aa \<and> hd r \<in> ev ` A \<and> tl r setinterleaves ((u, tl t), insert tick (ev ` S)) \<or> hd r = hd u \<and> hd r \<in> ev ` B \<and> tl r setinterleaves ((t, tl u), insert tick (ev ` S))"
-        using f12 a6 by (metis list.sel(1) list.sel(3)) }
-    ultimately show "hd r = ev aa \<and> hd r \<in> ev ` A \<and> tl r setinterleaves ((u, tl t), insert tick (ev ` S)) \<or> hd r = hd u \<and> hd r \<in> ev ` B \<and> tl r setinterleaves ((t, tl u), insert tick (ev ` S))"
-      using f10 a8 a7 a1 by (metis Sync.sym UnI1 image_Un list.sel(1) list.sel(3))
-  qed
-  with 9 show ?case 
-  proof(elim disjE conjE, goal_cases)
-    case 91:1
-    then show ?case
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving, simp)
-      apply(rule_tac conjI, metis empty_setinterleaving hd_append image_eqI)
-      apply(exI aa, rule_tac conjI, metis empty_setinterleaving hd_append2)   
-      apply(rule_tac disjI2, exI u, exI \<open>tl t\<close>, exI \<open>tl r\<close>, exI v, simp)  
-      by (metis Sync.sym empty_setinterleaving tickFree_tl tl_append2)
-  next
-    case 92:2
-    then show ?case
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI2, rule_tac disjI2, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving, simp)
-      apply(rule_tac conjI, metis empty_setinterleaving hd_append)
-      apply(exI ab, rule_tac conjI, metis empty_setinterleaving hd_append2)   
-      apply(rule_tac disjI2, exI \<open>tl u\<close>, exI \<open>t\<close>, exI \<open>tl r\<close>, exI v, simp)  
-      by (metis Sync.sym empty_setinterleaving tickFree_tl tl_append2)
-  qed 
-next
-  case (10 a b u t r v ab aa)
-  hence \<open>   (hd r = ev ab \<and> hd r \<in> ev ` B \<and> tl r setinterleaves ((t, tl u), insert tick (ev ` S))) 
-             \<or> (hd r = ev ab \<and> aa = ab \<and> hd r \<in> ev ` (A' \<inter> B') \<and> tl r setinterleaves ((tl t, tl u), insert tick (ev ` S)))\<close> 
-    using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>hd u\<close> \<open>tl u\<close>]
-    apply (simp del:si_neq split:if_splits) 
-    apply (metis (no_types, opaque_lifting) IntI Sync.sym UnE empty_iff event.inject image_iff insert_iff SyncSameHdTl)
-       apply (metis insert_iff SyncSameHdTl)
-    defer
-      apply (metis imageI subsetD)
-     apply (metis imageI subsetD)
-  proof 
-    assume a1: "hd u \<noteq> tick \<and> hd u \<notin> ev ` S"
-    assume a2: "ev aa \<in> ev ` S"
-    assume a3: "hd t = ev aa"
-    assume a4: "r setinterleaves ((u, t), insert tick (ev ` S))"
-    assume a5: "B' \<subseteq> S"
-    show \<open>hd r = hd u \<and> hd r \<in> ev ` B \<and> tl r setinterleaves ((t, tl u), insert tick (ev ` S))\<close>
-      apply safe
-        apply (metis "10"(8) Sync.sym a1 a2 a3 insertCI insertE SyncHd_Tl)
-       apply (metis (no_types, opaque_lifting) "10"(10) "10"(8) Sync.sym UnE a1 a2 a3 a5 image_Un insert_iff subset_eq subset_image_iff SyncHd_Tl)
-      by (metis Sync.sym a1 a2 a3 a4 insertCI insertE SyncHd_Tl)
-  qed
-  with 10 show ?case 
-  proof(elim disjE conjE, goal_cases)
-    case 101:1
-    then show ?case
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI2, rule_tac disjI2, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving, simp)
-      apply(rule_tac conjI, metis empty_setinterleaving hd_append)
-      apply(exI ab, rule_tac conjI, metis empty_setinterleaving hd_append2)   
-      apply(rule_tac disjI2, exI \<open>tl u\<close>, exI \<open>t\<close>, exI \<open>tl r\<close>, exI v, simp)  
-      by (metis Sync.sym empty_setinterleaving tickFree_tl tl_append2)   
-  next
-    case 102:2
-    then show ?case
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving)
-      apply(rule_tac disjI2, rule_tac disjI2, rule_tac disjI2, rule_tac disjI2, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac conjI, metis empty_setinterleaving hd_append2)
-      apply (exI aa, rule_tac conjI, metis empty_setinterleaving hd_append2)
-      apply (rule_tac disjI2, exI \<open>tl u\<close>, exI \<open>tl t\<close>, exI \<open>tl r\<close>, exI v, simp)
-      by (metis Sync.sym empty_setinterleaving tickFree_tl tl_append2)
-  qed    
-next
-  case (11 a b t u r v aa)
-  have 111:\<open>a = t@v\<close>
-     using 11(7,8,11) EmptyLeftSync Sync.sym by blast
-  hence 112:\<open>hd a \<in> ev ` A\<close>  
-    using emptyLeftNonSync[rule_format, of r \<open>insert tick (ev ` S)\<close> t \<open>hd t\<close>] 
-          11(10,11,2,8,9) Sync.sym by auto blast
-  with 11 show ?case 
-    apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, simp add:111)
-    apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, simp_all add:111) 
-    apply(rule_tac disjI1, exI aa, simp)
-    apply(rule_tac disjI2, exI \<open>tl t\<close>, exI u, exI \<open>tl r\<close>, exI v, simp)
-    by (simp add: Sync.sym SyncTlEmpty tickFree_tl)
-next
-  case (12 a b t u r v aa ab)
-  hence \<open>(hd r = ev aa \<and> hd r \<in> ev ` A \<and> tl r setinterleaves ((tl t, u), insert tick (ev ` S))) 
-         \<or> (hd r = ev ab \<and> hd r \<in> ev ` B \<and> tl r setinterleaves ((t, tl u), insert tick (ev ` S)))\<close>  
-    using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>hd u\<close> \<open>tl u\<close>] 
-    apply(simp del:si_neq split:if_splits, metis disjoint_iff event.inject image_iff, blast) 
-      apply (metis (no_types, lifting) event.simps(3) imageI insert_iff SyncHd_Tl)
-     defer apply blast
-  proof -
-    assume a1: "ab \<in> B"
-    assume a2: "r setinterleaves ((t, u), insert tick (ev ` S))"
-    assume a3: "setinterleaving (t, insert tick (ev ` S), ev ab # tl u) = 
-                {hd t # ua |ua. ua setinterleaves ((tl t, ev ab # tl u), insert tick (ev ` S))} \<union> 
-                {ev ab # ua |ua. ua setinterleaves ((t, tl u), insert tick (ev ` S))}"
-    assume a4: "hd u = ev ab"
-    assume a5: "u \<noteq> []"
-    assume a6: "hd t \<in> ev ` (A \<union> A')"
-    assume a7: "A' \<subseteq> S"
-    assume a8: "hd t \<notin> ev ` S"
-    have f9: "hd t \<in> ev ` A"
-      using a8 a7 a6 by blast
-    show "hd r = hd t \<and> hd r \<in> ev ` A \<and> tl r setinterleaves ((tl t, u), insert tick (ev ` S)) \<or> 
-          hd r = ev ab \<and> hd r \<in> ev ` B \<and> tl r setinterleaves ((t, tl u), insert tick (ev ` S))"
-    proof -
-      obtain ees :: "'a event list \<Rightarrow> 'a event list" where
-        f1: "((\<nexists>es. r = hd t # es \<and> es setinterleaves ((tl t, ev ab # tl u), insert tick (ev ` S))) \<or> 
-              r = hd t # ees r \<and> ees r setinterleaves ((tl t, ev ab # tl u), insert tick (ev ` S))) \<and> 
-             ((\<exists>es. r = hd t # es \<and> es setinterleaves ((tl t, ev ab # tl u), insert tick (ev ` S))) \<or> 
-              (\<forall>es. r \<noteq> hd t # es \<or> es \<notin> setinterleaving (tl t, insert tick (ev ` S), ev ab # tl u)))"
-        by meson
-      have f2: "ev ab # tl u = u"
-        using a5 by (subst a4[symmetric], rule list.collapse)
-      moreover
-      { assume "r \<noteq> hd t # ees r \<or> ees r \<notin> setinterleaving (tl t, insert tick (ev ` S), ev ab # tl u)"
-        then obtain eesa :: "'a event list \<Rightarrow> 'a event list" where
-          "r = ev ab # eesa r \<and> eesa r setinterleaves ((t, tl u), insert tick (ev ` S))"
-          using f2 f1 a2 a3 by fastforce
-        then have ?thesis
-          by (metis a1 imageI list.sel(1) list.sel(3)) }
-      ultimately show ?thesis
-        by (metis (no_types) f9 list.sel(1) list.sel(3))
-    qed 
-  qed    
-  with 12 show ?case 
-  proof(elim disjE conjE, goal_cases)
-    case 121:1
-    then show ?case
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving, simp)
-      apply(exI aa, rule_tac conjI, simp)   
-      by (rule_tac disjI2, exI \<open>tl t\<close>, exI u, exI \<open>tl r\<close>, exI v, simp)  
-  next
-    case 122:2
-    then show ?case
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI2, rule_tac disjI2, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving, simp)
-      by (rule_tac disjI2, exI \<open>t\<close>, exI \<open>tl u\<close>, exI \<open>tl r\<close>, exI v, simp)  blast
+    show \<open>s \<in> \<D> (?lhs A A' P B B' Q) \<Longrightarrow> (s, X) \<in> \<F> (?rhs A A' P B B' Q)\<close> 
+      using same_div NF_ND by blast
   qed
 next
-  case (13 a b t u r v aa ab)
-  hence \<open>   (hd r = ev aa \<and> hd r \<in> ev ` A \<and> tl r setinterleaves ((tl t, u), insert tick (ev ` S))) 
-             \<or> (hd r = ev ab \<and> aa = ab \<and> hd r \<in> ev ` (A' \<inter> B') \<and> tl r setinterleaves ((tl t, tl u), insert tick (ev ` S)))\<close> 
-    using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>hd u\<close> \<open>tl u\<close>]
-    apply (simp del:si_neq split:if_splits)
-    apply (metis (no_types, opaque_lifting) IntI UnE empty_iff event.inject image_iff insert_iff SyncSameHdTl) 
-       apply (metis empty_iff hd_Cons_tl, blast, blast) 
-  proof
-    assume a1: \<open>r setinterleaves ((t, u), insert tick (ev ` S))\<close>
-    assume a2: \<open>hd t \<in> ev ` (A \<union> A')\<close>
-    assume a3: \<open>hd t \<noteq> tick\<close>
-    assume a4: \<open>hd t \<notin> ev ` S\<close>
-    assume a5: \<open>ev ab \<in> ev ` S\<close>
-    assume a6: \<open>setinterleaving (t, insert tick (ev ` S), ev ab # tl u) = {hd t # ua |ua. ua setinterleaves ((tl t, ev ab # tl u), insert tick (ev ` S))}\<close>
-    show \<open>hd r = hd t \<and> hd r \<in> ev ` A \<and> tl r setinterleaves ((tl t, u), insert tick (ev ` S))\<close>
-      apply safe
-      using "13"(14) "13"(15) "13"(8) a6 list.collapse apply fastforce 
-      using "13"(14) "13"(15) "13"(2) a1 a2 a4 a6 list.collapse apply fastforce
-      by (metis "13"(15) Sync.sym a5 a3 a4 a1 insertCI insertE SyncHd_Tl)
-  qed
-  with 13 show ?case 
-  proof(elim disjE conjE, goal_cases)
-    case 131:1
-    then show ?case
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving, simp_all)
-      apply(exI aa, rule_tac conjI, simp)   
-      apply(rule_tac disjI2, exI \<open>tl t\<close>, exI u, exI \<open>tl r\<close>, exI v)
-      using 131(5) by blast 
-  next
-    case 132:2
-    then show ?case
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving)
-      apply(rule_tac disjI2, rule_tac disjI2, rule_tac disjI2, rule_tac disjI2, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac conjI, metis empty_setinterleaving hd_append2)
-      apply (exI aa, rule_tac conjI, metis empty_setinterleaving hd_append2)
-      apply (rule_tac disjI2, exI \<open>tl t\<close>, exI \<open>tl u\<close>, exI \<open>tl r\<close>, exI v) 
-      by (metis empty_setinterleaving tl_append2)    
-  qed    
-next
-  case (14 a b u t r v aa)
-  have 141:\<open>r = u\<close>
-     using 14 EmptyLeftSync Sync.sym by blast
-  hence 142:\<open>hd r \<in> ev ` B\<close>  
-    using emptyLeftNonSync[rule_format, of r \<open>insert tick (ev ` S)\<close> u \<open>hd u\<close>] 
-          14 Sync.sym by auto blast
-  with 14 show ?case 
-     apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, simp add:141) 
-     apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-     apply(intro disjI2 conjI, simp_all add:141 142) 
-     apply(exI aa, simp add:141) 
-     apply(rule_tac disjI2,  exI \<open>tl u\<close>, exI t, exI \<open>tl r\<close>, exI v) 
-    by (simp add: "141" Sync.sym SyncTlEmpty tickFree_tl)
-next
-  case (15 a b u t r v ab aa)
-  hence \<open>(hd r = ev aa \<and> hd r \<in> ev ` A \<and> tl r setinterleaves ((tl t, u), insert tick (ev ` S))) 
-         \<or> (hd r = ev ab \<and> hd r \<in> ev ` B \<and> tl r setinterleaves ((t, tl u), insert tick (ev ` S)))\<close>  
-    using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>hd u\<close> \<open>tl u\<close>]
-    apply(simp del:si_neq split:if_splits, metis disjoint_iff event.inject image_iff, blast, blast) 
-    defer
-     apply (metis (no_types, lifting) Sync.sym event.simps(3) imageI insertE insertI2 SyncHd_Tl)
-  proof -
-    assume a1: "hd u \<in> ev ` (B \<union> B')"
-    assume a2: "B' \<subseteq> S"
-    assume a3: "hd u \<notin> ev ` S"
-    assume a4: "r setinterleaves ((u, t), insert tick (ev ` S))"
-    assume a5: "setinterleaving (ev aa # tl t, insert tick (ev ` S), u) = 
-                {ev aa # ua |ua. ua setinterleaves ((tl t, u), insert tick (ev ` S))} \<union> 
-                {hd u # ua |ua. ua setinterleaves ((ev aa # tl t, tl u), insert tick (ev ` S))}"
-    assume a6: "hd t = ev aa"
-    assume a7: "t \<noteq> []"
-    assume a8: "aa \<in> A"
-    have f9: "hd u \<in> ev ` B"
-      using a3 a2 a1 by fast
-    have f10: "ev aa # tl t = t"
-      using a7 a6 hd_Cons_tl by fastforce
-    then have "r \<in> {ev aa # es |es. es setinterleaves ((tl t, u), insert tick (ev ` S))} \<union> 
-                   {hd u # es |es. es setinterleaves ((ev aa # tl t, tl u), insert tick (ev ` S))}"
-      using a5 a4 by (simp add: Sync.sym)
-    then show "hd r = ev aa \<and> hd r \<in> ev ` A \<and> tl r setinterleaves ((tl t, u), insert tick (ev ` S)) \<or> 
-               hd r = hd u \<and> hd r \<in> ev ` B \<and> tl r setinterleaves ((t, tl u), insert tick (ev ` S))"
-      using f10 f9 a8 by fastforce
-  qed  
-  with 15 show ?case 
-  proof(elim disjE conjE, goal_cases)
-    case 151:1
-    then show ?case
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving, simp)
-      apply(rule_tac disjI2, exI u, exI \<open>tl t\<close>, exI \<open>tl r\<close>, exI v, simp)
-      using Sync.sym by blast
-  next
-    case 152:2
-    then show ?case
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI2, rule_tac disjI2, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving, simp)
-      apply(exI ab, rule_tac conjI, simp)   
-      apply(rule_tac disjI2, exI \<open>tl u\<close>, exI \<open>t\<close>, exI \<open>tl r\<close>, exI v, simp)  
-      by (metis Sync.sym)
-  qed 
-next
-  case (16 a b u t r v ab aa)
-  hence \<open>   (hd r = ev ab \<and> hd r \<in> ev ` B \<and> tl r setinterleaves ((t, tl u), insert tick (ev ` S))) 
-             \<or> (hd r = ev ab \<and> aa = ab \<and> hd r \<in> ev ` (A' \<inter> B') \<and> tl r setinterleaves ((tl t, tl u), insert tick (ev ` S)))\<close> 
-    using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>hd u\<close> \<open>tl u\<close>]
-    apply (simp del:si_neq split:if_splits) 
-        apply (metis (no_types, opaque_lifting) "16"(11) "16"(3) Int_iff Sync.sym UnE empty_iff event.inject imageE imageI insertCI SyncSameHdTl)
-       apply (metis insert_iff SyncSameHdTl)
-      defer
-      apply (metis imageI subsetD)
-     apply (metis imageI subsetD)
-  proof -
-    assume a1: "hd u \<noteq> tick \<and> hd u \<notin> ev ` S"
-    assume a2: "B' \<subseteq> S"
-    assume a3: "hd u \<in> ev ` (B \<union> B')"
-    assume a4: "r setinterleaves ((u, t), insert tick (ev ` S))"
-    assume a5: "setinterleaving (ev aa # tl t, insert tick (ev ` S), u) = 
-                {hd u # ua |ua. ua setinterleaves ((ev aa # tl t, tl u), insert tick (ev ` S))}"
-    assume a6: "hd t = ev aa"
-    assume a7: "t \<noteq> []"
-    have f8: "B' \<union> S = S"
-      using a2 by blast
-    have f9: "ev aa # tl t = t"
-      using a7 a6 hd_Cons_tl by fastforce
-    then have "\<exists>es. r = hd u # es \<and> es setinterleaves ((ev aa # tl t, tl u), insert tick (ev ` S))"
-      using a5 a4 by (simp add: Sync.sym)
-    then show "hd r = hd u \<and> hd r \<in> ev ` B \<and> tl r setinterleaves ((t, tl u), insert tick (ev ` S)) \<or> 
-               hd r = hd u \<and> aa = ab \<and> hd r \<in> ev ` (A' \<inter> B') \<and> tl r setinterleaves ((tl t, tl u), insert tick (ev ` S))"
-      using f9 f8 a3 a1 by (metis Un_iff image_Un list.sel(1) list.sel(3))
-  qed
-  with 16 show ?case 
-  proof(elim disjE conjE, goal_cases)
-    case 161:1
-    then show ?case
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac disjI2, rule_tac disjI2, rule_tac disjI2, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving, simp)
-      apply(exI ab, rule_tac conjI, simp)   
-      apply(rule_tac disjI2, exI \<open>tl u\<close>, exI \<open>t\<close>, exI \<open>tl r\<close>, exI v, simp)  
-      by (metis Sync.sym)   
-  next
-    case 162:2
-    then show ?case
-      apply(rule_tac disjI2, rule_tac disjI1, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving)
-      apply(rule_tac disjI2, rule_tac disjI2, rule_tac disjI2, rule_tac disjI2, rule_tac conjI, metis append_is_Nil_conv empty_setinterleaving) 
-      apply(rule_tac conjI, metis empty_setinterleaving hd_append2)
-      apply (exI aa, rule_tac conjI, metis empty_setinterleaving hd_append2)
-      apply (rule_tac disjI2, exI \<open>tl u\<close>, exI \<open>tl t\<close>, exI \<open>tl r\<close>, exI v, simp)
-      by (metis Sync.sym)
-  qed 
-next 
-  case (17 aA bB)
-  have tact:\<open>\<And>P Q. \<nexists>t u r v. P t u r v \<Longrightarrow> Q \<or> (\<exists> t u r v. P t u r v) \<Longrightarrow> Q\<close>
-    by fastforce
-  from 17 show ?case 
-  proof (safe, goal_cases)
-    case 1
-    obtain X where 11: "(X::'a event set)= bB - ev ` A'" by auto 
-    obtain Y where 12: "(Y::'a event set)= bB - ev ` B'" by auto 
-    from 1 11 12 have 13: "bB = (X \<union> Y) \<inter> insert tick (ev ` S) \<union> X \<inter> Y" 
-      by auto
-    with 11 12 1 show ?case 
-      apply(exI \<open>[]\<close>, exI \<open>[]\<close>, exI X, rule_tac conjI) 
-       apply safe
-            apply (metis disjoint_iff_not_equal imageI)
-           apply (metis image_iff)
-          apply (metis disjoint_iff imageI)  
-         apply (metis IntI image_eqI)
-        apply (metis image_eqI)
-       apply (metis rev_image_eqI)
-      by (exI Y) (simp add: disjoint_iff image_Un)
-  next
-    case (2 x a t u X Y)
-    then show ?case
-      apply(erule_tac tact)
-      apply(rule_tac disjI1, exI \<open>ev x#t\<close>, exI \<open>[]\<close>, exI X, rule conjI, simp)
-      by (exI Y, simp, metis disjoint_iff event.inject hd_Cons_tl imageE)
-  next
-    case (3 x a t u X Y xa aa)
-    then show ?case 
-      apply(erule_tac tact)
-      apply(rule_tac disjI1, exI \<open>ev x#t\<close>, exI \<open>u\<close>, exI X, rule conjI, simp)
-      apply (exI Y, simp)
-      using hd_Cons_tl SyncSingleHeadAdd by fastforce+
-  next
-    case (4 x a t u X Y xa aa)
-    then show ?case
-      apply(erule_tac tact)
-      apply(rule_tac disjI1, exI \<open>ev x#t\<close>, exI \<open>u\<close>, exI X, rule conjI, simp)
-      apply (exI Y, simp)
-      using hd_Cons_tl SyncSingleHeadAdd by fastforce+
-  next
-    case (5 x a t u r v)
-    then show ?case
-      apply(erule_tac tact)
-      apply(rule_tac disjI2, exI \<open>ev x#t\<close>, exI \<open>[]\<close>, exI \<open>ev x#r\<close>, exI v, simp)   
-      by (metis disjoint_iff event.inject hd_Cons_tl imageE)
-  next
-    case (6 x a t u r v aa)
-    then show ?case
-      apply(erule_tac tact)
-      apply(rule_tac disjI2, exI \<open>ev x#t\<close>, exI \<open>u\<close>, exI \<open>ev x#r\<close>, exI v, simp)      
-      using hd_Cons_tl SyncSingleHeadAdd by fastforce+
-  next
-    case (7 x a t u r v aa)
-    then show ?case
-      apply(erule_tac tact)
-      apply(rule_tac disjI2, exI \<open>ev x#t\<close>, exI \<open>u\<close>, exI \<open>ev x#r\<close>, exI v, simp)      
-      using hd_Cons_tl SyncSingleHeadAdd by fastforce+
-  next
-    case (8 x a u t r v xa aa)
-    then show ?case 
-      apply(erule_tac tact)
-      apply(rule_tac disjI2, exI \<open>u\<close>, exI \<open>ev x#t\<close>, exI \<open>ev x#r\<close>, exI \<open>v\<close>, simp)           
-      using si_neq[of \<open>ev x\<close> \<open>t\<close> \<open>insert tick (ev ` S)\<close> \<open>hd u\<close> \<open>tl u\<close>]    
-      apply (simp add: SyncSingleHeadAdd split: if_splits, blast, blast)
-      by (metis Sync.sym SyncSingleHeadAdd event.distinct(1) insert_iff list.collapse) blast
-  next
-    case (9 x a u t r v xa aa)
-    then show ?case      
-      apply(erule_tac tact)
-      apply(rule_tac disjI2, exI \<open>u\<close>, exI \<open>ev x#t\<close>, exI \<open>ev x#r\<close>, exI \<open>v\<close>, simp)           
-      using si_neq[of \<open>ev x\<close> \<open>t\<close> \<open>insert tick (ev ` S)\<close> \<open>hd u\<close> \<open>tl u\<close>]    
-      apply (simp add: SyncSingleHeadAdd split: if_splits, blast, blast, blast) 
-      by (metis SyncHdAdd1 event.distinct(1) insert_iff list.collapse)
-  next
-    case (10 x a t u r v)
-    then show ?case 
-      apply(erule_tac tact)
-      apply(rule_tac disjI2, exI \<open>ev x#t\<close>, exI \<open>[]\<close>, exI \<open>ev x#r\<close>, exI \<open>[]\<close>, simp)      
-      by (metis disjoint_iff event.inject hd_Cons_tl imageE)
-  next
-    case (11 x a t u r v aa)
-    then show ?case
-      apply(erule_tac tact)
-      apply(rule_tac disjI2, exI \<open>ev x#t\<close>, exI \<open>u\<close>, exI \<open>ev x#r\<close>, exI \<open>[]\<close>, simp)
-      using SyncSingleHeadAdd list.collapse by fastforce
-  next
-    case (12 x a t u r v aa)
-    then show ?case 
-      apply(erule_tac tact)
-      apply(rule_tac disjI2, exI \<open>ev x#t\<close>, exI \<open>u\<close>, exI \<open>ev x#r\<close>, exI \<open>[]\<close>, simp)
-      using SyncSingleHeadAdd list.collapse by fastforce
-  next
-    case (13 x a u t r v xa aa)
-    then show ?case
-      apply(erule_tac tact)
-      apply(rule_tac disjI2, exI \<open>u\<close>, exI \<open>ev x#t\<close>, exI \<open>ev x#r\<close>, exI \<open>[]\<close>, simp)      
-      using si_neq[of \<open>ev x\<close> \<open>t\<close> \<open>insert tick (ev ` S)\<close> \<open>hd u\<close> \<open>tl u\<close>]
-      apply (simp add: SyncSingleHeadAdd split: if_splits, blast, blast)
-      by (metis Sync.sym SyncSingleHeadAdd event.distinct(1) insert_iff list.collapse) blast
-  next
-    case (14 x a u t r v xa aa)
-    then show ?case 
-      apply(erule_tac tact)
-      apply(rule_tac disjI2, exI \<open>u\<close>, exI \<open>ev x#t\<close>, exI \<open>ev x#r\<close>, exI \<open>[]\<close>, simp)   
-      using si_neq[of \<open>ev x\<close> \<open>t\<close> \<open>insert tick (ev ` S)\<close> \<open>hd u\<close> \<open>tl u\<close>]    
-      apply (simp add: SyncSingleHeadAdd split: if_splits, blast, blast, blast)
-      by (metis SyncHdAdd1 event.distinct(1) insert_iff list.collapse)
-  next
-    case (15 x a t u X Y)
-    then show ?case 
-      apply(erule_tac tact)
-      apply(rule_tac disjI1, exI \<open>[]\<close>, exI \<open>ev x#u\<close>, exI X, rule conjI, simp)
-      by (exI Y, simp, metis disjoint_iff event.inject hd_Cons_tl imageE)
-  next
-    case (16 x a t u X Y xa aa)
-    then show ?case 
-      apply(erule_tac tact)
-      apply(rule_tac disjI1, exI \<open>t\<close>, exI \<open>ev x#u\<close>, exI X, rule conjI, simp, exI Y, simp)
-      using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>ev x\<close> \<open>tl u\<close>]    
-      apply (simp add: SyncSingleHeadAdd split: if_splits, blast, blast, blast)
-      by (metis Sync.sym SyncSingleHeadAdd event.distinct(1) insert_iff list.collapse) blast
-  next
-    case (17 x a t u X Y xa aa)
-    then show ?case 
-      apply(erule_tac tact)
-      apply(rule_tac disjI1, exI \<open>t\<close>, exI \<open>ev x#u\<close>, exI X, rule conjI, simp)      
-      apply (exI Y, simp) 
-      using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>ev x\<close> \<open>tl u\<close>]    
-      apply (simp add: SyncSingleHeadAdd split: if_splits, blast, blast) sledgehammer
-      using SyncHdAdd by fastforce blast+
-  next
-    case (18 x a t u r v xa aa)
-    then show ?case
-      apply(erule_tac tact)
-      apply(rule_tac disjI2, exI \<open>t\<close>, exI \<open>ev x#u\<close>, exI \<open>ev x#r\<close>, exI \<open>v\<close>, simp)           
-      using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>ev x\<close> \<open>u\<close>]    
-      apply (simp add: SyncSingleHeadAdd split: if_splits, blast, blast, blast)
-      by (metis Sync.sym SyncSingleHeadAdd event.distinct(1) insert_iff list.collapse) blast
-  next
-    case (19 x a t u r v xa aa)
-    then show ?case 
-      apply(erule_tac tact)
-      apply(rule_tac disjI2, exI \<open>t\<close>, exI \<open>ev x#u\<close>, exI \<open>ev x#r\<close>, exI \<open>v\<close>, simp)           
-      using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>ev x\<close> \<open>u\<close>]    
-      apply (simp add: SyncSingleHeadAdd split: if_splits, blast, blast)
-      by (metis SyncHdAdd1 event.distinct(1) insert_iff list.collapse) blast+
-  next
-    case (20 x a u t r v)
-    then show ?case 
-      apply(erule_tac tact)
-      apply(rule_tac disjI2, exI \<open>ev x#u\<close>, exI \<open>[]\<close>, exI \<open>ev x#r\<close>, exI \<open>v\<close>, simp)      
-      by (metis disjoint_iff event.inject hd_Cons_tl imageE)
-  next
-    case (21 x a u t r v aa)
-    then show ?case 
-      apply(erule_tac tact)
-      apply(rule_tac disjI2, exI \<open>ev x#u\<close>, exI \<open>t\<close>, exI \<open>ev x#r\<close>, exI \<open>v\<close>, simp)
-      using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>ev x\<close> \<open>u\<close>]
-      apply (simp add: SyncSingleHeadAdd split: if_splits, blast, blast, blast)
-      by (metis list.collapse) blast
-  next
-    case (22 x a u t r v aa)
-    then show ?case
-      apply(erule_tac tact) 
-      apply(rule_tac disjI2, exI \<open>ev x#u\<close>, exI \<open>t\<close>, exI \<open>ev x#r\<close>, exI \<open>v\<close>, simp)      
-      using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>ev x\<close> \<open>u\<close>]    
-      apply (simp add: SyncSingleHeadAdd split: if_splits, blast, blast)
-      by (metis list.exhaust_sel) blast+
-  next
-    case (23 x a t u r v xa aa)
-    then show ?case
-      apply(erule_tac tact)
-      apply(rule_tac disjI2, exI \<open>t\<close>, exI \<open>ev x#u\<close>, exI \<open>ev x#r\<close>, exI \<open>[]\<close>, simp)           
-      using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>ev x\<close> \<open>u\<close>]    
-      apply (simp add: SyncSingleHeadAdd split: if_splits, blast, blast, blast)
-      by (metis Sync.sym SyncSingleHeadAdd event.distinct(1) insert_iff list.collapse) blast   
-  next
-    case (24 x a t u r v xa aa)
-    then show ?case 
-      apply(erule_tac tact)
-      apply(rule_tac disjI2, exI \<open>t\<close>, exI \<open>ev x#u\<close>, exI \<open>ev x#r\<close>, exI \<open>[]\<close>, simp)           
-      using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>ev x\<close> \<open>u\<close>]    
-      apply (simp add: SyncSingleHeadAdd split: if_splits, blast, blast) sledgehammer
-      using SyncHdAdd1 list.collapse by fastforce blast+
-  next
-    case (25 x a t u r v)
-    then show ?case 
-      apply(erule_tac tact)
-      apply(rule_tac disjI2, exI \<open>ev x#t\<close>, exI \<open>[]\<close>, exI \<open>ev x#r\<close>, exI \<open>[]\<close>, simp)      
-      by (metis disjoint_iff event.inject hd_Cons_tl imageE)
-  next
-    case (26 x a u t r v aa)
-    then show ?case 
-      apply(erule_tac tact) 
-      apply(rule_tac disjI2, exI \<open>ev x#u\<close>, exI \<open>t\<close>, exI \<open>ev x#r\<close>, exI \<open>[]\<close>, simp)      
-      using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>ev x\<close> \<open>u\<close>]    
-      apply (simp add: SyncSingleHeadAdd split: if_splits, blast, blast, blast)
-      by (metis list.collapse) blast
-  next
-    case (27 x a u t r v aa)
-    then show ?case 
-      apply(erule_tac tact) 
-      apply(rule_tac disjI2, exI \<open>ev x#u\<close>, exI \<open>t\<close>, exI \<open>ev x#r\<close>, exI \<open>[]\<close>, simp)      
-      using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>ev x\<close> \<open>u\<close>]    
-      apply (simp add: SyncSingleHeadAdd split: if_splits, blast, blast) sledgehammer
-      by (metis list.collapse) blast+
-  next
-    case (28 x a t u X Y)
-    then show ?case 
-      apply(erule_tac tact)
-      apply(rule_tac disjI1, exI \<open>ev x#t\<close>, exI \<open>ev x#u\<close>, exI X, rule conjI, simp)
-      by (exI Y, simp, metis hd_Cons_tl image_eqI in_mono)
-  next
-    case (29 x a t u r v)
-    then show ?case 
-      apply(erule_tac tact)
-      apply(rule_tac disjI2, exI \<open>ev x#t\<close>, exI \<open>ev x#u\<close>, exI \<open>ev x#r\<close>, exI \<open>v\<close>, simp)  
-      by (metis image_eqI list.exhaust_sel subsetD)  
-  next
-    case (30 x a t u r v)
-    then show ?case 
-      apply(erule_tac tact)
-      apply(rule_tac disjI2, exI \<open>ev x#t\<close>, exI \<open>ev x#u\<close>, exI \<open>ev x#r\<close>, exI \<open>v\<close>, simp)  
-      by (metis image_eqI list.exhaust_sel subsetD)  
-  next
-    case (31 x a t u r v)
-    then show ?case       
-      apply(erule_tac tact)
-      apply(rule_tac disjI2, exI \<open>ev x#t\<close>, exI \<open>ev x#u\<close>, exI \<open>ev x#r\<close>, exI \<open>[]\<close>, simp)  
-      by (metis image_eqI list.exhaust_sel subsetD) 
-  next
-    case (32 x a t u r v)
-    then show ?case 
-      apply(erule_tac tact)
-      apply(rule_tac disjI2, exI \<open>ev x#t\<close>, exI \<open>ev x#u\<close>, exI \<open>ev x#r\<close>, exI \<open>[]\<close>, simp)  
-      by (metis image_eqI list.exhaust_sel subsetD) 
-  qed
+  
+  fix s X
+  { fix P Q A A' B B'
+    assume assms : \<open>s \<noteq> []\<close> \<open>(s, X) \<in> \<F> (\<box>x \<in> A \<rightarrow> (P x \<lbrakk>S\<rbrakk> Mprefix (B \<union> B') Q))\<close>
+                   \<open>A \<inter> S = {}\<close> \<open>A' \<subseteq> S\<close> \<open>B \<inter> S = {}\<close> \<open>B' \<subseteq> S\<close>
+       and same_div : \<open>\<D> (?lhs A A' P B B' Q) = \<D> (?rhs A A' P B B' Q)\<close>
+    from assms(1, 2) obtain e 
+      where * : \<open>e \<in> A\<close> \<open>hd s = ev e\<close> \<open>(tl s, X) \<in> \<F> (P e \<lbrakk>S\<rbrakk> Mprefix (B \<union> B') Q)\<close>
+      by (auto simp add: F_Mprefix)
+    from "*" assms(1) consider 
+        \<open>\<exists>s_P s_Q X_P X_Q. (s_P, X_P) \<in> \<F> (P e) \<and> (s_Q, X_Q) \<in> \<F> (Mprefix (B \<union> B') Q) \<and> 
+         tl s setinterleaves ((s_P, s_Q), ev ` S \<union> {tick}) \<and> X = (X_P \<union> X_Q) \<inter> (ev ` S \<union> {tick}) \<union> X_P \<inter> X_Q\<close>
+        | \<open>s \<in> \<D> (\<box>x \<in> A \<rightarrow> (P x \<lbrakk>S\<rbrakk> Mprefix (B \<union> B') Q))\<close> 
+      by (force simp add: F_Sync D_Mprefix D_Sync)
+    hence \<open>(s, X) \<in> \<F> (?lhs A A' P B B' Q)\<close>
+    proof cases
+      case 1
+      then obtain s_P s_Q X_P X_Q 
+        where ** : \<open>(s_P, X_P) \<in> \<F> (P e)\<close> \<open>(s_Q, X_Q) \<in> \<F> (Mprefix (B \<union> B') Q)\<close> 
+                   \<open>tl s setinterleaves ((s_P, s_Q), ev ` S \<union> {tick})\<close> 
+                   \<open>X = (X_P \<union> X_Q) \<inter> (ev ` S \<union> {tick}) \<union> X_P \<inter> X_Q\<close> by blast
+      show \<open>(s, X) \<in> \<F> (?lhs A A' P B B' Q)\<close>
+        apply (simp add: F_Sync, rule disjI1)
+        apply (rule_tac x = \<open>ev e # s_P\<close> in exI, rule_tac x = s_Q in exI,
+               rule_tac x = X_P in exI, intro conjI)
+         apply (simp add: F_Mprefix image_iff "*"(1) "**"(1))
+        apply (rule_tac x = X_Q in exI, simp add: "**"(2, 4))
+        apply (subst list.collapse[OF assms(1), symmetric])
+        using "*"(1, 2) "**"(3) assms(3) by (cases s_Q) auto 
+    next
+      assume \<open>s \<in> \<D> (\<box>x\<in>A \<rightarrow> (P x \<lbrakk>S\<rbrakk> Mprefix (B \<union> B') Q))\<close>
+      hence \<open>s \<in> \<D> (?lhs A A' P B B' Q)\<close> by (simp add: same_div D_Det)
+      thus \<open>(s, X) \<in> \<F> (?lhs A A' P B B' Q)\<close> using NF_ND by blast
+    qed
+  } note * = this
+
+  { assume assms : \<open>s \<noteq> []\<close> \<open>(s, X) \<in> \<F> (\<box>x\<in>A' \<inter> B' \<rightarrow> (P x \<lbrakk>S\<rbrakk> Q x))\<close>
+       and same_div : \<open>\<D> (?lhs A A' P B B' Q) = \<D> (?rhs A A' P B B' Q)\<close>
+    then obtain e where * : \<open>e \<in> A'\<close> \<open>e \<in> B'\<close> \<open>hd s = ev e\<close> \<open>(tl s, X) \<in> \<F> (P e \<lbrakk>S\<rbrakk> Q e)\<close>
+      by (auto simp add: F_Mprefix)
+    have inside: \<open>e \<in> S\<close> using "*"(2) that(4) by blast
+    from "*" assms(1) consider 
+        \<open>\<exists>s_P s_Q X_P X_Q. (s_P, X_P) \<in> \<F> (P e) \<and> (s_Q, X_Q) \<in> \<F> (Q e) \<and>
+         tl s setinterleaves ((s_P, s_Q), ev ` S \<union> {tick}) \<and>
+         X = (X_P \<union> X_Q) \<inter> (ev ` S \<union> {tick}) \<union> X_P \<inter> X_Q\<close>
+        | \<open>s \<in> \<D> (\<box>x\<in>A' \<inter> B' \<rightarrow> (P x \<lbrakk>S\<rbrakk> Q x))\<close>
+      by (force simp add: F_Sync D_Mprefix D_Sync)
+    hence \<open>(s, X) \<in> \<F> (?lhs A A' P B B' Q)\<close>
+    proof cases
+      case 1
+      then obtain s_P s_Q X_P X_Q 
+        where ** : \<open>(s_P, X_P) \<in> \<F> (P e)\<close> \<open>(s_Q, X_Q) \<in> \<F> (Q e)\<close> 
+                   \<open>tl s setinterleaves ((s_P, s_Q), ev ` S \<union> {tick})\<close> 
+                   \<open>X = (X_P \<union> X_Q) \<inter> (ev ` S \<union> {tick}) \<union> X_P \<inter> X_Q\<close> by blast
+      show \<open>(s, X) \<in> \<F> (?lhs A A' P B B' Q)\<close>
+        apply (subst list.collapse[OF assms(1), symmetric], simp add: F_Sync "*"(3), rule disjI1)
+        apply (rule_tac x = \<open>ev e # s_P\<close> in exI, rule_tac x = \<open>ev e # s_Q\<close> in exI)
+        apply (rule_tac x = X_P in exI, intro conjI, simp add: F_Mprefix "*"(1) "**"(1))
+        using "**"(3) by (rule_tac x = X_Q in exI) (simp add: "*"(2) "**"(2, 4) inside F_Mprefix)
+    next
+      assume \<open>s \<in> \<D> (\<box>x\<in>A' \<inter> B' \<rightarrow> (P x \<lbrakk>S\<rbrakk> Q x))\<close>
+      hence \<open>s \<in> \<D> (?lhs A A' P B B' Q)\<close> by (simp add: same_div D_Det)
+      thus \<open>(s, X) \<in> \<F> (?lhs A A' P B B' Q)\<close> using NF_ND by blast
+    qed
+  } note ** = this
+  
+  have *** : \<open>X \<inter> ev ` (A' \<inter> B') = {} \<Longrightarrow> X \<inter> ev ` A = {} \<Longrightarrow> X \<inter> ev ` B = {} \<Longrightarrow> 
+              ([], X) \<in> \<F> (?lhs A A' P B B' Q)\<close>
+    apply (simp add: F_Sync, rule disjI1)
+    apply (rule_tac x = \<open>[]\<close> in exI, rule_tac x = \<open>[]\<close> in exI, simp add: F_Mprefix)
+    apply (rule_tac x = \<open>X - (ev ` (A' - B'))\<close> in exI, intro conjI, fastforce)
+    apply (rule_tac x = \<open>X - (ev ` (B' - A'))\<close> in exI, intro conjI, fastforce)
+    using sets_assms(2, 4) by auto
+
+  assume same_div : \<open>\<D> (?lhs A A' P B B' Q) = \<D> (?rhs A A' P B B' Q)\<close>
+  hence same_div_sym : \<open>\<D> (?lhs B B' Q A A' P) = \<D> (?rhs B B' Q A A' P)\<close>
+    by (subst Sync_commute, subst Int_commute, subst Det_commute, simp add: Sync_commute)
+  show \<open>(s, X) \<in> \<F> (?rhs A A' P B B' Q) \<Longrightarrow> (s, X) \<in> \<F> (?lhs A A' P B B' Q)\<close>
+    apply (auto simp add: F_Det)
+         apply (rule "***"; simp add: F_Mprefix)
+        apply (rule "*"; simp add: sets_assms same_div)
+       apply (subst (asm) Sync_commute, subst Sync_commute)
+       apply (rule "*"; simp add: sets_assms same_div_sym)
+      apply (erule "**", assumption, rule same_div)
+     apply (simp add: D_Mprefix D_Det)[1]
+    by (simp add: T_Mprefix T_Det)
 next
-  case (18 aA)
-  then show ?case
-  proof(elim exE disjE conjE, goal_cases)
-    case (1 t u r v a)
-      have 11:\<open>r = t\<close>
-        using 1 EmptyLeftSync Sync.sym by blast
-      hence 12:\<open>hd aA \<in> ev ` A\<close>  
-        using emptyLeftNonSync[rule_format, of r \<open>insert tick (ev ` S)\<close> t \<open>hd t\<close>] 
-          1 Sync.sym by auto blast
-    with 1 11 show ?case 
-      apply(rule_tac disjI1, simp) 
-      by (metis Sync.sym SyncTlEmpty tickFree_tl)
-  next
-    case (2 t u r v a aa)
-    hence \<open>(hd r = ev a \<and> hd r \<in> ev ` A \<and> tl r setinterleaves ((tl t, u), insert tick (ev ` S))) 
-         \<or> (hd r = ev aa \<and> hd r \<in> ev ` B \<and> tl r setinterleaves ((t, tl u), insert tick (ev ` S)))\<close>  
-      using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>hd u\<close> \<open>tl u\<close>]
-      apply(simp del:si_neq split:if_splits, blast , metis empty_iff hd_Cons_tl) 
-        apply (metis (no_types, lifting) event.simps(3) imageI insert_iff SyncHd_Tl) 
-       defer
-       apply blast
-    proof(safe, simp_all add: in_mono, goal_cases)
-      case (1 x)
-      show ?case
-        using "1"(18) "1"(21) "2"(14) "2"(15) "2"(8) list.collapse by fastforce
-    next
-      case (2 x)
-      show ?case
-        using "2"(13) "2"(14) "2"(18) "2"(20) "2"(21) "2"(8) list.collapse by fastforce
-    next
-      case (3 x)
-      show ?case
-        using "2"(14) "2"(15) "2"(8) "3"(18) "3"(21) list.collapse by fastforce
-    next
-      case (4 x)
-      show ?case
-        using "2"(13) "2"(14) "2"(15) "2"(8) "4"(18) "4"(21) list.collapse by fastforce 
-    next
-      case (5 x)
-      show ?case
-        using "2"(14) "2"(15) "2"(8) "5"(18) "5"(21) list.collapse by fastforce
-    next
-      case (6 x)
-      show ?case
-        using "6"(13) "6"(14) "6"(18) "6"(8) hd_Cons_tl "2"(13) "6"(20) "6"(21) by fastforce
-    next
-      case (7 x)
-      show ?case
-        using "2"(13) "2"(14) "2"(15) "2"(8) "7"(18) "7"(21) list.collapse by fastforce 
-    next
-      case (8 x)
-      show ?case
-        using "8"(20) "8"(21) "8"(13) "8"(14) "8"(18) "8"(8) hd_Cons_tl by fastforce
-    next
-      case (9 x)
-      show ?case
-        using "9"(21) "9"(13) "9"(14) "9"(13) "9"(14) "9"(18) "9"(8) hd_Cons_tl by fastforce
-    qed
-    with 2 show ?case 
-      by (simp add: hd_append) (metis empty_setinterleaving tickFree_tl)
-  next
-    case (3 t u r v a aa)
-    hence \<open>   (hd r = ev a \<and> hd r \<in> ev ` A \<and> tl r setinterleaves ((tl t, u), insert tick (ev ` S))) 
-               \<or> (hd r = ev aa \<and> aa = a \<and> hd r \<in> ev ` (A' \<inter> B') \<and> tl r setinterleaves ((tl t, tl u), insert tick (ev ` S)))\<close> 
-      using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>hd u\<close> \<open>tl u\<close>]
-      apply (simp del:si_neq split:if_splits) 
-            apply (simp add:  UnE disjoint_iff imageE insertI2 rev_image_eqI)
-            apply (metis (no_types, lifting) Int_iff Un_iff event.inject imageE image_eqI insertCI SyncSameHdTl)
-         apply (metis insert_iff SyncSameHdTl)
-        apply (metis imageI subsetD)
-       apply (metis imageI subsetD) 
-      by (metis (no_types, opaque_lifting) "3"(10) "3"(2) Sync.sym Un_iff image_Un subset_insertI sup.orderE SyncHd_Tl SyncSameHdTl)
-    with 3 show ?case 
-      by (simp add: hd_append) (metis Sync.sym empty_setinterleaving tickFree_tl)
-  next
-    case (4 u t r v a)
-    have 41:\<open>r = u\<close>
-      using 4 EmptyLeftSync Sync.sym by blast
-    hence 42:\<open>hd aA \<in> ev ` B\<close>  
-      using emptyLeftNonSync[rule_format, of r \<open>insert tick (ev ` S)\<close> u \<open>hd u\<close>] 
-            4 Sync.sym by auto blast
-    with 4 41 show ?case 
-      apply(rule_tac disjI2, rule_tac disjI1, simp)       
-      by (metis Sync.sym SyncTlEmpty tickFree_tl)
-  next
-    case (5 u t r v aa a)
-    hence \<open>(hd r = ev a \<and> hd r \<in> ev ` A \<and> tl r setinterleaves ((tl t, u), insert tick (ev ` S))) 
-         \<or> (hd r = ev aa \<and> hd r \<in> ev ` B \<and> tl r setinterleaves ((t, tl u), insert tick (ev ` S)))\<close>  
-      using si_neq[of \<open>hd u\<close> \<open>tl u\<close> \<open>insert tick (ev ` S)\<close> \<open>hd t\<close> \<open>tl t\<close> ]
-      apply(simp del:si_neq split:if_splits, blast, blast) 
-        apply (metis (no_types, lifting) Sync.sym event.simps(3) imageI insert_iff SyncHd_Tl)
-       defer
-       apply blast
-      proof(safe, simp_all add: in_mono, goal_cases)
-      case (1 x)
-      show ?case
-        using "1"(13) "1"(14) "1"(18) "1"(21) "5"(8) list.collapse by fastforce
+
+  { fix s t u r v P Q A A' B B'
+    assume assms : \<open>front_tickFree v\<close> \<open>tickFree r \<or> v = []\<close> \<open>s = r @ v\<close> 
+                   \<open>r setinterleaves ((t, u), insert tick (ev ` S))\<close> 
+                   \<open>t \<in> \<D> (Mprefix (A \<union> A') P)\<close> \<open>u \<in> \<T> (Mprefix (B \<union> B') Q)\<close>
+                   \<open>A \<inter> S = {}\<close> \<open>A' \<subseteq> S\<close> \<open>B \<inter> S = {}\<close> \<open>B' \<subseteq> S\<close>
+    from assms(5) obtain e where * : \<open>t \<noteq> []\<close> \<open>hd t = ev e\<close> \<open>tl t \<in> \<D> (P e)\<close> \<open>e \<in> A \<or> e \<in> A'\<close>
+      by (force simp add: D_Mprefix)
+    have nonNil: \<open>r \<noteq> [] \<and> s \<noteq> []\<close>
+      using *(1) assms(3, 4) empty_setinterleaving by blast
+    have \<open>s \<in> \<D> (?rhs A A' P B B' Q)\<close>
+    proof (cases \<open>u = []\<close>)
+      case True
+      hence \<open>hd s = ev e\<close> by (metis "*"(2) EmptyLeftSync Sync.sym assms(3, 4) hd_append nonNil)
+      also from "*"(1, 2, 4) Sync.sym assms(4, 8)[simplified True] have \<open>e \<in> A\<close> 
+        using emptyLeftNonSync hd_in_set by fastforce
+      ultimately show \<open>s \<in> \<D> (?rhs A A' P B B' Q)\<close>
+        apply (simp add: D_Det)
+        apply (rule disjI1, simp add: D_Mprefix nonNil D_Sync)
+        apply (rule_tac x = \<open>tl t\<close> in exI, rule_tac x = \<open>[]\<close> in exI,
+               rule_tac x = \<open>tl r\<close> in exI, rule_tac x = v in exI)
+        apply (auto simp add: assms(1, 3, 6)[simplified True] * nonNil)[1]
+         apply (metis assms(2) tickFree_tl)
+        using Sync.sym SyncTlEmpty True assms(4) by blast
     next
-      case (2 x)
-      show ?case
-        using "5"(14) "5"(15) "2"(18) "5"(8) "2"(21) "5"(13) list.collapse by fastforce 
-    next
-      case (3 x)
-      show ?case
-        using "3"(18) "3"(21) "5"(14) "5"(15) "5"(8) Sync.sym hd_Cons_tl by fastforce 
-    next 
-      case (4 x)
-      show ?case
-        using "4"(18) "4"(20) "4"(21) "5"(14) "5"(15) "5"(8) list.collapse by fastforce 
-    next
-      case (5 x)
-      show ?case
-        using "5"(13) "5"(14) "5"(18) "5"(21) "5"(8) Sync.sym hd_Cons_tl by fastforce
-    next
-      case (6 x)
-      show ?case
-        using "6"(20) "6"(21) "6"(13) "6"(14) "6"(18) "6"(8) "6"(12) Sync.sym hd_Cons_tl by fastforce
-    next
-      case (7 x)
-      show ?case
-        using "7"(18) "7"(13) "7"(14) "7"(8) "7"(20) "7"(21) Sync.sym hd_Cons_tl by fastforce
-    next
-      case (8 x)
-      show ?case
-        using "8"(13) "8"(14) hd_Cons_tl Sync.sym "8"(18) "8"(8) "8"(21) "8"(12) by fastforce
-    next
-      case (9 x)
-      show ?case
-        using "9"(14) "9"(13) list.collapse "9"(21) Sync.sym "9"(18) "9"(8) by fastforce
-    qed
-    with 5 show ?case
-      by (simp add: hd_append) (metis Sync.sym empty_setinterleaving tickFree_tl)
-  next
-    case (6 u t r v aa a)
-      hence \<open>   (hd r = ev aa \<and> hd r \<in> ev ` B \<and> tl r setinterleaves ((t, tl u), insert tick (ev ` S))) 
-               \<or> (hd r = ev aa \<and> aa = a \<and> hd r \<in> ev ` (A' \<inter> B') \<and> tl r setinterleaves ((tl t, tl u), insert tick (ev ` S)))\<close> 
-        using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>hd u\<close> \<open>tl u\<close>]
-        apply (simp del:si_neq split:if_splits) 
-            apply (simp add:  UnE disjoint_iff imageE insertI2 rev_image_eqI)
-            apply (metis (no_types, lifting) Int_iff Sync.sym Un_iff event.inject imageE image_eqI insertCI SyncSameHdTl)
-           apply (metis insert_iff SyncSameHdTl)
-          apply (metis (no_types, opaque_lifting) Sync.sym UnE image_Un insert_iff subset_eq subset_image_iff SyncHd_Tl SyncSameHdTl) 
-         apply (metis imageI subsetD) 
-        by (metis image_eqI subsetD)
-      with 6 show ?case
-        by (simp add: hd_append) (metis Sync.sym empty_setinterleaving tickFree_tl)
-  next
-    case (7 t u r v a)
-    have 71:\<open>r = t\<close>
-      using 7 EmptyLeftSync Sync.sym by blast
-    hence 72:\<open>hd aA \<in> ev ` A\<close>  
-      using emptyLeftNonSync[rule_format, of r \<open>insert tick (ev ` S)\<close> t \<open>hd t\<close>] 
-        7 Sync.sym by auto blast
-    with 7 71 show ?case 
-      apply(rule_tac disjI1, simp) 
-      by (metis Sync.sym append_self_conv front_tickFree_Nil SyncTlEmpty)
-  next
-    case (8 t u r v a aa)
-    hence \<open>(hd r = ev a \<and> hd r \<in> ev ` A \<and> tl r setinterleaves ((tl t, u), insert tick (ev ` S))) 
-         \<or> (hd r = ev aa \<and> hd r \<in> ev ` B \<and> tl r setinterleaves ((t, tl u), insert tick (ev ` S)))\<close>  
-      using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>hd u\<close> \<open>tl u\<close>]
-      apply(simp del:si_neq split:if_splits, blast , metis empty_iff hd_Cons_tl) 
-        apply (metis (no_types, lifting) event.simps(3) imageI insert_iff SyncHd_Tl) 
-       defer
-       apply blast
-    proof(safe, simp_all add: in_mono, goal_cases)
-      case (1 x)
-      show ?case
-        using "1"(17) "1"(20) "8"(14) "8"(15) "8"(8) list.collapse by fastforce
-    next
-      case (2 x)
-      show ?case
-        using "2"(12) "2"(13) hd_Cons_tl "2"(11) "8"(8) "2"(17) "2"(20) "2"(19) by fastforce
-    next
-      case (3 x)
-      show ?case
-        using "3"(12) "3"(13) "3"(17) "3"(20) "3"(7) "3"(8) Sync.sym hd_Cons_tl by fastforce
-    next
-      case (4 x)
-      show ?case
-        using "4"(11) "4"(17) "4"(20) "8"(14) "8"(15) "8"(8) list.collapse by fastforce
-    next
-      case (5 x)
-      show ?case
-        using "5"(17) "5"(12) "5"(13) "5"(7) "5"(8) "5"(20) list.collapse Sync.sym hd_Cons_tl by fastforce
-    next
-      case (6 x)
-      show ?case
-        using "6"(11) "6"(12) "6"(13) "6"(17) "6"(19) "6"(20) "6"(7) list.collapse by fastforce
-    next
-      case (7 x)
-      show ?case
-        using "7"(17) "7"(20) "8"(13) "8"(14) "8"(15) "8"(8) list.collapse by fastforce
-    next
-      case (8 x)
-      show ?case
-        using "8"(12) "8"(13) "8"(17) "8"(19) "8"(20) "8"(7) list.collapse by fastforce
-    next
-      case (9 x)
-      show ?case
-        using "9"(20) Sync.sym "9"(12) "9"(13) list.exhaust_sel "9"(12) "9"(13) "9"(17) "9"(7) Sync.sym hd_Cons_tl by fastforce
+      case False
+      with assms(6) obtain e' where ** : \<open>hd u = ev e'\<close> \<open>tl u \<in> \<T> (Q e')\<close> \<open>e' \<in> B \<or> e' \<in> B'\<close>
+        by (auto simp add: T_Mprefix)
+      consider \<open>e  \<in> A \<and> hd s = ev e  \<and> tl r setinterleaves ((tl t, u), insert tick (ev ` S))\<close> | 
+               \<open>e' \<in> B \<and> hd s = ev e' \<and> tl r setinterleaves ((t, tl u), insert tick (ev ` S))\<close> | 
+               \<open>e = e' \<and> e \<in> A' \<and> e \<in> B' \<and> hd s = ev e \<and> 
+                tl r setinterleaves ((tl t, tl u), insert tick (ev ` S))\<close>
+        using assms(4) 
+        apply (subst (asm) list.collapse[OF nonNil[THEN conjunct1], symmetric],
+               subst (asm) list.collapse[OF *(1), symmetric, simplified *(2)],
+               subst (asm) list.collapse[OF False, symmetric, simplified **(1)])
+        apply (simp add: assms(3) nonNil image_iff split: if_split_asm)
+           apply (metis (no_types, opaque_lifting) *(4) **(3) Int_iff 
+                        assms(7, 9) empty_iff list.sel(1, 3))
+          apply (metis (no_types, opaque_lifting) *(1, 2) **(3) Int_iff 
+                       assms(10) inf.order_iff list.exhaust_sel list.sel(1, 3))
+         apply (metis (no_types, opaque_lifting) *(1, 2, 4) **(1, 3) Int_iff
+                      False assms(8, 10) inf.order_iff list.exhaust_sel list.sel(1, 3))
+        by (metis (no_types, opaque_lifting) *(4) **(1) False assms(8) 
+                  list.collapse list.sel(1, 3) subsetD)
+      thus \<open>s \<in> \<D> (?rhs A A' P B B' Q)\<close>
+        apply cases
+          apply (simp_all add: D_Det)
+          apply (rule disjI1, simp add: D_Mprefix nonNil D_Sync)
+          apply (rule_tac x = \<open>tl t\<close> in exI, rule_tac x = u in exI,
+                 rule_tac x = \<open>tl r\<close> in exI, rule_tac x = v in exI)
+          apply (simp add: assms(1, 3, 6) *(3) nonNil, use assms(2) nonNil tickFree_tl in blast)
+         apply (rule disjI2, rule disjI1, simp add: D_Mprefix nonNil D_Sync)
+         apply (rule_tac x = t in exI, rule_tac x = \<open>tl u\<close> in exI,
+                rule_tac x = \<open>tl r\<close> in exI, rule_tac x = v in exI)
+         apply (simp add: assms(1, 3, 5) **(2) nonNil,
+                metis "*" UnCI assms(2) image_eqI tickFree_tl)
+        apply (rule disjI2, rule disjI2, auto simp add: D_Mprefix nonNil image_iff)
+        apply (simp add: D_Sync)
+        apply (rule_tac x = \<open>tl t\<close> in exI, rule_tac x = \<open>tl u\<close> in exI,
+               rule_tac x = \<open>tl r\<close> in exI, rule_tac x = v in exI)
+        by (use *(3) **(2) assms(1, 2, 3) nonNil tickFree_tl in \<open>auto simp add: nonNil\<close>)
     qed
-    with 8 show ?case 
-      by (metis empty_setinterleaving self_append_conv)
-  next
-    case (9 t u r v a aa)
-      hence \<open>   (hd r = ev a \<and> hd r \<in> ev ` A \<and> tl r setinterleaves ((tl t, u), insert tick (ev ` S))) 
-               \<or> (hd r = ev aa \<and> aa = a \<and> hd r \<in> ev ` (A' \<inter> B') \<and> tl r setinterleaves ((tl t, tl u), insert tick (ev ` S)))\<close> 
-        using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>hd u\<close> \<open>tl u\<close>]
-        apply (simp del:si_neq split:if_splits) 
-            apply (simp add: disjoint_iff)
-            apply (metis (no_types, lifting) Int_iff Un_iff event.inject imageE image_eqI insertCI SyncSameHdTl)
-           apply (metis insert_iff SyncSameHdTl)
-          apply (metis rev_image_eqI subsetD)
-         apply (metis imageI subsetD) 
-        by (metis (no_types, opaque_lifting) Sync.sym Un_iff image_Un insert_iff sup.absorb_iff2 SyncHd_Tl)
-      with 9 show ?case
-        by (metis empty_setinterleaving self_append_conv)
-    next
-      case (10 u t r v a)
-      have 101:\<open>r = u\<close>
-        using 10 EmptyLeftSync Sync.sym by blast
-      hence 102:\<open>hd aA \<in> ev ` B\<close>  
-        using emptyLeftNonSync[rule_format, of r \<open>insert tick (ev ` S)\<close> u \<open>hd u\<close>] 
-            10 Sync.sym by auto blast
-      with 10 101 show ?case 
-        apply(rule_tac disjI2, rule_tac disjI1, simp) 
-        by (metis Sync.sym append.right_neutral front_tickFree_Nil SyncTlEmpty)   
-    next
-      case (11 u t r v aa a)
-      hence \<open>(hd r = ev a \<and> hd r \<in> ev ` A \<and> tl r setinterleaves ((tl t, u), insert tick (ev ` S))) 
-         \<or> (hd r = ev aa \<and> hd r \<in> ev ` B \<and> tl r setinterleaves ((t, tl u), insert tick (ev ` S)))\<close>  
-        using si_neq[of \<open>hd u\<close> \<open>tl u\<close> \<open>insert tick (ev ` S)\<close> \<open>hd t\<close> \<open>tl t\<close> ]
-        apply(simp del:si_neq split:if_splits, blast, blast) 
-          apply (metis (no_types, lifting) Sync.sym event.simps(3) imageI insert_iff SyncHd_Tl)
-         defer
-         apply blast
-      proof(safe, simp_all add: in_mono, goal_cases)
-        case (1 x)
-        show ?case
-          using "1"(17) "1"(20) "11"(14) "11"(15) "11"(8) list.collapse by fastforce
-      next
-        case (2 x)
-        show ?case
-          using "2"(12) "2"(13) hd_Cons_tl "2"(11) "11"(8) "2"(17) "2"(20) by fastforce
-      next
-        case (3 x)
-        show ?case
-          using "3"(12) "3"(13) "3"(17) "3"(20) "3"(7) "3"(8) Sync.sym hd_Cons_tl by fastforce
-      next
-        case (4 x)
-        show ?case
-          using "11"(14) "11"(15) "11"(8) "4"(17) "4"(19) "4"(20) list.collapse by fastforce
-      next
-        case (5 x)
-        show ?case
-          using "5"(17) "5"(12) "5"(13) "5"(7) "5"(8) "5"(20) list.collapse Sync.sym hd_Cons_tl by fastforce
-      next
-        case (6 x)
-        show ?case
-          using "6"(11) "6"(12) "6"(13) "6"(17) "6"(19) "6"(20) "6"(7) list.collapse by fastforce
-      next
-        case (7 x)
-        show ?case
-          using "7"(12) "7"(13) "7"(17) "7"(19) "7"(20) "7"(7) Sync.sym list.collapse by fastforce
-      next
-        case (8 x)
-        show ?case
-          using "8"(20) "8"(12) "8"(11) "8"(13) list.collapse Sync.sym "8"(12) "8"(13) "8"(17) "8"(7) hd_Cons_tl by fastforce
-      next
-        case (9 x)
-        show ?case
-          using "9"(20) Sync.sym "9"(12) "9"(13) list.exhaust_sel "9"(12) "9"(13) "9"(17) "9"(7) Sync.sym hd_Cons_tl by fastforce
-      qed
-      with 11 show ?case
-        by (metis Sync.sym append.right_neutral empty_setinterleaving)
-    next
-      case (12 u t r v aa a)
-      hence \<open>   (hd r = ev aa \<and> hd r \<in> ev ` B \<and> tl r setinterleaves ((t, tl u), insert tick (ev ` S))) 
-             \<or> (hd r = ev aa \<and> aa = a \<and> hd r \<in> ev ` (A' \<inter> B') \<and> tl r setinterleaves ((tl t, tl u), insert tick (ev ` S)))\<close> 
-      using si_neq[of \<open>hd t\<close> \<open>tl t\<close> \<open>insert tick (ev ` S)\<close> \<open>hd u\<close> \<open>tl u\<close>]
-      apply (simp del:si_neq split:if_splits) 
-            apply (simp add:  UnE disjoint_iff imageE insertI2 rev_image_eqI)
-            apply (metis (no_types, lifting) Int_iff Sync.sym Un_iff event.inject imageE image_eqI insertCI SyncSameHdTl)
-           apply (metis insert_iff SyncSameHdTl)
-          apply (metis (no_types, opaque_lifting) Sync.sym UnE image_Un insert_iff subset_eq subset_image_iff SyncHd_Tl SyncSameHdTl) 
-         apply (metis imageI subsetD) 
-        by (metis image_eqI subsetD)
-    with 12 show ?case
-      by (metis (no_types, lifting) Sync.sym append_Nil2 empty_setinterleaving)
-  qed    
+  } note * = this
+
+  fix s
+  assume \<open>s \<in> \<D> (?lhs A A' P B B' Q)\<close>
+  then obtain t u r v
+    where ** : \<open>front_tickFree v\<close> \<open>tickFree r \<or> v = []\<close> \<open>s = r @ v\<close> 
+               \<open>r setinterleaves ((t, u), insert tick (ev ` S))\<close> 
+               \<open>t \<in> \<D> (Mprefix (A \<union> A') P) \<and> u \<in> \<T> (Mprefix (B \<union> B') Q) \<or>
+                t \<in> \<D> (Mprefix (B \<union> B') Q) \<and> u \<in> \<T> (Mprefix (A \<union> A') P)\<close> 
+    by (simp add: D_Sync) blast
+  have same_div : \<open>\<D> (?rhs A A' P B B' Q) = \<D> (?rhs B B' Q A A' P)\<close>
+    by (subst Det_commute, subst Int_commute, simp add: Sync_commute)
+  from **(5) show \<open>s \<in> \<D> (?rhs A A' P B B' Q)\<close>
+    apply (rule disjE)
+    by (rule *[OF **(1, 2, 3, 4)]; simp add: sets_assms)
+       (subst same_div, rule *[OF **(1, 2, 3, 4)]; simp add: sets_assms)
 next
-  case (19 x)
-  then show ?case 
-  proof(elim exE disjE conjE, goal_cases)
-    case (1 a t u r v)
-    then show ?case 
-      apply(exI \<open>ev a#t\<close>, exI u, exI \<open>ev a#r\<close>, exI v, simp)
-      apply (safe, simp_all add: disjoint_iff image_iff SyncSingleHeadAdd)
-       by (metis list.exhaust_sel)
-  next
-    case (2 a t u r v aa)
-    then show ?case 
-      apply(exI \<open>ev a#t\<close>, exI u, exI \<open>ev a#r\<close>, exI v, simp) 
-      apply (safe, simp_all add: disjoint_iff image_iff SyncSingleHeadAdd)
-       by (metis list.exhaust_sel)
-  next
-    case (3 a t u r v aa)
-    then show ?case 
-      apply(exI \<open>ev a#t\<close>, exI u, exI \<open>ev a#r\<close>, exI v, simp) 
-      apply (safe, simp_all add: disjoint_iff image_iff SyncSingleHeadAdd)
-       by (metis list.exhaust_sel)
-  next
-    case (4 a t u r v aa)
-    then show ?case 
-      apply(exI \<open>t\<close>, exI  \<open>ev a#u\<close>, exI \<open>ev a#r\<close>, exI v, simp)
-      apply (safe, simp_all add: disjoint_iff image_iff in_mono SyncHdAdd1 SyncSingleHeadAdd)
-        apply (metis list.exhaust_sel)
-      apply (metis (no_types, opaque_lifting) Sync.sym event.inject event.simps(3) imageE insertE SyncSingleHeadAdd)
-       by (metis list.exhaust_sel)
-  next
-    case (5 a t u r v)
-    then show ?case
-      apply(exI \<open>ev a#t\<close>, exI u, exI \<open>ev a#r\<close>, exI v, simp)
-      apply (safe, simp_all)
-       apply blast
-      by (metis list.exhaust_sel)
-  next
-    case (6 a t u r v aa)
-    then show ?case
-      apply(exI \<open>ev a#t\<close>, exI u, exI \<open>ev a#r\<close>, exI v, simp) 
-      apply (safe, simp_all add: disjoint_iff_not_equal image_iff SyncSingleHeadAdd)
-       by (metis list.exhaust_sel)
-  next
-    case (7 a t u r v aa)
-    then show ?case 
-      apply(exI \<open>ev a#t\<close>, exI u, exI \<open>ev a#r\<close>, exI v, simp) 
-      apply (safe, simp_all add: disjoint_iff_not_equal image_iff SyncSingleHeadAdd)
-       by (metis list.exhaust_sel)
-  next
-    case (8 a t u r v aa)
-    then show ?case 
-      apply(exI \<open>t\<close>, exI  \<open>ev a#u\<close>, exI \<open>ev a#r\<close>, exI v, simp)
-      apply (safe, simp_all add: disjoint_iff image_iff in_mono SyncHdAdd1)
-        apply (metis list.exhaust_sel)
-       apply (metis (no_types, lifting) Sync.sym event.distinct(1) event.inject imageE insertE SyncSingleHeadAdd)
-      by (metis list.collapse)
-  next
-    case (9 a t u r v aa)
-    then show ?case 
-      apply(exI \<open>t\<close>, exI  \<open>ev a#u\<close>, exI \<open>ev a#r\<close>, exI v, simp)
-      apply (safe, simp_all add: disjoint_iff image_iff in_mono SyncHdAdd1)
-        apply (metis list.exhaust_sel)
-       apply (metis (no_types, lifting) Sync.sym event.distinct(1) event.inject imageE insertE SyncSingleHeadAdd)
-      by (metis list.collapse)
-  next
-    case (10 a t u r v)
-    then show ?case 
-      apply(exI \<open>ev a#t\<close>, exI u, exI \<open>ev a#r\<close>, exI v, simp)
-      apply (safe, simp_all add: disjoint_iff image_iff SyncSingleHeadAdd)
-      by (metis list.exhaust_sel)
-  next
-    case (11 a t u r v aa)
-    then show ?case 
-      apply(exI \<open>ev a#t\<close>, exI  \<open>u\<close>, exI \<open>ev a#r\<close>, exI v, simp) 
-      apply (safe, simp_all add: disjoint_iff image_iff SyncSingleHeadAdd)
-      by (metis list.exhaust_sel)
-  next
-    case (12 a t u r v aa)
-    then show ?case      
-      apply(exI \<open>ev a#t\<close>, exI  \<open>u\<close>, exI \<open>ev a#r\<close>, exI v, simp) 
-      apply (safe, simp_all add: disjoint_iff image_iff SyncSingleHeadAdd)
-      by (metis list.exhaust_sel)
-  next
-    case (13 a t u r v aa)
-    then show ?case
-      apply(exI \<open>t\<close>, exI  \<open>ev a#u\<close>, exI \<open>ev a#r\<close>, exI v, simp)
-      apply (safe, auto simp add: disjoint_iff image_iff subset_eq SyncHdAdd1)
-         apply (metis list.exhaust_sel)
-        apply (metis (no_types, lifting) Sync.sym  event.inject event.simps(3) imageE insertE SyncSingleHeadAdd)
-       by (metis hd_Cons_tl)
-  next
-    case (14 a t u r v)
-    then show ?case 
-      apply(exI \<open>ev a#t\<close>, exI u, exI \<open>ev a#r\<close>, exI v, simp)
-      apply (safe, simp_all add: disjoint_iff image_iff SyncSingleHeadAdd)
-      by (metis list.collapse)
-  next
-    case (15 a t u r v aa)
-    then show ?case 
-      apply(exI \<open>ev a#t\<close>, exI  \<open>u\<close>, exI \<open>ev a#r\<close>, exI v, simp) 
-      apply (safe, simp_all add: disjoint_iff image_iff SyncSingleHeadAdd)
-      by (metis list.exhaust_sel)
-  next
-    case (16 a t u r v aa)
-    then show ?case 
-      apply(exI \<open>ev a#t\<close>, exI  \<open>u\<close>, exI \<open>ev a#r\<close>, exI v, simp) 
-      apply (safe, simp_all add: disjoint_iff image_iff SyncSingleHeadAdd)
-      by (metis list.exhaust_sel)
-  next
-    case (17 a t u r v)
-    then show ?case 
-      apply(exI \<open>ev a#t\<close>, exI  \<open>ev a#u\<close>, exI \<open>ev a#r\<close>, exI v, simp) 
-      apply (safe, simp_all)
-        apply (metis list.exhaust_sel)
-      by blast+
-  next
-    case (18 a t u r v)
-    then show ?case 
-      apply(exI \<open>ev a#t\<close>, exI  \<open>ev a#u\<close>, exI \<open>ev a#r\<close>, exI v, simp) 
-      apply (safe, simp_all)
-        apply (metis list.exhaust_sel)
-      by blast+
-  next
-    case (19 a t u r v)
-    then show ?case 
-      apply(exI \<open>ev a#t\<close>, exI  \<open>ev a#u\<close>, exI \<open>ev a#r\<close>, exI v, simp) 
-      apply (safe, simp_all)
-        apply (metis list.exhaust_sel)
-      by blast+
-  next
-    case (20 a t u r v)
-    then show ?case 
-      apply(exI \<open>ev a#t\<close>, exI  \<open>ev a#u\<close>, exI \<open>ev a#r\<close>, exI v, simp) 
-      apply (safe, simp_all)
-        apply (metis list.exhaust_sel)
-      by blast+
+
+  { fix A A' B B' P Q s
+    assume set_assm : \<open>A \<inter> S = {}\<close>
+    have \<open>s \<in> \<D> (\<box>x\<in>A \<rightarrow> (P x \<lbrakk>S\<rbrakk> Mprefix (B \<union> B') Q)) \<Longrightarrow> s \<in> \<D> (?lhs A A' P B B' Q)\<close>
+    proof (auto simp add: D_Mprefix)
+      fix e
+      assume assms: \<open>s \<noteq> []\<close> \<open>hd s = ev e\<close> \<open>e \<in> A\<close> \<open>tl s \<in> \<D> (P e \<lbrakk>S\<rbrakk> Mprefix (B \<union> B') Q)\<close>
+      from assms(4) obtain t u r v 
+        where * : \<open>front_tickFree v\<close> \<open>tickFree r \<or> v = []\<close> \<open>tl s = r @ v\<close>
+                  \<open>r setinterleaves ((t, u), insert tick (ev ` S))\<close>
+                  \<open>t \<in> \<D> (P e) \<and> u \<in> \<T> (Mprefix (B \<union> B') Q) \<or> 
+                   t \<in> \<D> (Mprefix (B \<union> B') Q) \<and> u \<in> \<T> (P e)\<close> by (simp add: D_Sync) blast
+      have notin: \<open>e \<notin> S\<close> using assms(3) set_assm by blast
+      show \<open>s \<in> \<D> (?lhs A A' P B B' Q)\<close>
+        apply (subst list.collapse[OF assms(1), symmetric], simp add: D_Sync assms(2))
+        using *(5) apply (rule disjE)
+  
+         apply (rule_tac x = \<open>ev e # t\<close> in exI, rule_tac x = u in exI, 
+                rule_tac x = \<open>ev e # r\<close> in exI, rule_tac x = v in exI)
+         apply (simp add: *(1, 2, 3, 4))
+         apply (cases u; simp add: notin image_iff T_Mprefix D_Mprefix)
+        using *(4) assms(3) apply (fast+)[2]
+  
+        apply (rule_tac x = t          in exI, rule_tac x = \<open>ev e # u\<close> in exI,
+               rule_tac x = \<open>ev e # r\<close> in exI, rule_tac x = v          in exI)
+         apply (simp add: *(1, 2, 3, 4))
+        apply (cases t; simp add: notin image_iff T_Mprefix D_Mprefix)
+        using *(4) assms(3) by blast
+    qed
+  } note * = this
+
+  show \<open>s \<in> \<D> (?rhs A A' P B B' Q) \<Longrightarrow> s \<in> \<D> (?lhs A A' P B B' Q)\<close> for s
+    apply (simp add: D_Det)
+    apply (erule disjE, rule *, simp_all add: sets_assms(1))
+    apply (erule disjE, subst Sync_commute, rule *, simp_all add: sets_assms(3) Sync_commute)
+  proof -
+    assume \<open>s \<in> \<D> (\<box>x \<in> A' \<inter> B' \<rightarrow> (P x \<lbrakk>S\<rbrakk> Q x))\<close>
+    then obtain e t u r v
+      where * : \<open>e \<in> A'\<close> \<open>e \<in> B'\<close> \<open>s \<noteq> []\<close> \<open>hd s = ev e\<close> \<open>front_tickFree v\<close> \<open>tickFree r \<or> v = []\<close>
+                \<open>tl s = r @ v\<close> \<open>r setinterleaves ((t, u), insert tick (ev ` S))\<close>
+                \<open>t \<in> \<D> (P e) \<and> u \<in> \<T> (Q e) \<or> t \<in> \<D> (Q e) \<and> u \<in> \<T> (P e)\<close> 
+      by (simp add: D_Mprefix D_Sync) force
+    have inside: \<open>e \<in> S\<close> using *(1) sets_assms(2) by blast
+    show \<open>s \<in> \<D> (?lhs A A' P B B' Q)\<close>
+      apply (subst list.collapse[OF *(3), symmetric], simp add: D_Sync)
+      apply (rule_tac x = \<open>ev e # t\<close> in exI, rule_tac x = \<open>ev e # u\<close> in exI,
+             rule_tac x = \<open>ev e # r\<close> in exI, rule_tac x = v in exI)
+      by (simp add: * inside D_Mprefix T_Mprefix)
   qed
 qed
 
 
 (* useful version for later *)
 lemma Mprefix_Sync_distr_bis: 
   \<open>(Mprefix A P) \<lbrakk>S\<rbrakk> (Mprefix B Q) =
-   (\<box>x\<in>A - S \<rightarrow> (P x \<lbrakk>S\<rbrakk> Mprefix B Q)) \<box> (\<box>y\<in>B - S \<rightarrow> (Mprefix A P \<lbrakk>S\<rbrakk> Q y)) \<box> (\<box>x\<in>A \<inter> B \<inter> S \<rightarrow> (P x \<lbrakk>S\<rbrakk> Q x))\<close>
+       (\<box>x\<in>A - S \<rightarrow> (P x \<lbrakk>S\<rbrakk> Mprefix B Q)) 
+    \<box> (\<box>y\<in>B - S \<rightarrow> (Mprefix A P \<lbrakk>S\<rbrakk> Q y)) 
+    \<box> (\<box>x\<in>A \<inter> B \<inter> S \<rightarrow> (P x \<lbrakk>S\<rbrakk> Q x))\<close>
   by (subst Mprefix_Sync_distr[of \<open>A - S\<close> S \<open>A \<inter> S\<close> \<open>B - S\<close> \<open>B \<inter> S\<close>, simplified Un_Diff_Int])
      (simp_all add: Int_commute inf_left_commute)
 
 
-lemmas Mprefix_Sync_distr_subset = Mprefix_Sync_distr[where A = \<open>{}\<close> and B = \<open>{}\<close>, simplified, simplified Mprefix_STOP Det_STOP trans[OF Det_commute Det_STOP]]
-   and  Mprefix_Sync_distr_indep = Mprefix_Sync_distr[where A'= \<open>{}\<close> and B'= \<open>{}\<close>, simplified, simplified Mprefix_STOP Det_STOP] 
-   and  Mprefix_Sync_distr_right = Mprefix_Sync_distr[where A = \<open>{}\<close> and B'= \<open>{}\<close>, simplified, simplified Mprefix_STOP Det_STOP trans[OF Det_commute Det_STOP], rotated] 
-   and   Mprefix_Sync_distr_left = Mprefix_Sync_distr[where A'= \<open>{}\<close> and B = \<open>{}\<close>, simplified, simplified Mprefix_STOP Det_STOP trans[OF Det_commute Det_STOP]]
+lemmas Mprefix_Sync_distr_subset = Mprefix_Sync_distr[where A = \<open>{}\<close> 
+       and B = \<open>{}\<close>, simplified, simplified Mprefix_STOP Det_STOP trans[OF Det_commute Det_STOP]]
+   and Mprefix_Sync_distr_indep = Mprefix_Sync_distr[where A'= \<open>{}\<close> 
+       and B'= \<open>{}\<close>, simplified, simplified Mprefix_STOP Det_STOP] 
+   and Mprefix_Sync_distr_right = Mprefix_Sync_distr[where A = \<open>{}\<close> 
+       and B'= \<open>{}\<close>, simplified, simplified Mprefix_STOP Det_STOP trans[OF Det_commute Det_STOP], rotated] 
+   and Mprefix_Sync_distr_left = Mprefix_Sync_distr[where A'= \<open>{}\<close> 
+       and B = \<open>{}\<close>, simplified, simplified Mprefix_STOP Det_STOP trans[OF Det_commute Det_STOP]]
 
 
 lemma Mprefix_Sync_SKIP: "(Mprefix B P \<lbrakk> S \<rbrakk> SKIP) = (\<box> x \<in>  B - S \<rightarrow> (P x \<lbrakk> S \<rbrakk> SKIP))"
 proof (auto simp add:Process_eq_spec_optimized, goal_cases)
   case (1 x)
   then show ?case
   proof(simp_all add:D_Sync D_Mprefix D_SKIP T_SKIP, elim exE conjE, goal_cases)
       case (1 t u r v a)
       then show ?case 
         apply(intro conjI) 
           using empty_setinterleaving apply blast
          apply(elim disjE)
-            apply (metis (no_types, lifting) DiffI Sync.sym emptyLeftProperty empty_iff hd_append2 image_diff_subset insertI2 list.exhaust_sel setinterleaving.simps(2) subsetCE)
-           apply (metis D_imp_front_tickFree Sync.sym TickLeftSync empty_iff empty_setinterleaving event.distinct(1) ftf_Sync21 insertI1 list.expand list.sel(1) list.set_intros(1) SyncHd_Tl SyncSameHdTl tickFree_def)
+          apply (metis (no_types, lifting) DiffI Sync.sym emptyLeftProperty 
+                           empty_iff hd_append2 image_diff_subset insertI2 list.exhaust_sel 
+                           setinterleaving.simps(2) subsetCE)
+          apply (metis D_imp_front_tickFree Sync.sym TickLeftSync empty_iff 
+                          empty_setinterleaving event.distinct(1) ftf_Sync21 insertI1 SyncHd_Tl
+                          list.expand list.sel(1) list.set_intros(1)  SyncSameHdTl tickFree_def)
           using Sync.sym emptyLeftNonSync emptyLeftProperty hd_in_set apply fastforce
-         apply (metis (no_types, lifting) DiffI Sync.sym append_Nil2 event.distinct(1) image_diff_subset insertI1 insertI2 list.sel(1) subsetCE SyncHd_Tl SyncSameHdTl)
+          apply (metis (no_types, lifting) DiffI Sync.sym append_Nil2 event.distinct(1) 
+                        image_diff_subset insertI1 insertI2 list.sel(1) subsetCE SyncHd_Tl SyncSameHdTl)
         apply(rule_tac x="a" in exI, intro conjI) 
-         apply (metis Sync.sym emptyLeftProperty empty_setinterleaving hd_append2 insertI1 list.sel(1) SyncHd_Tl SyncSameHdTl)
-        apply(rule_tac x="tl t" in exI, rule_tac x="u" in exI, rule_tac x="tl r" in exI, rule_tac x="v" in exI)
-        by (metis (no_types, lifting) Sync.sym empty_setinterleaving event.distinct(1) insertI1 list.sel(1) SyncHd_Tl SyncSameHdTl SyncTlEmpty tickFree_tl tl_append2)
+           apply (metis Sync.sym emptyLeftProperty empty_setinterleaving hd_append2 insertI1 
+                       list.sel(1) SyncHd_Tl SyncSameHdTl)
+          apply(rule_tac x="tl t" in exI, rule_tac x="u" in exI, 
+                rule_tac x="tl r" in exI, rule_tac x="v" in exI)
+          by (metis (no_types, lifting) Sync.sym empty_setinterleaving 
+                    event.distinct(1) insertI1 list.sel(1) SyncHd_Tl SyncSameHdTl 
+                    SyncTlEmpty tickFree_tl tl_append2)
   qed
 next
   case (2 x)
   then show ?case 
     proof(simp_all add:D_Sync D_Mprefix D_SKIP T_SKIP, elim exE conjE, goal_cases)
       case (1 a t u r v)
       then show ?case  
         apply(rule_tac x="hd x#t" in exI, rule_tac x="u" in exI, rule_tac x="hd x#r" in exI,
               rule_tac x="v" in exI, auto)      
         using hd_Cons_tl list.exhaust_sel by force+
     qed 
 next
   case (3 a b)
   then show ?case
   proof(simp add:F_Sync F_Mprefix F_SKIP, elim exE disjE, simp_all, goal_cases)
     case (1 t u X)
     { fix X Y A B
       assume "b = (X \<union> Y) \<inter> insert tick (ev ` B) \<union> X \<inter> Y" and "X \<inter> ev ` A = {}" and "tick \<notin> Y"
       hence "b \<inter> ev ` (A - B) = {}" by (rule_tac equals0I, auto) 
     } note l1 = this
     from 1 show ?case
       apply(elim exE conjE disjE)
           using l1 apply simp
          apply(rule disjI2, simp)
         apply(intro disjI2 conjI)
           using empty_setinterleaving apply blast
          apply (metis (no_types, opaque_lifting) DiffI Sync.sym UnI2 contra_subsetD emptyLeftNonSync 
                 emptyLeftProperty hd_in_set image_diff_subset insert_is_Un) 
         apply (metis Sync.sym Un_commute emptyLeftProperty list.sel(1) list.sel(3) neq_Nil_conv SyncTlEmpty)
        apply(intro disjI2 conjI)       
          using empty_setinterleaving apply blast
         apply (metis (no_types, opaque_lifting) DiffI Sync.sym event.distinct(1) event.inject 
                      imageE image_eqI insertI1 insertI2 list.sel(1) SyncHd_Tl SyncSameHdTl)
        apply (metis Sync.sym event.distinct(1) insertI1 list.sel(1) SyncHd_Tl SyncSameHdTl)
        done
   next
     case (2 t u r v)
     from 2(2) have "a \<in> \<D> (Mprefix B P \<lbrakk>S\<rbrakk> SKIP)" 
       apply(simp add:D_Sync) using T_SKIP by blast
     with 2(3) have "a \<in> \<D> (\<box> x \<in>  B - S \<rightarrow> (P x \<lbrakk> S \<rbrakk> SKIP))" by simp
     with 2(2) show ?case 
       by (simp add:D_Sync D_Mprefix, rule_tac disjI2, metis)
   qed
 next  
   case (4 a b)
   then show ?case
   proof(simp add: F_Sync F_Mprefix F_SKIP, elim exE disjE, simp_all, goal_cases)
     case 1
     then show ?case
       apply(rule_tac disjI1, rule_tac x="[]" in exI, simp, rule_tac x="[]" in exI, simp) 
       apply(rule_tac x="b - (ev ` B)" in exI, rule_tac conjI)
        by (blast, rule_tac x="b - {tick}" in exI, blast) 
   next
     case 2
     then show ?case 
     proof (elim conjE exE, elim disjE exE, simp_all, goal_cases)
       case (1 aa t u X)
       then show ?case      
         apply(erule_tac conjE, erule_tac exE, simp_all)
         apply(rule_tac disjI1, rule_tac x="(ev aa)#t" in exI, rule_tac x=u in exI, 
               rule_tac x=X in exI, intro conjI, simp_all)
         apply auto[1] 
         by (metis (no_types, lifting) DiffE event.distinct(1) event.inject 
             imageE insertE list.exhaust_sel SyncSingleHeadAdd)
     next
       case (2 aa t u r v)
       from 2(2) have "a \<in> \<D> (\<box> x \<in>  B - S \<rightarrow> (P x \<lbrakk> S \<rbrakk> SKIP))" 
         apply(simp add:D_Mprefix D_Sync) by (metis "2"(1) "2"(3) "2"(4))
       with 2(5) have "a \<in> \<D> (Mprefix B P \<lbrakk>S\<rbrakk> SKIP)" by simp
       with 2(2) show ?case by (simp add:D_Sync D_Mprefix)
     qed
   qed
 qed
 
 lemma Sync_Ndet_left_distrib: "((P \<sqinter> Q) \<lbrakk> S \<rbrakk> M) = ((P \<lbrakk> S \<rbrakk> M) \<sqinter> (Q \<lbrakk> S \<rbrakk> M))"
   by (auto simp: Process_eq_spec, simp_all add: D_Sync F_Sync D_Ndet F_Ndet T_Ndet) blast+
 
 lemma Sync_Ndet_right_distrib: "(M \<lbrakk> S \<rbrakk> (P \<sqinter> Q)) = ((M \<lbrakk> S \<rbrakk> P) \<sqinter> (M \<lbrakk> S \<rbrakk> Q))"
   by (metis Sync_commute Sync_Ndet_left_distrib)
 
 lemma prefix_Sync_SKIP1:  "a \<notin> S \<Longrightarrow> (a \<rightarrow> P \<lbrakk>S\<rbrakk> SKIP) = (a \<rightarrow> (P \<lbrakk>S\<rbrakk> SKIP))"
   by (metis (no_types, lifting) write0_def empty_Diff insert_Diff_if Mprefix_Sync_SKIP Mprefix_singl)
 
 lemma prefix_Sync_SKIP2: "a \<in> S \<Longrightarrow> (a \<rightarrow> P \<lbrakk>S\<rbrakk> SKIP) = STOP"
   by (simp add: Mprefix_STOP Mprefix_Sync_SKIP write0_def)
 
 lemma prefix_Sync_SKIP: "(a \<rightarrow> P \<lbrakk>S\<rbrakk> SKIP) = (if a \<in> S then STOP else (a \<rightarrow> (P \<lbrakk>S\<rbrakk> SKIP)))"
   by (auto simp add: prefix_Sync_SKIP2 prefix_Sync_SKIP1)
   
 lemma prefix_Sync1: "\<lbrakk>a \<in> S; b \<in> S; a \<noteq> b\<rbrakk> \<Longrightarrow> (a \<rightarrow> P \<lbrakk>S\<rbrakk> (b \<rightarrow> Q)) = STOP"  
   using Mprefix_Sync_distr_subset[of "{a}" S "{b}" "\<lambda>x. P" "\<lambda>x. Q", simplified]
   by (auto, simp add: Mprefix_STOP Mprefix_singl)
    
 lemma prefix_Sync2: "a \<in> S \<Longrightarrow> ((a \<rightarrow> P) \<lbrakk>S\<rbrakk> (a \<rightarrow> Q)) = (a \<rightarrow> (P \<lbrakk>S\<rbrakk> Q))"  
   by (simp add:write0_def Mprefix_Sync_distr_subset[of "{a}" S "{a}" "\<lambda>x. P" "\<lambda>x. Q", simplified])
 
 lemma prefix_Sync3: "\<lbrakk>a \<in> S; b \<notin> S\<rbrakk> \<Longrightarrow> (a \<rightarrow> P \<lbrakk>S\<rbrakk> (b \<rightarrow> Q)) = (b \<rightarrow> ((a \<rightarrow> P) \<lbrakk>S\<rbrakk> Q))"
   using Mprefix_Sync_distr_right[of "{b}" S "{a}" "\<lambda>x. P" "\<lambda>x. Q", simplified]
   by (auto simp add:write0_def Sync_commute)
 
 lemma Hiding_Sync_D1: \<open>finite A \<Longrightarrow> A \<inter> S = {} \<Longrightarrow>  \<D> ((P \<lbrakk>S\<rbrakk> Q) \ A) \<subseteq> \<D> ((P \ A) \<lbrakk>S\<rbrakk> (Q \ A))\<close>
 proof (simp only:D_Sync T_Sync D_Hiding T_Hiding, intro subsetI CollectI, 
                   elim CollectE exE conjE, elim exE CollectE disjE, goal_cases)
   case (1 x t u ta ua r v)
   then show ?case (is "\<exists>t ua ra va. ?P t ua ra va")
     apply (subgoal_tac "?P (trace_hide ta (ev ` A)) (trace_hide ua (ev ` A)) 
                         (trace_hide r (ev ` A)) ((trace_hide v (ev ` A))@u)") 
      apply (metis (no_types, lifting)) 
     apply(simp_all add:front_tickFree_append Hiding_tickFree tickFree_def disjoint_iff_not_equal
                         Hiding_interleave[of "ev ` A" "insert tick (ev ` S)" r ta ua])
       apply(elim conjE, erule_tac disjE, rule_tac disjI1, rule_tac conjI, case_tac "tickFree ta") 
       apply(meson front_tickFree_charn self_append_conv tickFree_def) 
       apply (metis D_imp_front_tickFree emptyLeftNonSync ftf_Sync21 ftf_Sync32 in_set_conv_decomp_last 
                   insertI1 is_processT2_TR nonTickFree_n_frontTickFree tickFree_Nil tickFree_def)
     apply(subst disj_commute, rule_tac disjCI, simp)
     subgoal proof(goal_cases)
       case 1
       hence a:"tickFree ua" by (metis front_tickFree_implies_tickFree is_processT2_TR is_processT5_S7)
       from 1(11) 1(10) inf_hidden[of A ua Q] obtain ff where "isInfHiddenRun ff Q A \<and> ua \<in> range ff" by auto
       with 1(2,3,4,7) a show ?case
         apply(rule_tac x=ua in exI, rule_tac x="[]" in exI)
         using front_tickFree_Nil tickFree_def by blast
     qed
     apply(rule_tac disjI2, rule_tac conjI, case_tac "tickFree ta") 
       apply(meson front_tickFree_charn self_append_conv tickFree_def) 
       apply (metis D_imp_front_tickFree emptyLeftNonSync ftf_Sync21 ftf_Sync32 in_set_conv_decomp_last 
                   insertI1 is_processT2_TR nonTickFree_n_frontTickFree tickFree_Nil tickFree_def)
     apply(subst disj_commute, rule_tac disjCI, simp)
     proof(goal_cases)
       case 1
       hence a:"tickFree ua" by (metis front_tickFree_implies_tickFree is_processT2_TR is_processT5_S7)
       from 1(10) 1(11) inf_hidden[of A ua P] obtain ff where "isInfHiddenRun ff P A \<and> ua \<in> range ff" by auto
       with 1(2,3,4,7) a show ?case
         apply(rule_tac x=ua in exI, rule_tac x="[]" in exI)
         using front_tickFree_Nil tickFree_def by blast
     qed
 next
   case (2 x t u f)
   then show ?case (is "\<exists>t ua ra va. ?P t ua ra va")
   proof(elim UnE exE conjE rangeE CollectE, goal_cases 21)
     case (21 xa)
     note aa = 21(7)[rule_format, of xa] 
     with 21 show ?case
     proof(elim UnE exE conjE rangeE CollectE, goal_cases 211 212)
       case (211 taa uaa)
       then show ?case (is "\<exists>t ua ra va. ?P t ua ra va")
       proof (cases "\<forall>i. f i \<in> {s. \<exists>t u. t \<in> \<T> P \<and> u \<in> \<T> Q \<and> s setinterleaves ((t, u), ev ` S \<union> {tick})}")
         case True
         define ftu where "ftu \<equiv> \<lambda>i. (SOME (t,u). t \<in> \<T> P \<and> u \<in> \<T> Q \<and> 
                                 (f i) setinterleaves ((t, u), ev ` S \<union> {tick}))"
         define ft fu where "ft \<equiv> fst \<circ> ftu" and "fu \<equiv> snd \<circ> ftu"
         have "inj ftu"
         proof
           fix x y
           assume ftuxy: "ftu x = ftu y"
           obtain t u where tu:"(t, u) = ftu x" by (metis surj_pair)
           have "\<exists>t u. t \<in> \<T> P \<and> u \<in> \<T> Q \<and> f x setinterleaves ((t, u), ev ` S \<union> {tick})" 
             using True[rule_format, of x] by simp
           with tu have a:"(f x) setinterleaves ((t, u), ev ` S \<union> {tick})"
             unfolding ftu_def by (metis (mono_tags, lifting) exE_some old.prod.case tu)
           have "\<exists>t u. t \<in> \<T> P \<and> u \<in> \<T> Q \<and> f y setinterleaves ((t, u), ev ` S \<union> {tick})" 
             using True[rule_format, of y] by simp
           with ftuxy tu have b:"(f y) setinterleaves ((t, u), ev ` S \<union> {tick})"
             unfolding ftu_def by (metis (mono_tags, lifting) exE_some old.prod.case tu)
           from interleave_eq_size[OF a b] have "length (f x) = length (f y)" by assumption
           with 211(6) show "x = y"
             by (metis add.left_neutral less_length_mono linorder_neqE_nat not_add_less2 strict_mono_def)
         qed
         hence inf_ftu: "infinite (range ftu)" using finite_imageD by blast
         have "range ftu \<subseteq> range ft \<times> range fu" 
           by (clarify, metis comp_apply fst_conv ft_def fu_def rangeI snd_conv)
         with inf_ftu have inf_ft_fu: "infinite (range ft) \<or> infinite (range fu)" 
           by (meson finite_SigmaI infinite_super)
         have a:"isInfHiddenRun f (P \<lbrakk>S\<rbrakk> Q) A"
           using "2"(6) T_Sync by blast
         { fix i
           from a obtain t where "f i = f 0 @ t \<and> set t \<subseteq>  (ev ` A)"
             unfolding isInfHiddenRun_1 by blast
           hence "set (f i) \<subseteq> set (f 0) \<union> (ev ` A)" by auto
         } note b = this
         { fix x
           obtain t u where tu:"(t, u) = ftu x" by (metis surj_pair)
           have "\<exists>t u. t \<in> \<T> P \<and> u \<in> \<T> Q \<and> f x setinterleaves ((t, u), ev ` S \<union> {tick})" 
            using True[rule_format, of x] by simp
           with tu have a:"t \<in> \<T> P \<and> u \<in> \<T> Q \<and> (f x) setinterleaves ((t, u), ev ` S \<union> {tick})"
            unfolding ftu_def by (metis (mono_tags, lifting) exE_some old.prod.case tu)
           hence "ft x \<in> \<T> P \<and> fu x \<in> \<T> Q \<and> (f x) setinterleaves ((ft x, fu x), ev ` S \<union> {tick})"
             by (metis comp_apply fst_conv ft_def fu_def snd_conv tu)
           hence "ft x \<in> \<T> P \<and> fu x \<in> \<T> Q \<and> set (ft x) \<union> set (fu x) \<subseteq> set (f x) 
                   \<and> (f x) setinterleaves ((ft x, fu x), ev ` S \<union> {tick})" using interleave_set by blast
         } note ft_fu_f = this
         with b have c:"ft i \<in> \<T> P \<and> fu i \<in> \<T> Q \<and> set (ft i) \<union> set (fu i) \<subseteq> set (f 0) \<union> ev ` A" for i by blast        
         with inf_ft_fu show ?thesis
         proof(elim disjE, goal_cases 2111 2112)
           case 2111
           have "\<exists>t'\<in>range ft. t = take i t' \<longrightarrow> (set t \<subseteq> set (f 0) \<union> ev ` A \<and> length t \<le> i)" for i
             by simp (metis "211"(9) b)
-          hence "{t. \<exists>t'\<in>range ft. t = take i t'} \<subseteq> {t. set t \<subseteq> set (f 0) \<union> ev ` A \<and> length t \<le> i} " for i 
+          hence "   {t. \<exists>t'\<in>range ft. t = take i t'} 
+                 \<subseteq> {t. set t \<subseteq> set (f 0) \<union> ev ` A \<and> length t \<le> i} " for i 
             by auto (meson UnE c in_set_takeD subsetCE sup.boundedE)
-          with 2(1) finite_lists_length_le[of "set (f 0) \<union> ev ` A"] have "finite {t. \<exists>t'\<in>range ft. t = take i t'}" for i
+          with 2(1) finite_lists_length_le[of "set (f 0) \<union> ev ` A"]
+            have "finite {t. \<exists>t'\<in>range ft. t = take i t'}" for i
             by (meson List.finite_set finite_Un finite_imageI finite_subset)
-          from KoenigLemma[of "range ft", OF 2111(2), rule_format, OF this] obtain ftf::"nat \<Rightarrow> 'a event list" where 
+          from KoenigLemma[of "range ft", OF 2111(2), rule_format, OF this] 
+          obtain ftf::"nat \<Rightarrow> 'a event list" where 
             d:"strict_mono ftf \<and> range ftf \<subseteq> {t. \<exists>t'\<in>range ft. t \<le> t'}" by blast
           with c d[THEN conjunct2] have e:"range ftf \<subseteq> \<T> P" using is_processT3_ST_pref by blast
           define ftfs where f:"ftfs = ftf \<circ> (\<lambda>n. n + length (f 0))"
           from e d[THEN conjunct1] strict_mono_def have f1:"range ftfs \<subseteq> \<T> P" and f2:"strict_mono ftfs"
             by (auto simp add: strict_mono_def f)
           { fix i
             have t0:"length (ftfs 0) \<ge> length (f 0)" 
               by (metis d[THEN conjunct1] add_leE comp_def f length_strict_mono)
             obtain tt where t1:"ftfs i = (ftfs 0) @ tt" 
               by (metis f2 le0 le_list_def strict_mono_less_eq)
             from d[THEN conjunct2] f obtain j where t2:"ftfs i \<le> ft j" by simp blast
             obtain tt1 where t3: "ft j = (ftfs 0) @ tt @ tt1" 
               by (metis append.assoc le_list_def t1 t2)
             with t0 interleave_order[of "f j" "ftfs 0" "tt@tt1" "ev ` S \<union> {tick}" "fu j"] ft_fu_f 
               have t4:"set tt \<subseteq> set (drop (length (f 0)) (f j))"
                 by (metis Un_subset_iff set_append set_drop_subset_set_drop subset_Un_eq)
             with 21 isInfHiddenRun_1[of f _ A] have t5: "set (drop (length (f 0)) (f j)) \<subseteq> ev ` A"
               by (metis (full_types) a append_eq_conv_conj) 
             with t4 have "set tt \<subseteq> ev ` A" by simp
             with t1 have "trace_hide (ftfs i) (ev ` A) = trace_hide (ftfs 0) (ev ` A)"
               by (simp add: subset_eq)
           } note f3 = this
           from d[THEN conjunct2] f obtain i where f4:"ftfs 0 \<le> ft i" by simp blast
           show ?case 
-            apply(rule_tac x="trace_hide (ft i) (ev ` A)" in exI, rule_tac x="trace_hide (fu i) (ev ` A)" in exI)
+            apply(rule_tac x="trace_hide (ft i) (ev ` A)" in exI, 
+                  rule_tac x="trace_hide (fu i) (ev ` A)" in exI)
             apply(rule_tac x="trace_hide (f i) (ev ` A)" in exI, rule_tac x="u" in exI)
           proof (intro conjI, goal_cases 21111 21112 21113 21114 21115)
             case 21111
             then show ?case using 2 by (simp add: "211"(3))
           next
             case 21112
             then show ?case by (metis "211"(4) "211"(9) a Hiding_tickFree) 
           next
             case 21113
             then show ?case by (metis "211"(5) "211"(8) "211"(9)) 
           next
             case 21114
             then show ?case 
               apply(rule Hiding_interleave)
                using "211"(2) apply blast 
               using ft_fu_f by simp
           next
             case 21115
             from f4 obtain u where f5:"ft i = (ftfs 0) @ u" by (metis le_list_def)
             have "tickFree (f i)" by (metis "211"(4) "211"(8) "211"(9) Hiding_tickFree)
             with ft_fu_f have f6:"tickFree (ft i)" by (meson subsetCE sup.boundedE tickFree_def)
             show ?case
               apply (rule disjI1, rule conjI, simp)
                apply(rule_tac x="ftfs 0" in exI, rule_tac x="trace_hide u (ev ` A)" in exI, intro conjI)
-              apply (metis f5 front_tickFree_Nil front_tickFree_mono ft_fu_f Hiding_fronttickFree is_processT2_TR)
+                  apply (metis f5 front_tickFree_Nil front_tickFree_mono ft_fu_f
+                               Hiding_fronttickFree is_processT2_TR)
               apply (metis f5 f6 tickFree_append)
                 apply (simp add: f5, rule disjI2, rule_tac x=ftfs in exI)  
                using f1 f2 f3 apply blast
               using elemTIselemHT[of "fu i" Q A, simplified T_Hiding] ft_fu_f by blast
           qed 
         next
           case 2112
           have "\<exists>t'\<in>range fu. t = take i t' \<longrightarrow> (set t \<subseteq> set (f 0) \<union> ev ` A \<and> length t \<le> i)" for i
             by simp (metis "211"(9) b)
-          hence "{t. \<exists>t'\<in>range fu. t = take i t'} \<subseteq> {t. set t \<subseteq> set (f 0) \<union> ev ` A \<and> length t \<le> i} " for i 
+          hence "   {t. \<exists>t'\<in>range fu. t = take i t'} 
+                  \<subseteq> {t. set t \<subseteq> set (f 0) \<union> ev ` A \<and> length t \<le> i} " for i 
             by auto (meson UnE c in_set_takeD subsetCE sup.boundedE)
-          with 2(1) finite_lists_length_le[of "set (f 0) \<union> ev ` A"] have "finite {t. \<exists>t'\<in>range fu. t = take i t'}" for i
+          with 2(1) finite_lists_length_le[of "set (f 0) \<union> ev ` A"] 
+          have "finite {t. \<exists>t'\<in>range fu. t = take i t'}" for i
             by (meson List.finite_set finite_Un finite_imageI finite_subset)
-          from KoenigLemma[of "range fu", OF 2112(2), rule_format, OF this] obtain fuf::"nat \<Rightarrow> 'a event list" where 
+          from KoenigLemma[of "range fu", OF 2112(2), rule_format, OF this] 
+          obtain fuf::"nat \<Rightarrow> 'a event list" where 
             d:"strict_mono fuf \<and> range fuf \<subseteq> {t. \<exists>t'\<in>range fu. t \<le> t'}" by blast
           with c d[THEN conjunct2] have e:"range fuf \<subseteq> \<T> Q" using is_processT3_ST_pref by blast
           define fufs where f:"fufs = fuf \<circ> (\<lambda>n. n + length (f 0))"
           from e d[THEN conjunct1] strict_mono_def have f1:"range fufs \<subseteq> \<T> Q" and f2:"strict_mono fufs"
             by (auto simp add: strict_mono_def f)
           { fix i
             have t0:"length (fufs 0) \<ge> length (f 0)" 
               by (metis d[THEN conjunct1] add_leE comp_def f length_strict_mono)
             obtain tt where t1:"fufs i = (fufs 0) @ tt" 
               by (metis f2 le0 le_list_def strict_mono_less_eq)
             from d[THEN conjunct2] f obtain j where t2:"fufs i \<le> fu j" by simp blast
             obtain tt1 where t3: "fu j = (fufs 0) @ tt @ tt1" by (metis append.assoc le_list_def t1 t2)
             with t0 interleave_order[of "f j" "fufs 0" "tt@tt1" "ev ` S \<union> {tick}" "ft j"] ft_fu_f 
               have t4:"set tt \<subseteq> set (drop (length (f 0)) (f j))"
                 by (metis (no_types, opaque_lifting) Sync.sym Un_subset_iff order_trans 
                                                 set_append set_drop_subset_set_drop)
             with 21 isInfHiddenRun_1[of f _ A] have t5: "set (drop (length (f 0)) (f j)) \<subseteq> ev ` A"
               by (metis (full_types) a append_eq_conv_conj) 
             with t4 have "set tt \<subseteq> ev ` A" by simp
             with t1 have "trace_hide (fufs i) (ev ` A) = trace_hide (fufs 0) (ev ` A)"
               by (simp add: subset_eq)
           } note f3 = this
           from d[THEN conjunct2] f obtain i where f4:"fufs 0 \<le> fu i" by simp blast
           show ?case 
             apply(rule_tac x="trace_hide (fu i) (ev ` A)" in exI, 
                   rule_tac x="trace_hide (ft i) (ev ` A)" in exI)
             apply(rule_tac x="trace_hide (f i) (ev ` A)" in exI, rule_tac x="u" in exI)
           proof (intro conjI, goal_cases 21111 21112 21113 21114 21115)
             case 21111
             then show ?case using 2 by (simp add: "211"(3))
           next
             case 21112
             then show ?case by (metis "211"(4) "211"(9) a Hiding_tickFree) 
           next
             case 21113
             then show ?case by (metis "211"(5) "211"(8) "211"(9)) 
           next
             case 21114
             then show ?case 
               apply(rule Hiding_interleave)
                using "211"(2) apply blast 
               using ft_fu_f using Sync.sym by blast
           next
             case 21115
             from f4 obtain u where f5:"fu i = (fufs 0) @ u" by (metis le_list_def)
             have "tickFree (f i)" by (metis "211"(4) "211"(8) "211"(9) Hiding_tickFree)
             with ft_fu_f have f6:"tickFree (fu i)" by (meson subsetCE sup.boundedE tickFree_def)
             show ?case
               apply (rule disjI2, rule conjI, simp)
                apply(rule_tac x="fufs 0" in exI, rule_tac x="trace_hide u (ev ` A)" in exI, intro conjI)
-              apply (metis f5 front_tickFree_Nil front_tickFree_mono ft_fu_f Hiding_fronttickFree is_processT2_TR)
+                  apply (metis f5 front_tickFree_Nil front_tickFree_mono ft_fu_f 
+                                  Hiding_fronttickFree is_processT2_TR)
               apply (metis f5 f6 tickFree_append)
                 apply (simp add: f5, rule disjI2, rule_tac x=fufs in exI)  
                using f1 f2 f3 apply blast
               using elemTIselemHT[of "ft i" P A, simplified T_Hiding] ft_fu_f by blast             
           qed 
         qed
       next
         case False
         then obtain xaa 
           where "f xaa \<notin> {s. \<exists>t u. t \<in> \<T> P \<and> u \<in> \<T> Q \<and> s setinterleaves ((t, u), ev ` S \<union> {tick})}" 
             by blast
         with 211(7)[rule_format, of xaa] obtain ta ua ra va 
           where bb:"front_tickFree va \<and> (tickFree ra \<or> va = []) \<and> 
                     f xaa = ra @ va \<and> ra setinterleaves ((ta, ua), ev ` S \<union> {tick}) \<and> 
                     (ta \<in> \<D> P \<and> ua \<in> \<T> Q \<or> ta \<in> \<D> Q \<and> ua \<in> \<T> P)" by blast
         from 211 have cc:"x = trace_hide (f xaa) (ev ` A) @ u" by (metis (no_types, lifting))
         from bb 211(9) "211"(8) "21"(4) have "tickFree ra \<and> tickFree va" 
           by (metis Hiding_tickFree tickFree_append)
         with cc bb 211 show ?thesis
           apply(subgoal_tac "?P (trace_hide ta (ev ` A)) (trace_hide ua (ev ` A)) 
                              (trace_hide ra (ev ` A))  ((trace_hide va (ev ` A))@u)")
            apply (metis (no_types, lifting))
           apply(simp_all add:front_tickFree_append Hiding_tickFree tickFree_def disjoint_iff_not_equal 
                                       Hiding_interleave[of "ev ` A" "insert tick (ev ` S)" ra ta ua])
             apply(elim conjE disjE, rule_tac disjI1, rule_tac conjI, case_tac "tickFree ta") 
               apply(meson front_tickFree_charn self_append_conv tickFree_def) 
               apply (metis D_imp_front_tickFree emptyLeftNonSync ftf_Sync21 ftf_Sync32 in_set_conv_decomp_last 
                           insertI1 is_processT2_TR nonTickFree_n_frontTickFree tickFree_Nil tickFree_def)
          apply(subst disj_commute, rule_tac disjCI, simp)
           subgoal proof(goal_cases 2111)
           case 2111
           hence a:"tickFree ua" by (metis front_tickFree_implies_tickFree is_processT2_TR is_processT5_S7)
           from 2111(20) 2111(21) inf_hidden[of A ua Q] obtain ff 
             where "isInfHiddenRun ff Q A \<and> ua \<in> range ff" by auto
           with 2111(2,3,4,7) a show ?case
             apply(rule_tac x=ua in exI, rule_tac x="[]" in exI)
             using front_tickFree_Nil tickFree_def by blast
           qed
           apply(rule_tac disjI2, rule_tac conjI, case_tac "tickFree ta") 
             apply(meson front_tickFree_charn self_append_conv tickFree_def) 
             apply (metis D_imp_front_tickFree emptyLeftNonSync ftf_Sync21 ftf_Sync32 in_set_conv_decomp_last 
                         insertI1 is_processT2_TR nonTickFree_n_frontTickFree tickFree_Nil tickFree_def)
           apply(subst disj_commute, rule_tac disjCI, simp)
           proof(goal_cases 2111)
             case 2111
             hence a:"tickFree ua" by (metis front_tickFree_implies_tickFree is_processT2_TR is_processT5_S7)
             from 2111(20) 2111(21) inf_hidden[of A ua P] obtain ff 
               where "isInfHiddenRun ff P A \<and> ua \<in> range ff" by auto
             with 2111(2,3,4,7) a show ?case
               apply(rule_tac x=ua in exI, rule_tac x="[]" in exI)
               using front_tickFree_Nil tickFree_def by blast
           qed
       qed      
     next
       case (212 ta ua r v)
       then show ?case (is "\<exists>t ua ra va. ?P t ua ra va")
         apply (subgoal_tac "?P (trace_hide ta (ev ` A)) (trace_hide ua (ev ` A)) 
                                (trace_hide r (ev ` A)) ((trace_hide v (ev ` A))@u)") 
        apply (metis (no_types, lifting))
       apply(simp_all add:front_tickFree_append Hiding_tickFree tickFree_def disjoint_iff_not_equal
                          Hiding_interleave[of "ev ` A" "insert tick (ev ` S)" r ta ua])
       apply(erule_tac disjE, rule_tac disjI1, rule_tac conjI, case_tac "tickFree ta") 
         apply(meson front_tickFree_charn self_append_conv tickFree_def) 
         apply (metis D_imp_front_tickFree emptyLeftNonSync ftf_Sync21 ftf_Sync32 in_set_conv_decomp_last 
                     insertI1 is_processT2_TR nonTickFree_n_frontTickFree tickFree_Nil tickFree_def)
       apply(subst disj_commute, rule_tac disjCI, simp)
       subgoal proof(goal_cases 2121)
         case 2121
         hence a:"tickFree ua" by (metis front_tickFree_implies_tickFree is_processT2_TR is_processT5_S7)
         from 2121(14) 2121(13) inf_hidden[of A ua Q] obtain ff 
           where "isInfHiddenRun ff Q A \<and> ua \<in> range ff" by auto
         with 2121(2,3,4,7) a show ?case
           apply(rule_tac x=ua in exI, rule_tac x="[]" in exI)
           using front_tickFree_Nil tickFree_def by blast
       qed
       apply(rule_tac disjI2, rule_tac conjI, case_tac "tickFree ta") 
         apply(meson front_tickFree_charn self_append_conv tickFree_def) 
         apply (metis D_imp_front_tickFree emptyLeftNonSync ftf_Sync21 ftf_Sync32 in_set_conv_decomp_last 
                     insertI1 is_processT2_TR nonTickFree_n_frontTickFree tickFree_Nil tickFree_def)
       apply(subst disj_commute, rule_tac disjCI, simp)
       proof(goal_cases 2121)
         case 2121
         hence a:"tickFree ua" by (metis front_tickFree_implies_tickFree is_processT2_TR is_processT5_S7)
         from 2121(14) 2121(13) inf_hidden[of A ua P] obtain ff 
           where "isInfHiddenRun ff P A \<and> ua \<in> range ff" by auto
         with 2121(2,3,4,7) a show ?case
           apply(rule_tac x=ua in exI, rule_tac x="[]" in exI)
           using front_tickFree_Nil tickFree_def by blast
       qed
     qed
   qed
 qed
 
 lemma Hiding_Sync_D2: 
   assumes *:"A \<inter> S = {}"
   shows     \<open>\<D> ((P \ A) \<lbrakk>S\<rbrakk> (Q \ A)) \<subseteq> \<D> ((P \<lbrakk>S\<rbrakk> Q) \ A)\<close>
 proof -
   { fix P Q   
-    have "{s. \<exists>t u r v. front_tickFree v \<and> (tickFree r \<or> v = []) \<and>
+    have \<open>{s. \<exists>t u r v. front_tickFree v \<and> (tickFree r \<or> v = []) \<and>
            s = r @ v \<and> r setinterleaves ((t, u), insert tick (ev ` S)) \<and>
-           (t \<in> \<D> (P \\ A) \<and> u \<in> \<T> (Q \\ A))} \<subseteq> \<D> ((P \<lbrakk>S\<rbrakk> Q) \\ A)"
+           (t \<in> \<D> (P \ A) \<and> u \<in> \<T> (Q \ A))} \<subseteq> \<D> ((P \<lbrakk>S\<rbrakk> Q) \ A)\<close>
     proof(simp add:D_Hiding D_Sync, intro subsetI CollectI, elim exE conjE CollectE, goal_cases a)
       case (a x t u r v ta1 ta2)
       from a(1,3-9) show ?case
       proof(erule_tac disjE, goal_cases)
         case 1
         with interleave_append[of r "trace_hide ta1 (ev ` A)" "ta2" "insert tick (ev ` S)" u] 
         obtain u1 u2 r1 r2
           where a1:"u = u1 @ u2" and a2:"r = r1 @ r2" and 
                 a3:"r1 setinterleaves ((trace_hide ta1 (ev ` A), u1), insert tick (ev ` S))" and
                 a4:"r2 setinterleaves ((ta2, u2), insert tick (ev ` S))" by blast
         with 1 show ?case
         proof(auto simp only:T_Hiding, goal_cases 11 12 13)
           case (11 ua) 
           from trace_hide_append[OF 11(12)] 
           obtain ua1 where a5:"u1 = trace_hide ua1 (ev ` A) \<and> ua1 \<le> ua \<and> ua1 \<in> \<T> Q" 
             using "11"(13) F_T is_processT3_ST_pref le_list_def by blast
           from interleave_Hiding[OF _ 11(10)[simplified a5]] obtain ra1
             where a6:"r1 = trace_hide ra1 (ev ` A) \<and> ra1 setinterleaves ((ta1, ua1), insert tick (ev ` S))"
             using * by blast
           from a(2) 11 a5 a6 show ?case
             apply(exI ra1, exI "r2@v", intro conjI, simp_all (asm_lr))
-              apply (metis a(5) append_Nil2 front_tickFree_append front_tickFree_mono ftf_Sync is_processT2_TR)
+              apply (metis a(5) append_Nil2 front_tickFree_append 
+                           front_tickFree_mono ftf_Sync is_processT2_TR)
              apply (metis equals0D ftf_Sync1 ftf_Sync21 insertI1 tickFree_def)
             using front_tickFree_Nil by blast
         next
           case (12 ua1 ua2)          
           then show ?case 
           proof(cases "u1 \<le> trace_hide ua1 (ev ` A)")
             case True
             then obtain uu1 where  "u1@uu1 = trace_hide ua1 (ev ` A)" using le_list_def by blast
             with trace_hide_append[OF this] obtain uaa1 
               where a5:"u1 = trace_hide uaa1 (ev ` A) \<and> uaa1 \<le> ua1 \<and> uaa1 \<in> \<T> Q"
               using "12"(15) NT_ND is_processT3_ST_pref le_list_def by blast
             from interleave_Hiding[OF _ 12(10)[simplified a5]] obtain rr1
               where a6:"r1 = trace_hide rr1 (ev ` A) \<and> 
                         rr1 setinterleaves ((ta1, uaa1), insert tick (ev ` S))"
               using * by blast
             from a(2) 12 a5 a6 show ?thesis
             apply(exI rr1, exI "r2@v", intro conjI, simp_all (asm_lr))
               apply (metis a(5) append_Nil2 front_tickFree_append front_tickFree_mono ftf_Sync is_processT2_TR)
              apply (metis equals0D ftf_Sync1 ftf_Sync21 insertI1 tickFree_def)
             using front_tickFree_Nil by blast
           next
             case False
             with 12(14) obtain uaa1 where "u1 = trace_hide ua1 (ev ` A)@uaa1"
               by (metis append_eq_append_conv2 le_list_def)
             with a3 interleave_append_sym[of r1 "trace_hide ta1 (ev ` A)" "insert tick (ev ` S)"  
                  "trace_hide ua1 (ev ` A)" uaa1]  
             obtain taa1 taa2 ra1 ra2
               where aa1:"trace_hide ta1 (ev ` A) = taa1 @ taa2" and aa2:"r1 = ra1 @ ra2" and 
                 aa3:"ra1 setinterleaves ((taa1, trace_hide ua1 (ev ` A)), insert tick (ev ` S))" and
                 aa4:"ra2 setinterleaves ((taa2,uaa1), insert tick (ev ` S))" by blast
             with trace_hide_append[OF aa1[symmetric]] 
             obtain taaa1 where a5:"taa1 = trace_hide taaa1 (ev ` A) \<and> taaa1 \<le> ta1 \<and> taaa1 \<in> \<T> P"
               using "12"(7) D_T is_processT3_ST_pref le_list_def by blast
             with interleave_Hiding[OF _ aa3[simplified a5]] obtain rr1
               where a6:"ra1 = trace_hide rr1 (ev ` A) \<and> rr1 setinterleaves ((taaa1, ua1), insert tick (ev ` S))"
               using * by blast
             from a(2) 12 a5 show ?thesis
               apply(exI rr1, exI "ra2@r2@v", intro conjI, simp_all (asm_lr))
                  apply (metis aa2 front_tickFree_append front_tickFree_mono ftf_Sync 
                               Hiding_tickFree self_append_conv tickFree_append)          
                 apply (metis a6 ftf_Sync1 le_list_def tickFree_append tickFree_def)
                using a6 aa2 apply blast 
               using Sync.sym a6 front_tickFree_Nil by blast
           qed
         next
           case (13 ua fa xa)
           with isInfHiddenRun_1[of fa Q] have a0:"\<forall>i. \<exists>t. fa i = fa 0 @ t \<and> set t \<subseteq>  (ev ` A)" by simp
           define tlf where "tlf \<equiv> \<lambda>i. drop (length (fa 0)) (fa i)"
           have tlf_def2:"(fa x) = (fa 0) @ (tlf x)" for x by (metis a0 append_eq_conv_conj tlf_def)
           { fix x y
             assume *:"(x::nat) < y"
             hence "fa x = fa 0 @ tlf x \<and> fa y = fa 0 @ tlf y" by (metis tlf_def2)
             hence  "tlf x < tlf y"
               using strict_monoD[OF 13(16), of x y] by (simp add: A "*" le_list_def)
           } note tlf_strict_mono = this
           have tlf_range:"set (tlf i)  \<subseteq>  (ev ` A)" for i 
             by (metis a0 append_eq_conv_conj tlf_def)
           from 13 show ?case 
           proof(cases "u1 \<le> trace_hide (fa xa) (ev ` A)")
             case True
             then obtain uu1 where  "u1@uu1 = trace_hide (fa xa) (ev ` A)" using le_list_def by blast
             with trace_hide_append[OF this] 
             obtain uaa1 where a5:"u1 = trace_hide uaa1 (ev ` A) \<and> uaa1 \<le> (fa xa) \<and> uaa1 \<in> \<T> Q"
               by (metis "13"(17) is_processT3_ST le_list_def)
             from interleave_Hiding[OF _ 13(10)[simplified a5]] obtain rr1
-              where a6:"r1 = trace_hide rr1 (ev ` A) \<and> rr1 setinterleaves ((ta1, uaa1), insert tick (ev ` S))"
+              where a6:"  r1 = trace_hide rr1 (ev ` A) 
+                        \<and> rr1 setinterleaves ((ta1, uaa1), insert tick (ev ` S))"
               using * by blast
             from a(2) 13 a5 a6 show ?thesis
             apply(exI rr1, exI "r2@v", intro conjI, simp_all (asm_lr))
               apply (metis a(5) append_Nil2 front_tickFree_append front_tickFree_mono ftf_Sync is_processT2_TR)
              apply (metis equals0D ftf_Sync1 ftf_Sync21 insertI1 tickFree_def)
             using front_tickFree_Nil by blast
           next
             case False
             with 13(14) obtain uaa1 where "u1 = trace_hide (fa 0) (ev ` A)@uaa1"
               by (metis "13"(18) append_eq_append_conv2 le_list_def)
             with a3 interleave_append_sym[of r1 "trace_hide ta1 (ev ` A)" "insert tick (ev ` S)"  
                  "trace_hide (fa 0) (ev ` A)" uaa1]  
             obtain taa1 taa2 ra1 ra2
               where aa1:"trace_hide ta1 (ev ` A) = taa1 @ taa2" and aa2:"r1 = ra1 @ ra2" and 
                 aa3:"ra1 setinterleaves ((taa1, trace_hide (fa 0) (ev ` A)), insert tick (ev ` S))" and
                 aa4:"ra2 setinterleaves ((taa2,uaa1), insert tick (ev ` S))" by blast
             with trace_hide_append[OF aa1[symmetric]] 
             obtain taaa1 where a5:"taa1 = trace_hide taaa1 (ev ` A) \<and> taaa1 \<le> ta1 \<and> taaa1 \<in> \<T> P"
               using "13"(7) D_T is_processT3_ST_pref le_list_def by blast
             with interleave_Hiding[OF _ aa3[simplified a5]] obtain rr1
               where a6:"ra1 = trace_hide rr1 (ev ` A) \<and> 
                         rr1 setinterleaves ((taaa1, (fa 0)), insert tick (ev ` S))"
               using * by blast
             from a(2) 13 a0 a5 a6 aa1 aa2 aa3 show ?thesis
               apply(exI rr1, exI "ra2@r2@v", intro conjI, simp_all (asm_lr))
                 apply (metis front_tickFree_append front_tickFree_mono ftf_Sync 
                              Hiding_tickFree self_append_conv tickFree_append)          
                 apply (metis a6 ftf_Sync1 le_list_def tickFree_append tickFree_def)
              proof (rule_tac disjI2, exI "\<lambda>i. rr1@(tlf i)", intro conjI, goal_cases 131 132 133 134)
                case 131
                then show ?case 
                  apply(rule_tac strict_monoI, drule_tac tlf_strict_mono,rule_tac less_append) by assumption
              next
                case 132
                have "(rr1@tlf i) setinterleaves ((taaa1, fa i),insert tick (ev ` S))" for i
                  apply(subst tlf_def2, rule interleave_append_tail_sym[OF a6[THEN conjunct2], of "tlf i"])
                  using * tlf_range by blast
                then show ?case
                  unfolding T_Sync using a5 13(17) by auto
              next
                case 133
                from tlf_range have "trace_hide (y @ tlf i) (ev ` A) = trace_hide y (ev ` A)" for i y 
                  apply(induct y) using filter_empty_conv apply fastforce by simp
                then show ?case by simp
              next
                case 134
                have "tlf 0 = []"
                  by (simp add: tlf_def)
                then show ?case by simp
              qed  
           qed  
         qed
       next
         case 2
         from 2(8) obtain nta::nat and ff::"nat \<Rightarrow> 'a event list" 
           where "strict_mono ff" and ff:"(\<forall>i. ff i \<in> \<T> P) \<and> ta1 = ff nta \<and> 
                 (\<forall>i. trace_hide (ff i) (ev ` A) = trace_hide (ff 0) (ev ` A))" by blast
         define f where "f \<equiv> (\<lambda>i. ff (i + nta))"
         with ff have f1:"strict_mono f" and f2:"(\<forall>i. f i \<in> \<T> P)" and f3:"ta1 = f 0" and 
                 f4:"(\<forall>i. trace_hide (f i) (ev ` A) = trace_hide ta1 (ev ` A))"
           apply auto apply(rule strict_monoI, rule \<open>strict_mono ff\<close>[THEN strict_monoD])
           by simp metis
         with isInfHiddenRun_1[of f P] have a0:"\<forall>i. \<exists>t. f i = f 0 @ t \<and> set t \<subseteq>  (ev ` A)" by simp
         define tlf where "tlf \<equiv> \<lambda>i. drop (length (f 0)) (f i)"
         have tlf_def2:"(f x) = ta1 @ (tlf x)" for x by (metis a0 f3 append_eq_conv_conj tlf_def)
         { fix x y
           assume *:"(x::nat) < y"
           hence "f x = f 0 @ tlf x \<and> f y = f 0 @ tlf y" by (metis f3 tlf_def2)
           hence  "tlf x < tlf y"
             using strict_monoD[OF f1, of x y] by (simp add: A "*" le_list_def)
         } note tlf_strict_mono = this
         have tlf_range:"set (tlf i)  \<subseteq>  (ev ` A)" for i 
           by (metis a0 append_eq_conv_conj tlf_def)
         with 2 interleave_append[of r "trace_hide ta1 (ev ` A)" "ta2" "insert tick (ev ` S)" u] 
         obtain u1 u2 r1 r2
           where a1:"u = u1 @ u2" and a2:"r = r1 @ r2" and 
                 a3:"r1 setinterleaves ((trace_hide ta1 (ev ` A), u1), insert tick (ev ` S))" and
                 a4:"r2 setinterleaves ((ta2, u2), insert tick (ev ` S))" by blast
         with 2(1-6) f1 f2 f3 f4 show ?case
         proof(auto simp only:T_Hiding, goal_cases 21 22 23)
           case (21 ua) 
           from trace_hide_append[OF 21(14)] obtain ua1 
             where a5:"u1 = trace_hide ua1 (ev ` A) \<and> ua1 \<le> ua \<and> ua1 \<in> \<T> Q" 
             using "21"(15) F_T is_processT3_ST_pref le_list_def by blast
           from interleave_Hiding[OF _ a3[simplified a5]] obtain ra1
             where a6:"r1 = trace_hide ra1 (ev ` A) \<and> ra1 setinterleaves ((ta1, ua1), insert tick (ev ` S))"
             using * by blast
           from a(2) 21 a5 a6 show ?case 
             apply(exI ra1, exI "r2@v", intro conjI, simp_all (asm_lr))
               apply (metis a(5) append_Nil2 front_tickFree_append front_tickFree_mono ftf_Sync is_processT2_TR)
              apply (metis equals0D ftf_Sync1 ftf_Sync21 insertI1 tickFree_def) 
              proof (rule_tac disjI2, exI "\<lambda>i. ra1@(tlf i)", intro conjI, goal_cases 211 212 213 214)
                case 211
                then show ?case 
                  by(rule_tac strict_monoI, drule_tac tlf_strict_mono, rule_tac less_append)(assumption)
              next
                case 212
                have "(ra1@tlf i) setinterleaves ((f i, ua1),insert tick (ev ` S))" for i
                  apply(subst tlf_def2, rule interleave_append_tail[OF a6[THEN conjunct2], of "tlf i"])
                  using * tlf_range by blast
                then show ?case
                  unfolding T_Sync using a5 21(15) f2 by auto
              next
                case 213
                from tlf_range have "trace_hide (y @ tlf i) (ev ` A) = trace_hide y (ev ` A)" for i y 
                  apply(induct y) using filter_empty_conv apply fastforce by simp
                then show ?case by simp
              next
                case 214
                have "tlf 0 = []"
                  by (simp add: tlf_def)
                then show ?case by simp
              qed              
         next
           case (22 ua1 ua2)
           then show ?case
           proof(cases "u1 \<le> trace_hide ua1 (ev ` A)")
             case True
             then obtain uu1 where  "u1@uu1 = trace_hide ua1 (ev ` A)" using le_list_def by blast
             from trace_hide_append[OF this] 
             obtain uaa1 where a5:"u1 = trace_hide uaa1 (ev ` A) \<and> uaa1 \<le> ua1 \<and> uaa1 \<in> \<T> Q" 
               using "22"(17) D_T is_processT3_ST le_list_def by blast
             from interleave_Hiding[OF _ a3[simplified a5]] 
             obtain ra1
-              where a6:"r1 = trace_hide ra1 (ev ` A) \<and> ra1 setinterleaves ((ta1, uaa1), insert tick (ev ` S))"
+              where a6:"  r1 = trace_hide ra1 (ev ` A) 
+                        \<and> ra1 setinterleaves ((ta1, uaa1), insert tick (ev ` S))"
               using * by blast
             from a(2) 22 a5 a6 show ?thesis
               apply(exI ra1, exI "r2@v", intro conjI, simp_all (asm_lr))
-                apply (metis a(5) append_Nil2 front_tickFree_append front_tickFree_mono ftf_Sync is_processT2_TR)
+                apply (metis a(5) append_Nil2 front_tickFree_append 
+                                  front_tickFree_mono ftf_Sync is_processT2_TR)
                apply (metis equals0D ftf_Sync1 ftf_Sync21 insertI1 tickFree_def)
              proof (rule_tac disjI2, exI "\<lambda>i. ra1@(tlf i)", intro conjI, goal_cases 211 212 213 214)
                case 211
                then show ?case apply(rule_tac strict_monoI, drule_tac tlf_strict_mono, rule_tac less_append) by assumption
              next
                case 212
                have "(ra1@tlf i) setinterleaves ((f i, uaa1),insert tick (ev ` S))" for i
                  apply(subst tlf_def2, rule interleave_append_tail[OF a6[THEN conjunct2], of "tlf i"])
                  using * tlf_range by blast
                then show ?case
                  unfolding T_Sync using a5 22(15) f2 by auto
              next
                case 213
                from tlf_range have "trace_hide (y @ tlf i) (ev ` A) = trace_hide y (ev ` A)" for i y 
                  apply(induct y) using filter_empty_conv apply fastforce by simp
                then show ?case by simp
              next
                case 214
                have "tlf 0 = []"
                  by (simp add: tlf_def)
                then show ?case by simp
              qed  
           next
             case False
             with 22(16) obtain uaa1 where "u1 = trace_hide ua1 (ev ` A)@uaa1"
               by (metis append_eq_append_conv2 le_list_def)
             with a3 interleave_append_sym[of r1 "trace_hide ta1 (ev ` A)" "insert tick (ev ` S)"  "
                  trace_hide ua1 (ev ` A)" uaa1]  
             obtain taa1 taa2 ra1 ra2
               where aa1:"trace_hide ta1 (ev ` A) = taa1 @ taa2" and aa2:"r1 = ra1 @ ra2" and 
                 aa3:"ra1 setinterleaves ((taa1, trace_hide ua1 (ev ` A)), insert tick (ev ` S))" and
                 aa4:"ra2 setinterleaves ((taa2,uaa1), insert tick (ev ` S))" by blast
             with trace_hide_append[OF aa1[symmetric]] 
             obtain taaa1 where a5:"taa1 = trace_hide taaa1 (ev ` A) \<and> taaa1 \<le> ta1 \<and> taaa1 \<in> \<T> P"
               using f2 f3 is_processT3_ST_pref le_list_def by metis
             with interleave_Hiding[OF _ aa3[simplified a5]] obtain rr1
               where a6:"ra1 = trace_hide rr1 (ev ` A) \<and> 
                         rr1 setinterleaves ((taaa1, ua1), insert tick (ev ` S))"
               using * by blast
             from a(2) 22 a5 show ?thesis
               apply(exI rr1, exI "ra2@r2@v", intro conjI, simp_all (asm_lr))
-                 apply (metis a(5) a(8) aa2 front_tickFree_append front_tickFree_mono ftf_Sync Hiding_tickFree 
-                              is_processT2_TR self_append_conv tickFree_append)                
+                 apply (metis a(5) a(8) aa2 front_tickFree_append front_tickFree_mono is_processT2_TR
+                              ftf_Sync Hiding_tickFree   self_append_conv tickFree_append)                
                 apply (metis a6 ftf_Sync1 le_list_def tickFree_append tickFree_def)
                using a6 aa2 apply blast 
               using Sync.sym a6[THEN conjunct2] front_tickFree_Nil by (metis append_Nil2)
           qed
         next
           case (23 ua fa xa)
           with isInfHiddenRun_1[of fa Q] have a0:"\<forall>i. \<exists>t. fa i = fa 0 @ t \<and> set t \<subseteq>  (ev ` A)" by simp
           define tlfa where "tlfa \<equiv> \<lambda>i. drop (length (fa 0)) (fa i)"
           have tlfa_def2:"(fa x) = (fa 0) @ (tlfa x)" for x by (metis a0 append_eq_conv_conj tlfa_def)
           { fix x y
             assume *:"(x::nat) < y"
             hence "fa x = fa 0 @ tlfa x \<and> fa y = fa 0 @ tlfa y" by (metis tlfa_def2)
             hence  "tlfa x < tlfa y"
               using strict_monoD[OF 23(18), of x y] by (simp add: A "*" le_list_def)
           } note tlfa_strict_mono = this
           have tlfa_range:"set (tlfa i)  \<subseteq>  (ev ` A)" for i 
             by (metis a0 append_eq_conv_conj tlfa_def)
           from 23 show ?case 
           proof(cases "u1 \<le> trace_hide (fa xa) (ev ` A)")
             case True
             then obtain uu1 where  "u1@uu1 = trace_hide (fa xa) (ev ` A)" using le_list_def by blast
             with trace_hide_append[OF this] 
             obtain uaa1 where a5:"u1 = trace_hide uaa1 (ev ` A) \<and> uaa1 \<le> (fa xa) \<and> uaa1 \<in> \<T> Q"
               by (metis "23"(19) is_processT3_ST le_list_def)
             from interleave_Hiding[OF _ a3[simplified a5]] 
             obtain rr1
               where a6:"r1 = trace_hide rr1 (ev ` A) \<and> rr1 setinterleaves ((ta1, uaa1), insert tick (ev ` S))"
               using * by blast
             from a(2) 23 a5 a6 show ?thesis
             apply(exI rr1, exI "r2@v", intro conjI, simp_all (asm_lr))
-              apply (metis a(5) append_Nil2 front_tickFree_append front_tickFree_mono ftf_Sync is_processT2_TR)
-             apply (metis equals0D ftf_Sync1 ftf_Sync21 insertI1 tickFree_def)
+            apply (metis a(5) append_Nil2 front_tickFree_append front_tickFree_mono 
+                                  ftf_Sync is_processT2_TR)
+            apply (metis equals0D ftf_Sync1 ftf_Sync21 insertI1 tickFree_def)
             proof (rule_tac disjI2, exI "\<lambda>i. rr1@(tlf i)", intro conjI, goal_cases 211 212 213 214)
                case 211
-               then show ?case apply(rule_tac strict_monoI, drule_tac tlf_strict_mono, rule_tac less_append) by assumption
+               then show ?case 
+                 apply(rule_tac strict_monoI, drule_tac tlf_strict_mono, rule_tac less_append) by assumption
              next
                case 212
                have "(rr1@tlf i) setinterleaves ((f i, uaa1),insert tick (ev ` S))" for i
                  apply(subst tlf_def2, rule interleave_append_tail[OF a6[THEN conjunct2], of "tlf i"])
                  using * tlf_range by blast
                then show ?case
                  unfolding T_Sync using a5 23(17) f2 by auto
              next
                case 213
                from tlf_range have "trace_hide (y @ tlf i) (ev ` A) = trace_hide y (ev ` A)" for i y 
                  apply(induct y) using filter_empty_conv apply fastforce by simp
                then show ?case by simp
              next
                case 214
                have "tlf 0 = []"
                  by (simp add: tlf_def)
                then show ?case by simp
              qed  
           next
             case False
             with 23(16) obtain uaa1 where "u1 = trace_hide (fa 0) (ev ` A)@uaa1"
               by (metis "23"(20) append_eq_append_conv2 le_list_def)
-            with a3 interleave_append_sym[of r1 "trace_hide ta1 (ev ` A)" "insert tick (ev ` S)"  "trace_hide (fa 0) (ev ` A)" uaa1]  
+            with a3 interleave_append_sym[of r1 "trace_hide ta1 (ev ` A)" 
+                                                "insert tick (ev ` S)"  
+                                                "trace_hide (fa 0) (ev ` A)" uaa1]  
             obtain taa1 taa2 ra1 ra2
               where aa1:"trace_hide ta1 (ev ` A) = taa1 @ taa2" and aa2:"r1 = ra1 @ ra2" and 
                 aa3:"ra1 setinterleaves ((taa1, trace_hide (fa 0) (ev ` A)), insert tick (ev ` S))" and
                 aa4:"ra2 setinterleaves ((taa2,uaa1), insert tick (ev ` S))" by blast
             with trace_hide_append[OF aa1[symmetric]] 
             obtain taaa1 where a5:"taa1 = trace_hide taaa1 (ev ` A) \<and> taaa1 \<le> ta1 \<and> taaa1 \<in> \<T> P"
               by (metis f2 f3 is_processT3_ST le_list_def)
             with interleave_Hiding[OF _ aa3[simplified a5]] obtain rr1
               where a6:"ra1 = trace_hide rr1 (ev ` A) \<and> 
                         rr1 setinterleaves ((taaa1, (fa 0)), insert tick (ev ` S))"
               using * by blast
             from a(2) 23 a0 a5 a6 aa1 aa2 aa3 show ?thesis
               apply(exI rr1, exI "ra2@r2@v", intro conjI, simp_all (asm_lr))
                 apply (metis a(5) a(8) front_tickFree_append front_tickFree_mono ftf_Sync 
                                        Hiding_tickFree is_processT2_TR self_append_conv)
                 apply (metis a6 ftf_Sync1 le_list_def tickFree_append tickFree_def)
              proof (rule_tac disjI2, exI "\<lambda>i. rr1@(tlfa i)", intro conjI, goal_cases 131 132 133 134)
                case 131
                then show ?case 
                  by(rule_tac strict_monoI, drule_tac tlfa_strict_mono, rule_tac less_append) assumption
              next
                case 132
                have "(rr1@tlfa i) setinterleaves ((taaa1, fa i),insert tick (ev ` S))" for i
                  apply(subst tlfa_def2, rule interleave_append_tail_sym[OF a6[THEN conjunct2], of "tlfa i"])
                  using * tlfa_range by blast
                then show ?case
                  unfolding T_Sync using a5 23(19) by auto
              next
                case 133
                from tlfa_range have "trace_hide (y @ tlfa i) (ev ` A) = trace_hide y (ev ` A)" for i y 
                  apply(induct y) using filter_empty_conv apply fastforce by simp
                then show ?case by simp
              next
                case 134
                have "tlfa 0 = []"
                  by (simp add: tlfa_def)
                then show ?case by simp
              qed  
           qed  
         qed
       qed
     qed
   }
   from this[of P Q] this[of Q P] Sync_commute[of P S Q] show ?thesis
     by (simp add:D_Sync T_Sync) blast
 qed
 
 lemma Hiding_Sync: 
   \<open>finite A \<Longrightarrow> A \<inter> S = {} \<Longrightarrow> ((P \<lbrakk>S\<rbrakk> Q) \ A) = ((P \ A) \<lbrakk>S\<rbrakk> (Q \ A))\<close>
 proof(auto simp add: Process_eq_spec_optimized subset_antisym[OF Hiding_Sync_D1 Hiding_Sync_D2], 
       simp_all add: F_Sync F_Hiding,
       goal_cases)
   case (1 a b)
   then show ?case 
   proof(elim disjE, goal_cases 11 12)
     case 11
     then show ?case
     proof(elim exE conjE, elim disjE, goal_cases 111 112)
       case (111 c)
       from 111(7) obtain t u X Y where
         a: "(t, X) \<in> \<F> P" and
         b: "(u, Y) \<in> \<F> Q" and 
         c: "c setinterleaves ((t, u), insert tick (ev ` S))" and
         d: "b  \<union> ev ` A = (X \<union> Y) \<inter> insert tick (ev ` S) \<union> X \<inter> Y" by auto
       from 1(2) d have e:"ev ` A \<subseteq> X \<inter> Y" by blast 
       from a b c d e 111(2,3) show ?case
         apply(rule_tac disjI1)
         apply(rule_tac x="trace_hide t (ev ` A)" in exI, rule_tac x="trace_hide u (ev ` A)" in exI)
         apply(rule_tac x="X - ((ev ` A) - b)" in exI, intro conjI disjI1, rule_tac x="t" in exI)
          apply (metis Int_subset_iff Un_Diff_Int Un_least is_processT4 sup_ge1)
         apply(rule_tac x="Y - ((ev ` A) - b)" in exI, intro conjI disjI1, rule_tac x="u" in exI)
          apply (metis Int_subset_iff Un_Diff_Int Un_least is_processT4 sup_ge1)
         using Hiding_interleave[of "ev ` A" "insert tick (ev ` S)" c t u] by blast+
     next
       case (112 t)
       from 112(7) have a:"front_tickFree t" 
         by (metis (mono_tags, opaque_lifting) D_imp_front_tickFree append_Nil2 
                   front_tickFree_append ftf_Sync is_processT2_TR)
       from 112 have "t \<in> \<D> (P \<lbrakk>S\<rbrakk> Q)" by (simp add:D_Sync)
-      with 112(1,2,3) have "a \<in> \<D> ((P \<lbrakk>S\<rbrakk> Q) \\ A)" 
+      with 112(1,2,3) have \<open>a \<in> \<D> ((P \<lbrakk>S\<rbrakk> Q) \ A)\<close>
         apply (simp add:D_Hiding)
         proof(case_tac "tickFree t", goal_cases 1121 1122)
           case 1121
           then show ?case 
             by (rule_tac x=t in exI, rule_tac x="[]" in exI, simp)
         next
           case 1122
           with a obtain t' where "t = t'@[tick]" using nonTickFree_n_frontTickFree by blast
           with a show ?case 
             apply (rule_tac x="t'" in exI, rule_tac x="[tick]" in exI, auto)
              using front_tickFree_mono apply blast
             using 1122(4) is_processT9 by blast
         qed
       then show ?case
         apply(rule_tac disjI2)
-        using Hiding_Sync_D1[of A S P Q, OF 112(1,2)] D_Sync[of "P \\ A" S "Q \\ A"] by auto
+        using Hiding_Sync_D1[of A S P Q, OF 112(1,2)] D_Sync[of \<open>P \ A\<close> S \<open>Q \ A\<close>] by auto
     qed
   next
     case 12
-    hence "a \<in> \<D> ((P \<lbrakk>S\<rbrakk> Q) \\ A)" by (simp add:D_Hiding)
+    hence \<open>a \<in> \<D> ((P \<lbrakk>S\<rbrakk> Q) \ A)\<close> by (simp add:D_Hiding)
     then show ?case
       apply(rule_tac disjI2)
-      using Hiding_Sync_D1[of A S P Q, OF 12(1,2)] D_Sync[of "P \\ A" S "Q \\ A"] by auto
+      using Hiding_Sync_D1[of A S P Q, OF 12(1,2)] D_Sync[of \<open>P \ A\<close> S \<open>Q \ A\<close>] by auto
   qed 
 next
   case (2 a b)
   then show ?case
   proof(elim disjE, goal_cases 21 22)
     case 21
     then show ?case
     proof(elim exE conjE, elim disjE, goal_cases 211 212 213 214)
       case (211 t u X Y)
       then obtain ta ua where t211: "t = trace_hide ta (ev ` A) \<and> (ta, X \<union> ev ` A) \<in> \<F> P" and 
                               u211: "u = trace_hide ua (ev ` A) \<and> (ua, Y \<union> ev ` A) \<in> \<F> Q" by blast
       from interleave_Hiding[of "(ev ` A)" "insert tick (ev ` S)" a ta ua] "211"(1,2,3) t211 u211 
       obtain aa  where a211: "a = trace_hide aa  (ev ` A) \<and> 
                               aa setinterleaves ((ta, ua), insert tick (ev ` S))" by blast
       with 211(1,2,3,4) t211 u211 show ?case
         apply(rule_tac disjI1, rule_tac x="aa" in exI, simp)
         apply(rule_tac disjI1, rule_tac x="ta" in exI, rule_tac x="ua" in exI)
         apply(rule_tac x="X \<union> ev ` A" in exI, rule conjI) using is_processT4 apply blast
         apply(rule_tac x="Y \<union> ev ` A" in exI, rule conjI) using is_processT4 by blast+
     next
       case (212 t u X Y)
-      hence "u \<in> \<D> (Q \\ A)" and "t \<in> \<T> (P \\ A)"  
+      hence \<open>u \<in> \<D> (Q \ A)\<close> and \<open>t \<in> \<T> (P \ A)\<close>  
          apply (simp add:D_Hiding)
         using "212"(8) F_T elemTIselemHT by blast
-      with 212(3,8) have "a \<in> \<D> (((P \\ A) \<lbrakk>S\<rbrakk> (Q \\ A)))" 
+      with 212(3,8) have \<open>a \<in> \<D> (((P \ A) \<lbrakk>S\<rbrakk> (Q \ A)))\<close> 
         apply (simp add:D_Sync)
         using Sync.sym front_tickFree_charn by blast
       then show ?case
         apply (rule_tac disjI2)
         using Hiding_Sync_D2[of A S P Q, OF 2(2)] D_Hiding[of "(P \<lbrakk>S\<rbrakk> Q)", simplified] by auto
     next
       case (213 t u X Y)
-      hence "u \<in> \<T> (Q \\ A)" and "t \<in> \<D> (P \\ A)"  
+      hence \<open>u \<in> \<T> (Q \ A)\<close> and \<open>t \<in> \<D> (P \ A)\<close>  
         by (simp_all add:D_Hiding, metis F_T elemTIselemHT)
-      with 213(3,8) have "a \<in> \<D> (((P \\ A) \<lbrakk>S\<rbrakk> (Q \\ A)))"
+      with 213(3,8) have \<open>a \<in> \<D> (((P \ A) \<lbrakk>S\<rbrakk> (Q \ A)))\<close>
         apply (simp add:D_Sync)
         using Sync.sym front_tickFree_charn by blast
       then show ?case
         apply (rule_tac disjI2)
         using Hiding_Sync_D2[of A S P Q, OF 2(2)] D_Hiding[of "(P \<lbrakk>S\<rbrakk> Q)", simplified] by auto
     next
       case (214 t u X Y)
-      hence "u \<in> \<T> (Q \\ A)" and "t \<in> \<D> (P \\ A)"
+      hence \<open>u \<in> \<T> (Q \ A)\<close> and \<open>t \<in> \<D> (P \ A)\<close>
         by (simp_all add:D_Hiding T_Hiding)
-      with 214(3,8) have "a \<in> \<D> (((P \\ A) \<lbrakk>S\<rbrakk> (Q \\ A)))"
+      with 214(3,8) have \<open>a \<in> \<D> (((P \ A) \<lbrakk>S\<rbrakk> (Q \ A)))\<close>
         apply (simp add:D_Sync)
         using Sync.sym front_tickFree_charn by blast
       then show ?case
         apply (rule_tac disjI2)
         using Hiding_Sync_D2[of A S P Q, OF 2(2)] D_Hiding[of "(P \<lbrakk>S\<rbrakk> Q)", simplified] by auto
     qed
   next
     case 22
     hence \<open>a \<in> \<D> (((P \ A) \<lbrakk>S\<rbrakk> (Q \ A)))\<close> by (simp add:D_Sync)
     then show ?case
       apply (rule_tac disjI2)
       using Hiding_Sync_D2[of A S P Q, OF 2(2)] D_Hiding[of "(P \<lbrakk>S\<rbrakk> Q)", simplified] by auto
   qed 
 qed
 
 lemma Sync_assoc_oneside_D: "\<D> (P \<lbrakk>S\<rbrakk> (Q \<lbrakk>S\<rbrakk> T)) \<subseteq> \<D> (P \<lbrakk>S\<rbrakk> Q \<lbrakk>S\<rbrakk> T)"
 proof(auto simp add:D_Sync T_Sync del:disjE, goal_cases a)
   case (a tt uu rr vv)
   from a(3,4) show ?case
   proof(auto, goal_cases)
     case (1 t u)
     with interleave_assoc_2[OF 1(5) 1(1)] obtain tu 
       where *:"tu setinterleaves ((tt, t), insert tick (ev ` S))" 
         and **:"rr setinterleaves ((tu, u), insert tick (ev ` S))"
       by blast
     with a(1,2) 1 show ?case by (metis append.right_neutral front_tickFree_charn) 
   next
     case (2 t u u1 u2)
     with interleave_append_sym [OF 2(1)] obtain t1 t2 r1 r2
       where a1:"tt = t1 @ t2" and a2:"rr = r1 @ r2" 
         and a3:"r1 setinterleaves ((t1, u1), insert tick (ev ` S))" 
         and a4:"r2 setinterleaves ((t2, u2), insert tick (ev ` S))" by blast
     with interleave_assoc_2[OF 2(5) a3] obtain tu 
       where *:"tu setinterleaves ((t1, t), insert tick (ev ` S))" 
        and **:"r1 setinterleaves ((tu, u), insert tick (ev ` S))"
       by blast
     with a1 a2 a3 a(1,2) 2 show ?case 
       apply(exI tu, exI u, exI r1, exI "r2@vv", intro conjI, simp_all) 
         apply (metis D_imp_front_tickFree append_Nil2 front_tickFree_append front_tickFree_mono ftf_Sync)
        using D_imp_front_tickFree front_tickFree_append front_tickFree_mono ftf_Sync apply blast
       by (metis NT_ND Sync.sym append_Nil2 front_tickFree_Nil is_processT3_ST)
   next
     case (3 v u u1 u2)
     with interleave_append_sym [OF 3(1)] obtain t1 t2 r1 r2
       where a1:"tt = t1 @ t2" and a2:"rr = r1 @ r2" 
        and  a3:"r1 setinterleaves ((t1, u1), insert tick (ev ` S))" 
        and  a4:"r2 setinterleaves ((t2, u2), insert tick (ev ` S))" by blast
     with interleave_assoc_2[OF _ a3, of u v] obtain tu 
       where *:"tu setinterleaves ((t1, u), insert tick (ev ` S))" 
        and **:"r1 setinterleaves ((tu, v), insert tick (ev ` S))"
       using Sync.sym 3(5) by blast
     with a1 a2 a3 a(1,2) 3 show ?case 
       apply(exI v, exI tu, exI r1, exI "r2@vv", intro conjI, simp_all) 
         apply (metis D_imp_front_tickFree append_Nil2 front_tickFree_append front_tickFree_mono ftf_Sync)
       using D_imp_front_tickFree front_tickFree_append front_tickFree_mono ftf_Sync apply blast
       using Sync.sym apply blast by (meson D_T is_processT3_ST)
   next
     case (4 t u)
     with interleave_assoc_2[OF 4(3) 4(1)] obtain tu 
       where *:"tu setinterleaves ((tt, t), insert tick (ev ` S))" 
        and **:"rr setinterleaves ((tu, u), insert tick (ev ` S))"
       by blast
     with a(1,2) 4 show ?case 
       apply(exI tu, exI u, exI rr, exI vv, simp) using NT_ND front_tickFree_Nil by blast
   next
     case (5 t u)
     with interleave_assoc_2[OF _ 5(1), of u t] obtain tu 
       where *:"tu setinterleaves ((tt, u), insert tick (ev ` S))" 
        and **:"rr setinterleaves ((tu, t), insert tick (ev ` S))"
       using Sync.sym by blast
     with a(1,2) 5 show ?case 
       apply(exI tu, exI t, exI rr, exI vv, simp) using NT_ND front_tickFree_Nil by blast
   next
     case (6 t u u1 u2)
     with interleave_append [OF 6(1)] obtain t1 t2 r1 r2
       where a1:"uu = t1 @ t2" and a2:"rr = r1 @ r2" 
         and a3:"r1 setinterleaves ((t1, u1), insert tick (ev ` S))" 
         and a4:"r2 setinterleaves ((t2, u2), insert tick (ev ` S))" using Sync.sym by blast
     with interleave_assoc_2[OF 6(5) a3] obtain tu 
       where *:"tu setinterleaves ((t1, t), insert tick (ev ` S))" 
        and **:"r1 setinterleaves ((tu, u), insert tick (ev ` S))"
       by blast
     with a1 a2 a3 a(1,2) 6 show ?case 
       apply(exI tu, exI u, exI r1, exI "r2@vv", intro conjI, simp_all) 
         apply (metis append_Nil2 front_tickFree_append front_tickFree_mono ftf_Sync is_processT2_TR) 
        apply (meson front_tickFree_append front_tickFree_mono ftf_Sync is_processT2_TR) 
       by (metis Sync.sym append_Nil2 front_tickFree_Nil is_processT3_ST)
   next
     case (7 v u t1 t2)
     with interleave_append [OF 7(1)] obtain u1 u2 r1 r2
       where a1:"uu = u1 @ u2" and a2:"rr = r1 @ r2" 
        and  a3:"r1 setinterleaves ((t1, u1), insert tick (ev ` S))" 
        and  a4:"r2 setinterleaves ((t2, u2), insert tick (ev ` S))" by blast
     with interleave_assoc_2[of t1 u _ v r1 u1] obtain tu 
       where *:"tu setinterleaves ((u1, u), insert tick (ev ` S))" 
        and **:"r1 setinterleaves ((tu, v), insert tick (ev ` S))"
       using 7(5) Sync.sym by blast
     with a1 a2 a3 a(1,2) 7 show ?case 
       apply(exI v, exI tu, exI r1, exI "r2@vv", intro conjI, simp_all) 
         apply (metis append_Nil2 front_tickFree_append front_tickFree_mono ftf_Sync is_processT2_TR) 
        apply (meson front_tickFree_append front_tickFree_mono ftf_Sync is_processT2_TR) 
       using Sync.sym apply blast by (meson D_T is_processT3_ST)
   next
     case (8 t u)
     with interleave_assoc_2[OF 8(3), of rr uu] obtain tu 
       where *:"tu setinterleaves ((uu, t), insert tick (ev ` S))" 
        and **:"rr setinterleaves ((tu, u), insert tick (ev ` S))"
       using Sync.sym by blast
     with a(1,2) 8 show ?case 
       apply(exI tu, exI u, exI rr, exI vv, simp) using Sync.sym front_tickFree_Nil by blast
   next
     case (9 t u)
     with interleave_assoc_1[OF 9(3), of rr uu] obtain uv 
       where *:"uv setinterleaves ((u, uu), insert tick (ev ` S))" 
        and **:"rr setinterleaves ((t, uv), insert tick (ev ` S))"
       by blast
     with a(1,2) 9 show ?case 
       apply(exI t, exI uv, exI rr, exI vv, simp) using Sync.sym front_tickFree_Nil by blast
   qed
 qed
 
 lemma Sync_assoc_oneside: "((P \<lbrakk>S\<rbrakk> Q) \<lbrakk>S\<rbrakk> T) \<le> (P \<lbrakk>S\<rbrakk> (Q \<lbrakk>S\<rbrakk> T))"
 proof(unfold le_ref_def, rule conjI, goal_cases D F)
   case D
   then show ?case using Sync_assoc_oneside_D by assumption
 next
   case F
   then show ?case
   unfolding F_Sync proof(rule Un_least, goal_cases FF DD)
     case (FF)
     then show ?case
     proof(rule subsetI, simp add:D_Sync T_Sync split_paired_all, elim exE conjE disjE, goal_cases)
       case (1 r Xtuv t uv Xt Xuv u v Xu Xv)
       with interleave_assoc_2[OF 1(6), OF 1(2)] obtain tu
         where *:"tu setinterleaves ((t, u), insert tick (ev ` S))" 
         and **:"r setinterleaves ((tu, v), insert tick (ev ` S))" by blast
       with 1(1,3,4,5,7) show ?case 
         apply(rule_tac disjI1, exI tu, exI v, exI "(Xt \<union> Xu) \<inter> insert tick (ev ` S) \<union> Xt \<inter> Xu", 
               intro conjI disjI1, simp_all) 
         by blast+
     next
       case (2 r Xtuv t uv Xt Xuv u v uv1 uv2)
       with interleave_append_sym [of r t _ uv1 uv2] obtain t1 t2 r1 r2
         where a1:"t = t1 @ t2" and a2:"r = r1 @ r2" 
           and a3:"r1 setinterleaves ((t1, uv1), insert tick (ev ` S))" 
           and a4:"r2 setinterleaves ((t2, uv2), insert tick (ev ` S))" by metis
       with interleave_assoc_2[OF 2(6), OF a3] obtain tu
         where *:"tu setinterleaves ((t1, u), insert tick (ev ` S))" 
          and **:"r1 setinterleaves ((tu, v), insert tick (ev ` S))" by blast
       from 2(1) a1 obtain Xt1 where ***:"(t1, Xt1) \<in> \<F> P" using is_processT3_SR by blast
       from 2 a1 a2 a3 a4 * ** *** show ?case
         apply(rule_tac disjI2, exI tu, exI v, exI r1, exI r2, intro conjI disjI1, simp_all) 
           apply (metis front_tickFree_charn front_tickFree_mono ftf_Sync is_processT2) 
          apply (metis equals0D ftf_Sync1 ftf_Sync21 insertI1 tickFree_def)
         using F_T Sync.sym front_tickFree_Nil by blast
     next
       case (3 r Xtuv t uv Xt Xuv v u uv1 uv2)
       with interleave_append_sym [of r t _ uv1 uv2] obtain t1 t2 r1 r2
         where a1:"t = t1 @ t2" and a2:"r = r1 @ r2" 
          and  a3:"r1 setinterleaves ((t1, uv1), insert tick (ev ` S))" 
          and  a4:"r2 setinterleaves ((t2, uv2), insert tick (ev ` S))" by metis
       with interleave_assoc_2[OF _ a3, of u v] obtain tu
         where *:"tu setinterleaves ((t1, u), insert tick (ev ` S))" 
          and **:"r1 setinterleaves ((tu, v), insert tick (ev ` S))" using "3"(6) Sync.sym by blast
       from 3(1) a1 obtain Xt1 
         where ***:"(t1, Xt1) \<in> \<F> P" using is_processT3_SR by blast
       from 3 a1 a2 a3 a4 * ** *** show ?case
         apply(rule_tac disjI2, exI v, exI tu, exI r1, exI r2, intro conjI, simp_all) 
           apply (metis front_tickFree_charn front_tickFree_mono ftf_Sync is_processT2) 
          apply (metis equals0D ftf_Sync1 ftf_Sync21 insertI1 tickFree_def)
         using Sync.sym F_T by blast+ 
     next
       case (4 r Xtuv t uv Xt Xuv u v uv1 uv2)
       with interleave_assoc_2[OF 4(6), of r t] obtain tu
         where *:"tu setinterleaves ((t, u), insert tick (ev ` S))" 
          and **:"r setinterleaves ((tu, v), insert tick (ev ` S))" by auto
       from 4 * **  show ?case
         apply(rule_tac disjI2, exI tu, exI v, exI r, exI "[]", intro conjI, simp_all) 
         by (metis "4"(4) F_T Sync.sym append.right_neutral)
     next
       case (5 r Xtuv t uv Xt Xuv v u uv1 uv2)
       from 5(2,7,5,6)  interleave_assoc_2[of uv u _ v r t] obtain tu
         where *:"tu setinterleaves ((t, u), insert tick (ev ` S))" 
          and **:"r setinterleaves ((tu, v), insert tick (ev ` S))" by (metis Sync.sym append_Nil2)
       from 5 * **  show ?case
         apply(rule_tac disjI2, exI v, exI tu, exI r, exI "[]", intro conjI, simp_all)
         using Sync.sym F_T by blast+
     qed
   next
     case (DD)
     then show ?case
       using Sync_assoc_oneside_D[of P S Q T] by (simp add:D_Sync Collect_mono_iff sup.coboundedI2) 
   qed
 qed
 
 lemma Sync_assoc: "((P \<lbrakk>S\<rbrakk> Q) \<lbrakk>S\<rbrakk> T) = (P \<lbrakk>S\<rbrakk> (Q \<lbrakk>S\<rbrakk> T))"
   by (metis antisym_conv Sync_assoc_oneside Sync_commute)
 
 subsection\<open> Derivative Operators laws  \<close>
 
 (* Trivial results have been removed *)
 lemmas Par_BOT = Sync_BOT[where S = \<open>UNIV\<close>]
    and Par_SKIP_SKIP = Sync_SKIP_SKIP[where S = \<open>UNIV\<close>]
    and Par_SKIP_STOP = Sync_SKIP_STOP[where S = \<open>UNIV\<close>]
    and Par_commute = Sync_commute[where S = \<open>UNIV\<close>]
    and Par_assoc = Sync_assoc[where S = \<open>UNIV\<close>]
    and Par_Ndet_right_distrib = Sync_Ndet_right_distrib[where S = \<open>UNIV\<close>]
    and Par_Ndet_left_distrib = Sync_Ndet_left_distrib[where S = \<open>UNIV\<close>]
    and Mprefix_Par_SKIP = Mprefix_Sync_SKIP[where S = \<open>UNIV\<close>]
    and prefix_Par_SKIP = prefix_Sync_SKIP[where S = \<open>UNIV\<close>, simplified]
    and mono_Par_FD = mono_Sync_FD[where S = \<open>UNIV\<close>]
    and mono_Par_ref = mono_Sync_ref[where S = \<open>UNIV\<close>]
    and prefix_Par1 = prefix_Sync1[where S = \<open>UNIV\<close>, simplified]
    and prefix_Par2 = prefix_Sync2[where S = \<open>UNIV\<close>, simplified]
    and Mprefix_Par_distr = Mprefix_Sync_distr_subset[where S = \<open>UNIV\<close>, simplified]
 
    and Inter_BOT = Sync_BOT[where S = \<open>{}\<close>]
    and Inter_SKIP_SKIP = Sync_SKIP_SKIP[where S = \<open>{}\<close>]
    and Inter_SKIP_STOP = Sync_SKIP_STOP[where S = \<open>{}\<close>]
    and Inter_commute = Sync_commute[where S = \<open>{}\<close>]
    and Inter_assoc = Sync_assoc[where S = \<open>{}\<close>]
    and Inter_Ndet_right_distrib = Sync_Ndet_right_distrib[where S = \<open>{}\<close>]
    and Inter_Ndet_left_distrib = Sync_Ndet_left_distrib[where S = \<open>{}\<close>]
    and Mprefix_Inter_SKIP = Mprefix_Sync_SKIP[where S = \<open>{}\<close>, simplified, simplified Mprefix_STOP]
    and prefix_Inter_SKIP = prefix_Sync_SKIP[where S = \<open>{}\<close>, simplified]
    and mono_Inter_FD = mono_Sync_FD[where S = \<open>{}\<close>]
    and mono_Inter_ref = mono_Sync_ref[where S = \<open>{}\<close>]
    and Hiding_Inter = Hiding_Sync[where S = \<open>{}\<close>, simplified]
    and Mprefix_Inter_distr = Mprefix_Sync_distr_indep[where S = \<open>{}\<close>, simplified]
    and prefix_Inter = Mprefix_Sync_distr_indep[of \<open>{a}\<close> \<open>{}\<close> \<open>{b}\<close> \<open>\<lambda>x. P\<close> \<open>\<lambda>x. Q\<close>,
                                                simplified, folded write0_def] for a P b Q
 
 
 
 lemma Inter_SKIP: "(P ||| SKIP) = P"  
 proof(auto simp:Process_eq_spec D_Sync F_Sync F_SKIP D_SKIP T_SKIP, goal_cases)
   case (1 a t X Y)
   then have aa:"(X \<union> Y) \<inter> {tick} \<union> X \<inter> Y \<subseteq> X" by (simp add: Int_Un_distrib2)
   have "front_tickFree t" using "1"(1) is_processT2 by blast
   with 1 EmptyLeftSync[of a "{tick}" t] have bb:"a=t"
     using Sync.sym by blast
   from 1(1) aa bb show ?case using is_processT4 by blast
 next
   case (2 a t X Y)
   have "front_tickFree t" using 2(1) is_processT2 by blast
   with 2 TickLeftSync[of "{tick}" t a] have bb:"a=t \<and> last t=tick"
     using Sync.sym by blast
   with 2 have "a \<in> \<T> P \<and> last a = tick" using F_T by blast
   with tick_T_F[of "butlast a" P "(X \<union> Y) \<inter> {tick} \<union> X \<inter> Y"] show ?case 
     by (metis "2"(2) EmptyLeftSync bb self_append_conv2 snoc_eq_iff_butlast)
 next
   case (3 b t r v)
   with 3 EmptyLeftSync[of r "{tick}" t] have bb:"r=t"
     using Sync.sym by blast
   with 3 show ?case using is_processT by blast
 next
   case (4 b t r v)
   with TickLeftSync[of "{tick}" t r, simplified] have bb:"r=t"
     using D_imp_front_tickFree Sync.sym by blast
   with 4 show ?case using is_processT by blast
 next
   case (5 b t r)
   with EmptyLeftSync[of r "{tick}" t] have bb:"r=t"
     using Sync.sym by blast
   with 5 show ?case using is_processT by blast
 next
   case (6 b t r)
   with TickLeftSync[of "{tick}" t r, simplified] have bb:"r=t"
     using D_imp_front_tickFree Sync.sym by blast
   with 6 show ?case using is_processT by blast
 next
   case (7 a b)
   then show ?case 
     apply(cases "tickFree a")
      apply(rule_tac x=a in exI, rule_tac x="[]" in exI, rule_tac x=b in exI, simp)
      apply(rule_tac x="b - {tick}" in exI, simp, intro conjI)
       using emptyLeftSelf[of a "{tick}"] Sync.sym tickFree_def apply fastforce
      apply blast
     apply(rule_tac x=a in exI, rule_tac x="[tick]" in exI, rule_tac x=b in exI, simp, rule conjI)
     subgoal proof -
       assume a1: "\<not> tickFree a"
       assume a2: "(a, b) \<in> \<F> P"
       then obtain ees :: "'a event list \<Rightarrow> 'a event list" where
         f3: "a = ees a @ [tick]"
         using a1 by (meson is_processT2 nonTickFree_n_frontTickFree)
       then have "ees a setinterleaves (([], ees a), {tick})"
         using a2 by (metis (no_types) DiffD2 Diff_insert_absorb emptyLeftSelf 
                                       front_tickFree_implies_tickFree is_processT2 tickFree_def)
       then show "a setinterleaves ((a, [tick]), {tick})"
         using f3 by (metis (no_types) Sync.sym addSyncEmpty insertI1)
     qed
     apply(rule_tac x="b - {tick}" in exI) by blast
 next
   case (8 t r v)
   with EmptyLeftSync[of r "{tick}" t] have bb:"r=t"
     using Sync.sym by blast
   with 8 show ?case using is_processT by blast
 next
   case (9 t r v)
   with TickLeftSync[of "{tick}" t r, simplified] have bb:"r=t"
     using D_imp_front_tickFree Sync.sym by blast
   with 9 show ?case using is_processT by blast
 next
   case (10 t r)
   with EmptyLeftSync[of r "{tick}" t] have bb:"r=t"
     using Sync.sym by blast
   with 10 show ?case by simp
 next
   case (11 t r)
   with TickLeftSync[of "{tick}" t r, simplified] have bb:"r=t"
     using D_imp_front_tickFree Sync.sym by blast
   with 11 show ?case by simp
 next
   case (12 x)
   then show ?case 
   proof(cases "tickFree x")
     case True
     with 12 show ?thesis 
       apply(rule_tac x=x in exI, rule_tac x="[]" in exI, 
             rule_tac x=x in exI, rule_tac x="[]" in exI, simp)
       by (metis Sync.sym emptyLeftSelf singletonD tickFree_def)
   next
     case False
     with 12 show ?thesis 
       apply(rule_tac x="butlast x" in exI, rule_tac x="[]" in exI, 
             rule_tac x="butlast x" in exI, rule_tac x="[tick]" in exI, simp, intro conjI)
          apply (metis D_imp_front_tickFree append_butlast_last_id front_tickFree_mono 
                       list.distinct(1) tickFree_Nil)  
       using NT_ND T_nonTickFree_imp_decomp apply fastforce 
        apply (metis NT_ND Sync.sym append_T_imp_tickFree append_butlast_last_id emptyLeftSelf 
                     list.distinct(1) singletonD tickFree_Nil tickFree_def)
       using D_imp_front_tickFree is_processT9 nonTickFree_n_frontTickFree by fastforce
   qed
 qed
 
 lemma Inter_STOP_Seq_STOP: "(P ||| STOP) = (P  \<^bold>;  STOP)"
 proof (auto simp add:Process_eq_spec D_Sync F_Sync F_STOP D_STOP T_STOP F_Seq D_Seq, goal_cases)
   case (1 a t X Y)
   have "insert tick ((X \<union> Y) \<inter> {tick} \<union> X \<inter> Y) \<subseteq> X \<union> {tick}" by blast
   with 1 show ?case
     by (metis (mono_tags, lifting) EmptyLeftSync Sync.sym is_processT 
                                    is_processT5_S2 no_Trace_implies_no_Failure)
 next
   case (2 a t X)
   then show ?case using EmptyLeftSync Sync.sym tickFree_def by fastforce
 next
   case (3 b t r v)
-  then show ?case using EmptyLeftSync Sync.sym tickFree_def by blast
+  then show ?case using EmptyLeftSync Sync.sym is_processT7 by blast
 next
   case (4 t r v)
-  then show ?case using EmptyLeftSync Sync.sym by blast
+  then show ?case using EmptyLeftSync Sync.sym is_processT7 by blast
 next
   case (5 b t r)
-  then show ?case by (metis EmptyLeftSync Sync.sym is_processT)
+  then show ?case using EmptyLeftSync Sync.sym is_processT7 by blast
 next
   case (6 t r)
-  then show ?case using EmptyLeftSync Sync.sym tickFree_def by fastforce
+  then show ?case using EmptyLeftSync Sync.sym is_processT7 by blast
 next
   case (7 a b)
   then show ?case 
     apply(rule_tac x=a in exI, rule_tac x="b" in exI, intro conjI)
       apply (meson insert_iff is_processT subsetI)
      using emptyLeftSelf[of a "{tick}"] Sync.sym tickFree_def apply fastforce   
     by blast
 next
   case (8 a b)
   then show ?case 
     apply(rule_tac x=a in exI, rule_tac x="b-{tick}" in exI, intro conjI)
       apply (meson NF_NT is_processT6)
      using emptyLeftSelf[of a "{tick}"] Sync.sym tickFree_def 
      apply (metis append_T_imp_tickFree list.distinct(1) singletonD)
     by blast
 next
-  case (9 b t1 t2)
-  hence "t1 setinterleaves ((t1, []), {tick})"
-    using emptyLeftSelf[of t1 "{tick}"] Sync.sym tickFree_def by fastforce
-  with 9(1)[THEN spec, THEN spec, of t1 t1, simplified] have False
-    using "9"(2) "9"(3) "9"(4) by blast
-  then show ?case ..
+  case (9 t X)
+  then show ?case
+    apply (cases \<open>tickFree t\<close>)
+    by (metis Sync.sym append.right_neutral emptyLeftSelf front_tickFree_Nil singletonD tickFree_def)
+       (metis D_T D_imp_front_tickFree Sync.sym append_single_T_imp_tickFree emptyLeftSelf 
+        front_tickFree_single is_processT9_S_swap nonTickFree_n_frontTickFree singletonD tickFree_def)
 next
   case (10 t r v)
-  then show ?case
-    apply(rule_tac x=r in exI, rule_tac x="v" in exI, auto)
-    using EmptyLeftSync Sync.sym by blast
+  then show ?case using EmptyLeftSync Sync.sym is_processT7 by blast
 next
   case (11 t r)
-  then show ?case
-    apply(rule_tac x=r in exI, rule_tac x="[]" in exI, simp)
-    using EmptyLeftSync Sync.sym tickFree_def by fastforce
+  then show ?case using Sync.sym emptyLeftProperty by blast
 next
-  case (12 t1 t2)
+  case (12 t)
   then show ?case
-    apply(rule_tac x=t1 in exI, rule_tac x=t1 in exI, rule_tac x=t2 in exI, simp)
-    by (metis Sync.sym emptyLeftSelf singletonD tickFree_def)
+    apply (cases \<open>tickFree t\<close>)
+     apply (rule_tac x = t in exI, rule_tac x = t in exI, simp,
+            metis Sync.sym emptyLeftSelf singletonD tickFree_def)
+    by (rule_tac x = \<open>butlast t\<close> in exI, rule_tac x = \<open>butlast t\<close> in exI, 
+        rule_tac x = \<open>[tick]\<close> in exI, simp,
+        metis D_imp_front_tickFree Sync.sym emptyLeftSelf front_tickFree_implies_tickFree tickFree_def
+              is_processT9_S_swap nonTickFree_n_frontTickFree singletonD snoc_eq_iff_butlast)
 qed
 
 
 lemma Par_STOP: "P \<noteq> \<bottom> \<Longrightarrow> (P || STOP) = STOP"  
 proof(auto simp add:Process_eq_spec, 
       simp_all add:D_Sync F_Sync F_STOP D_STOP T_STOP is_processT2 D_imp_front_tickFree F_UU D_UU,
       goal_cases)
   case (1 a b aa ba)
   then show ?case
   proof(elim exE conjE disjE, goal_cases)
     case (1 t X Y)
     then show ?case
       proof(cases t)
         case Nil then show ?thesis using "1"(4) EmptyLeftSync by blast
       next
         case (Cons a list)
         with 1 show ?thesis by (simp split:if_splits, cases a, simp_all)
       qed 
   next
     case (2 t r v)
     hence "[] \<in> \<D> P"
     proof(cases t)
       case Nil with 2 show ?thesis by simp
     next
       case (Cons a list)
       with 2 show ?thesis by (simp split:if_splits, cases a, simp_all)
     qed 
     with 2(1,2) show ?case using NF_ND is_processT7 by fastforce 
   next
     case (3 t r v)
     hence "[] \<in> \<D> P"
     proof(cases t)
       case Nil with 3 show ?thesis by simp
     next
       case (Cons a list)
       with 3 show ?thesis by (simp split:if_splits, cases a, simp_all)
     qed 
     with 3(1,2) show ?case using NF_ND is_processT7 by fastforce 
   qed
 next
   case (2 a b aa ba)
   then show ?case
     apply(rule_tac disjI1, rule_tac x="[]" in exI, rule_tac x="{}" in exI, simp, rule_tac conjI)
     using is_processT apply blast
     apply(rule_tac x=ba in exI, rule_tac set_eqI, rule_tac iffI)
     using event_set apply blast
     by fast
 next
   case (3 a b x)
   then show ?case 
   proof(elim exE conjE disjE, goal_cases)
     case (1 t r v)
     hence "[] \<in> \<D> P"
     proof(cases t)
       case Nil with 1 show ?thesis by simp
     next
       case (Cons a list)
       with 1 show ?thesis by (simp split:if_splits, cases a, simp_all)
     qed 
     with 3(1,2) show ?case using NF_ND is_processT7 by fastforce
   next
     case (2 t r v)
     hence "[] \<in> \<D> P"
     proof(cases t)
       case Nil with 2 show ?thesis by simp
     next
       case (Cons a list)
       with 2 show ?thesis by (simp split:if_splits, cases a, simp_all)
     qed 
     with 3(1,2) show ?case using NF_ND is_processT7 by fastforce
   qed
 next
   case (4 x a b)
   then show ?case
   proof(elim exE conjE disjE, goal_cases)
     case (1 t X Y)
     then show ?case
       proof(cases t)
         case Nil then show ?thesis using "1"(4) EmptyLeftSync by blast
       next
         case (Cons a list)
         with 1 show ?thesis by (simp split:if_splits, cases a, simp_all)
       qed 
   next
     case (2 t r v)
     hence "[] \<in> \<D> P"
     proof(cases t)
       case Nil with 2 show ?thesis by simp
     next
       case (Cons a list)
       with 2 show ?thesis by (simp split:if_splits, cases a, simp_all)
     qed 
     with 2(1,2) show ?case using NF_ND is_processT7 by fastforce 
   next
     case (3 t r v)
     hence "[] \<in> \<D> P"
     proof(cases t)
       case Nil with 3 show ?thesis by simp
     next
       case (Cons a list)
       with 3 show ?thesis by (simp split:if_splits, cases a, simp_all)
     qed 
   with 3(1,2) show ?case using NF_ND is_processT7 by fastforce 
   qed 
 next
   case (5 x a b)
   then show ?case
   apply(rule_tac disjI1, rule_tac x="[]" in exI, rule_tac x="{}" in exI, simp, rule_tac conjI)
   using is_processT apply blast
   apply(rule_tac x=b in exI, rule_tac set_eqI, rule_tac iffI)
   using event_set apply blast
   by fast
 next
   case (6 x xa)
   then show ?case
   proof(elim exE conjE disjE, goal_cases)
     case (1 t r v)
     hence "[] \<in> \<D> P"
     proof(cases t)
       case Nil with 1 show ?thesis by simp
     next
       case (Cons a list)
       with 1 show ?thesis by (simp split:if_splits, cases a, simp_all)
     qed 
     with 6(1,2) show ?case using NF_ND is_processT7 by fastforce
   next
     case (2 t r v)
     hence "[] \<in> \<D> P"
     proof(cases t)
       case Nil with 2 show ?thesis by simp
     next
       case (Cons a list)
       with 2 show ?thesis by (simp split:if_splits, cases a, simp_all)
     qed 
     with 6(1,2) show ?case using NF_ND is_processT7 by fastforce
   qed
 qed
 
 
   
 section\<open>Multiple Non Deterministic Operator Laws\<close>
 
 lemma Mprefix_refines_Mndetprefix: "(\<sqinter> x \<in> A \<rightarrow> P x) \<le> (\<box> x \<in> A \<rightarrow> P x)"
 proof(cases "A = {}")
   case True
   then show ?thesis by (simp add: Mprefix_STOP)
 next
   case False
   then show ?thesis 
     by (auto simp add:le_ref_def D_Mprefix write0_def F_Mprefix F_Mndetprefix D_Mndetprefix)
 qed
 
 lemma Mndetprefix_refine_FD: "a \<in> A \<Longrightarrow> (\<sqinter> x \<in> A \<rightarrow> (P x)) \<le> (a \<rightarrow> (P a))"
   by(subgoal_tac "A \<noteq> {}", auto simp:le_ref_def D_Mndetprefix F_Mndetprefix)
 
 lemma Mndetprefix_subset_FD:"A \<noteq> {} \<Longrightarrow> (\<sqinter>xa\<in> A \<union> B \<rightarrow>  P) \<le> (\<sqinter>xa\<in> A \<rightarrow>  P)"
   by (simp add: D_Mndetprefix F_Mndetprefix le_ref_def)
 
 lemma mono_Mndetprefix_FD[simp]: "\<forall>x \<in> A. P x \<le> P' x \<Longrightarrow> (\<sqinter> x \<in> A \<rightarrow> (P x)) \<le> (\<sqinter> x \<in> A \<rightarrow> (P' x))"
   apply(cases "A \<noteq> {}", auto simp:le_ref_def D_Mndetprefix F_Mndetprefix)
   by(meson contra_subsetD le_ref_def mono_write0_FD)+ 
 
 lemma Mndetprefix_FD_subset : "A \<noteq> {} \<Longrightarrow> A \<subseteq> B \<Longrightarrow> ((\<sqinter> x \<in> B \<rightarrow> P x)  \<le> (\<sqinter> x \<in> A \<rightarrow> P x))"
   by (metis bot.extremum_uniqueI Mndetprefix_Un_distrib mono_Ndet_FD_right order_refl sup.absorb_iff1)
 
 section \<open> Infra-structure for Communication Primitives \<close>
 
 lemma read_read_Sync:
   assumes contained: "(\<And>y. c y \<in> S)"
     shows "((c\<^bold>?x \<rightarrow> P x) \<lbrakk>S\<rbrakk> (c\<^bold>?x \<rightarrow> Q x)) = (c\<^bold>?x \<rightarrow> ((P x) \<lbrakk>S\<rbrakk> (Q x)))"
 proof -
   have A: "range c \<subseteq> S" by (insert contained, auto)
   show ?thesis by (auto simp: read_def o_def Set.Int_absorb2 Mprefix_Sync_distr_subset A)
 qed
 
 lemma read_read_non_Sync:
   "\<lbrakk>\<And>y. c y \<notin> S; \<And>y. d y \<in> S\<rbrakk> \<Longrightarrow> (c\<^bold>?x \<rightarrow> (P x)) \<lbrakk>S\<rbrakk> (d\<^bold>?x \<rightarrow>(Q x)) = c\<^bold>?x \<rightarrow> ((P x) \<lbrakk>S\<rbrakk> (d\<^bold>?x \<rightarrow>(Q x)))"
   apply (auto simp add: read_def o_def)
   using Mprefix_Sync_distr_right[of "range c" S "range d" "\<lambda>x. Q (inv d x)" "\<lambda>x. P (inv c x)"]
   apply (subst (1 2) Sync_commute)
   by auto
 
 lemma write_read_Sync:
   assumes contained: "\<And>y. c y \<in> S"
       and is_construct: "inj c"
     shows "(c\<^bold>!a \<rightarrow> P) \<lbrakk>S\<rbrakk> (c\<^bold>?x \<rightarrow> Q x) = (c\<^bold>!a \<rightarrow> (P \<lbrakk>S\<rbrakk> Q a))"
 proof -
   have A : "range c \<subseteq> S" by (insert contained, auto)
   have B : " {c a} \<inter> range c \<inter> S = {c a}" by (insert contained, auto)
   show ?thesis
     apply (simp add: read_def write_def o_def, subst Mprefix_Sync_distr_subset)
     by (simp_all add: A B contained Mprefix_singl is_construct)
 qed
 
 lemma write_read_non_Sync:
   "\<lbrakk>d a \<notin> S; \<And>y. c y \<in> S \<rbrakk> \<Longrightarrow> (d\<^bold>!a \<rightarrow> P) \<lbrakk>S\<rbrakk> (c\<^bold>?x \<rightarrow> Q x) = d\<^bold>!a \<rightarrow> (P \<lbrakk>S\<rbrakk> (c\<^bold>?x \<rightarrow> Q x))"
   apply (simp add: read_def o_def write_def)
   using Mprefix_Sync_distr_right[of "{d a}" S "range c" "\<lambda>x. (Q (inv c x))" "\<lambda>x. P"]
   apply (subst (1 2) Sync_commute)
   by auto
  
 lemma write0_read_non_Sync:
   "\<lbrakk>d \<in> S; \<And>y. c y \<notin> S\<rbrakk> \<Longrightarrow> (d \<rightarrow> P) \<lbrakk>S\<rbrakk> (c\<^bold>?x \<rightarrow> Q x) = c\<^bold>?x \<rightarrow> ((d \<rightarrow> P) \<lbrakk>S\<rbrakk> Q x)"
   apply (simp add: read_def o_def)
   apply (subst (1 2)  Mprefix_singl[symmetric])
   apply (subst Mprefix_Sync_distr_right)
   by auto
   
 lemma write0_write_non_Sync:
  "\<lbrakk>d a \<notin> C; c \<in> C\<rbrakk> \<Longrightarrow> (c \<rightarrow> Q) \<lbrakk>C\<rbrakk> (d\<^bold>!a \<rightarrow> P) = d\<^bold>!a \<rightarrow> ((c \<rightarrow> Q) \<lbrakk>C\<rbrakk> P)"
   apply(simp add: write_def )
   apply(subst (1 2) Mprefix_singl[symmetric])
   by (auto simp: Mprefix_Sync_distr_right)
 
 
+
+
+section \<open>Renaming operator laws\<close>
+
+lemma Renaming_BOT: \<open>Renaming \<bottom> f = \<bottom>\<close>
+  by (fastforce simp add: F_UU D_UU F_Renaming D_Renaming EvExt_tF EvExt_ftF
+                          Process_eq_spec front_tickFree_append intro: tickFree_Nil)+
   
 
+lemma Renaming_STOP: \<open>Renaming STOP f = STOP\<close>
+  by (subst Process_eq_spec) (simp add: EvExt_ftF F_STOP D_STOP F_Renaming D_Renaming)
+
+
+lemma Renaming_SKIP: \<open>Renaming SKIP f = SKIP\<close>
+  by (subst Process_eq_spec) (force simp add: EvExt_def F_SKIP D_SKIP F_Renaming D_Renaming)
+
+
+
+lemma Renaming_Ndet: \<open>Renaming (P \<sqinter> Q) f = Renaming P f \<sqinter> Renaming Q f\<close>
+  by (subst Process_eq_spec) (auto simp add: F_Renaming D_Renaming F_Ndet D_Ndet)
+
+
+lemma Renaming_Det:  \<open>Renaming (P \<box> Q) f = Renaming P f \<box> Renaming Q f\<close>
+proof (subst Process_eq_spec, intro iffI conjI subset_antisym)
+  show \<open>\<F> (Renaming (P \<box> Q) f) \<subseteq> \<F> (Renaming P f \<box> Renaming Q f)\<close>
+    apply (simp add: F_Renaming D_Renaming T_Renaming F_Det D_Det, safe,
+           simp_all add: is_processT6_S2)
+    by blast+ (metis EvExt_eq_tick, meson map_EvExt_tick)+
+next 
+  show \<open>\<F> (Renaming P f \<box> Renaming Q f) \<subseteq> \<F> (Renaming (P \<box> Q) f)\<close>
+    apply (simp add: F_Renaming D_Renaming T_Renaming F_Det D_Det, safe, simp_all)
+    by blast+ (metis EvExt_eq_tick, metis Cons_eq_append_conv EvExt_tF 
+                     list.map_disc_iff tickFree_Cons)+
+next
+  show \<open>\<D> (Renaming (P \<box> Q) f) \<subseteq> \<D> (Renaming P f \<box> Renaming Q f)\<close>
+    by (auto simp add: D_Renaming D_Det)
+next
+  show \<open>\<D> (Renaming P f \<box> Renaming Q f) \<subseteq> \<D> (Renaming (P \<box> Q) f)\<close>
+    by (auto simp add: D_Renaming D_Det)
+qed
+
+
+
+
+(* lemma THE_inj_trivial: \<open>inj f \<Longrightarrow> (THE x. f x = f a) = a\<close> by (simp add: inj_eq)
+
+lemma THE_inj_on_trivial: \<open>inj_on f A \<Longrightarrow> a \<in> A \<Longrightarrow> (THE x. x  \<in> A \<and> f x = f a) = a\<close> 
+  by (simp add: inj_onD the_equality)
+ *)
+
+(* TODO: Move this in Mprefix and Mndetprefix theories *)
+
+lemma mono_Mprefix_eq: \<open>\<forall>a \<in> A. P a = Q a \<Longrightarrow> Mprefix A P = Mprefix A Q\<close>
+  by (subst Process_eq_spec, auto simp add: F_Mprefix D_Mprefix)
+
+lemma mono_Mndetprefix_eq: \<open>\<forall>a \<in> A. P a = Q a \<Longrightarrow> Mndetprefix A P = Mndetprefix A Q\<close>
+  by (cases \<open>A = {}\<close>, simp) (subst Process_eq_spec, auto simp add: F_Mndetprefix D_Mndetprefix)
+
+
+
+
+lemma Renaming_Mprefix: \<open>Renaming (\<box> a \<in> A \<rightarrow> P (f a)) f = \<box> b \<in> f ` A \<rightarrow> Renaming (P b) f\<close>
+proof (subst Process_eq_spec, intro conjI subset_antisym)
+  show \<open>\<F> (Renaming (\<box> a \<in> A \<rightarrow> P (f a)) f) \<subseteq> \<F> (\<box> b \<in> f ` A \<rightarrow> Renaming (P b) f)\<close>
+    apply (simp add: F_Renaming F_Mprefix D_Mprefix, safe; 
+           auto simp add: hd_map_EvExt map_tl tickFree_tl)
+    by ((meson disjoint_iff ev_elem_anteced1 image_eqI)+)[3]
+next
+  show \<open>\<F> (\<box> b \<in> f ` A \<rightarrow> Renaming (P b) f) \<subseteq> \<F> (Renaming (\<box> a \<in> A \<rightarrow> P (f a)) f)\<close>
+    apply (simp add: F_Renaming F_Mprefix D_Mprefix, safe, simp_all)
+      apply (auto simp add: vimage_def image_def, insert hd_map_EvExt, fastforce)[1]
+     apply (rule_tac x = \<open>ev xa # s1\<close> in exI, simp,
+            metis hd_map hd_map_EvExt list.collapse list.discI list.sel(1))
+  proof goal_cases
+    case (1 a b xa aa s1 s2)
+    have \<open>s1 \<notin> \<D> (P (f xa))\<close>
+      apply (rule "1"(1)[rule_format, of \<open>ev xa # s1\<close> s2, simplified])
+      by (simp_all add: "1"(4, 6, 7)) 
+         (metis "1"(2, 3, 8) hd_map_EvExt list.collapse list.distinct(1) list.sel(1) list.simps(9))
+    with \<open>s1 \<in> \<D> (P (f xa))\<close> show ?case by blast
+  qed
+next
+  show \<open>\<D> (Renaming (\<box> a \<in> A \<rightarrow> P (f a)) f) \<subseteq> \<D> (\<box> b \<in> f ` A \<rightarrow> Renaming (P b) f)\<close>
+    apply (auto simp add: D_Mprefix D_Renaming hd_map_EvExt)
+    by (rule_tac x = \<open>tl s1\<close> in exI, simp add: map_tl tickFree_tl)
+next
+  show \<open>\<D> (\<box> b \<in> f ` A \<rightarrow> Renaming (P b) f) \<subseteq> \<D> (Renaming (\<box> a \<in> A \<rightarrow> P (f a)) f)\<close>
+    apply (auto simp add: D_Mprefix D_Renaming)
+    by (rule_tac x = \<open>ev xb # s1\<close> in exI, simp, rule_tac x = s2 in exI, simp)
+       (metis EvExt_def event.case(1) list.collapse o_apply)
+qed
+
+
+
+lemma Renaming_Mprefix_inj_on:
+  \<open>Renaming (Mprefix A P) f = \<box> b \<in> f ` A \<rightarrow> Renaming (P (THE a. a \<in> A \<and> f a = b)) f\<close> 
+  if inj_on_f: \<open>inj_on f A\<close>
+  apply (subst Renaming_Mprefix[symmetric])
+  apply (intro arg_cong[where f = \<open>\<lambda>Q. Renaming Q f\<close>] mono_Mprefix_eq)
+  by (metis that the_inv_into_def the_inv_into_f_f)
+
+
+corollary Renaming_Mprefix_inj:
+  \<open>Renaming (Mprefix A P) f = \<box> b \<in> f ` A \<rightarrow> Renaming (P (THE a. f a = b)) f\<close> if inj_f: \<open>inj f\<close>
+  apply (subst Renaming_Mprefix_inj_on, metis inj_eq inj_onI that)
+  apply (rule mono_Mprefix_eq[rule_format])
+  by (metis imageE inj_eq[OF inj_f])
+
+
+
+text \<open>A smart application (as \<^term>\<open>f\<close> is of course injective on the singleton \<^term>\<open>{a}\<close>)\<close>
+
+corollary Renaming_prefix: \<open>Renaming (a \<rightarrow> P) f = (f a \<rightarrow> Renaming P f)\<close>
+  unfolding write0_def by (simp add: Renaming_Mprefix_inj_on)
+
+(* TODO: write corollaries on read and write *)
+
+
+
+lemma Renaming_Mndetprefix: \<open>Renaming (\<sqinter> a \<in> A \<rightarrow> P (f a)) f = \<sqinter> b \<in> f ` A \<rightarrow> Renaming (P b) f\<close>
+  apply (cases \<open>A = {}\<close>, simp add: Renaming_STOP)
+  by (subst Process_eq_spec)
+     (auto simp add: F_Renaming F_Mndetprefix D_Renaming D_Mndetprefix Renaming_prefix[symmetric])
+
+
+corollary Renaming_Mndetprefix_inj_on:
+  \<open>Renaming (Mndetprefix A P) f = \<sqinter> b \<in> f ` A \<rightarrow> Renaming (P (THE a. a \<in> A \<and> f a = b)) f\<close> 
+  if inj_on_f: \<open>inj_on f A\<close>
+  apply (subst Renaming_Mndetprefix[symmetric])
+  apply (intro arg_cong[where f = \<open>\<lambda>Q. Renaming Q f\<close>] mono_Mndetprefix_eq)
+  by (metis that the_inv_into_def the_inv_into_f_f)
+  
+
+
+corollary Renaming_Mndetprefix_inj:
+  \<open>Renaming (Mndetprefix A P) f = \<sqinter> b \<in> f ` A \<rightarrow>  Renaming (P (THE a. f a = b)) f\<close> 
+  if inj_f: \<open>inj f\<close>
+  apply (subst Renaming_Mndetprefix_inj_on, metis inj_eq inj_onI that)
+  apply (rule mono_Mndetprefix_eq[rule_format])
+  by (metis imageE inj_eq[OF inj_f])
+
+
+
+
+
+
+lemma Renaming_Seq: \<open>Renaming (P \<^bold>; Q) f = Renaming P f \<^bold>; Renaming Q f\<close>
+proof (subst Process_eq_spec, intro conjI impI subset_antisym)
+  show \<open>\<F> (Renaming (P \<^bold>; Q) f) \<subseteq> \<F> (Renaming P f \<^bold>; Renaming Q f)\<close>
+    apply (simp add: F_Seq D_Seq F_Renaming D_Renaming T_Renaming, safe;
+           auto simp add: EvExt_tF append_single_T_imp_tickFree)
+          apply (rule_tac x = s1 in exI)
+          apply (metis Diff_insert_absorb Diff_single_insert anteced_EvExt_diff_tick
+                       insert_absorb insert_absorb2 is_processT4 subset_insertI)
+         apply (rule_tac x = \<open>t1 @ t2\<close> in exI, metis map_EvExt_tick map_append)
+        apply (metis map_EvExt_tick map_append)
+       apply (metis NF_ND)
+      apply (metis EvExt_ftF front_tickFree_mono map_append nonTickFree_n_frontTickFree
+                   non_tickFree_tick process_charn tickFree_Nil)
+     apply (rule_tac x = \<open>t1 @ t2\<close> in exI)
+    by (metis map_EvExt_tick map_append)+
+next
+  show \<open>\<F> (Renaming P f \<^bold>; Renaming Q f) \<subseteq> \<F> (Renaming (P \<^bold>; Q) f)\<close>
+  proof ((simp add: F_Seq D_Seq F_Renaming D_Renaming T_Renaming subset_iff, safe; auto), 
+         goal_cases)
+    case (1 Y s1)
+    then show ?case
+      apply (rule_tac x = \<open>s1\<close> in exI, safe; simp add: EvExt_tF)
+      by (metis (no_types, lifting) Diff_insert_absorb anteced_EvExt_diff_tick insert_Diff 
+                                    insert_absorb insert_iff tick_elem_anteced1)
+  next
+    case (2 Y t1 t1a s1)
+    then show ?case 
+      apply (rule_tac x = \<open>butlast t1a @ s1\<close> in exI)
+      by (metis (no_types, opaque_lifting) EvExt_tF T_nonTickFree_imp_decomp butlast_snoc 
+                                           map_append map_butlast non_tickFree_tick tickFree_append)
+  next
+    case (3 Y t1 t1a s1 s2)
+    have \<open>butlast t1a @ s1 \<notin> \<D> P \<and> 
+          (\<forall>t1. t1 @ [tick] \<in> \<T> P \<longrightarrow> (\<forall>t2. butlast t1a @ s1 = t1 @ t2 \<longrightarrow> t2 \<notin> \<D> Q))\<close>
+      apply (rule "3"(1)[rule_format, of \<open>butlast t1a @ s1\<close>, rotated 2, OF "3"(5)])
+      using "3"(2) "3"(4) front_tickFree_butlast is_processT2_TR tickFree_append apply blast
+      by (metis "3"(3) append.assoc butlast_snoc map_append map_butlast)
+    then show ?case 
+      by (metis "3"(2, 3, 6) EvExt_tF T_nonTickFree_imp_decomp snoc_eq_iff_butlast tickFree_butlast)
+  next
+    case (4 Y t1 t1a t2a s1)
+    have \<open>(if t2a = [] then butlast t1a else t1a) \<notin> \<D> P \<and> 
+          (\<forall>t1. t1 @ [tick] \<in> \<T> P \<longrightarrow> 
+                (\<forall>t2. (if t2a = [] then butlast t1a else t1a) = t1 @ t2 \<longrightarrow> t2 \<notin> \<D> Q))\<close>
+      apply (rule "4"(1)[rule_format, of _ \<open>butlast t2a @ map (EvExt f) s1\<close>])
+      using "4"(2) front_tickFree_butlast tickFree_implies_front_tickFree apply fastforce
+       apply (auto, metis "4"(4) append.right_neutral butlast_snoc map_butlast, 
+                    metis "4"(4) butlast_append butlast_snoc)
+      by (metis "4"(3, 6) EvExt_ftF front_tickFree_append front_tickFree_butlast is_processT2)
+    then show ?case
+      by (metis "4"(2, 4, 5) EvExt_tF append.right_neutral tickFree_Cons tickFree_append)
+  next
+    case (5 Y t1 t1a t2a s1 s2)
+    have \<open>(if t2a = [] then butlast t1a else t1a) \<notin> \<D> P \<and> 
+          (\<forall>t1. t1 @ [tick] \<in> \<T> P \<longrightarrow> 
+                (\<forall>t2. (if t2a = [] then butlast t1a else t1a) = t1 @ t2 \<longrightarrow> t2 \<notin> \<D> Q))\<close>
+      apply (rule "5"(1)[rule_format, of _ \<open>butlast t2a @ map (EvExt f) s1 @ s2\<close>])
+      using "5"(2) tickFree_butlast apply fastforce
+       apply (auto, metis "5"(4) append.right_neutral butlast_snoc map_butlast, 
+                    metis "5"(4) butlast_append butlast_snoc)
+      by (metis "5"(3, 6, 7) EvExt_tF front_tickFree_append front_tickFree_butlast)
+    then show ?case
+      by (metis "5"(2, 4, 5) EvExt_tF append_Nil2 non_tickFree_tick tickFree_append)
+  qed
+next
+  show \<open>\<D> (Renaming (P \<^bold>; Q) f) \<subseteq> \<D> (Renaming P f \<^bold>; Renaming Q f)\<close>
+    apply (auto simp add: D_Seq D_Renaming T_Renaming)
+    by (metis map_EvExt_tick map_append)
+next
+  show \<open>\<D> (Renaming P f \<^bold>; Renaming Q f) \<subseteq> \<D> (Renaming (P \<^bold>; Q) f)\<close>
+    apply (auto simp add: D_Seq D_Renaming T_Renaming)
+     apply (rule_tac x = \<open>butlast t1a @ s1\<close> in exI, auto,
+            metis append_butlast_last_id append_single_T_imp_tickFree butlast.simps(1) tickFree_Nil)
+     apply (rule_tac x = s2 in exI, auto, metis butlast_snoc map_butlast,
+            metis EvExt_tF T_nonTickFree_imp_decomp snoc_eq_iff_butlast tickFree_butlast)
+    apply (rule_tac x = \<open>t1a\<close> in exI, simp)
+    apply (rule_tac x = \<open>butlast t2a @ map (EvExt f) s1 @ s2\<close> in exI, auto)
+     apply (meson EvExt_tF front_tickFree_append front_tickFree_butlast)
+    by (metis EvExt_tF butlast_append butlast_snoc non_tickFree_tick tickFree_append)
+qed
+
+
+(* TODO: Renaming of Hiding and Renaming of Sync *)
+
+
+
+
+
+
+
+  
+
+
+
 
 (* ************************************************************************* *)
 (* 	                                                    								     *)
 (* Setup for rewriting							                                         *)
 (* 									                                                         *)
 (* ************************************************************************* *)
 
 lemmas Sync_rules =  prefix_Sync2 
                      read_read_Sync read_read_non_Sync 
                      write_read_Sync write_read_non_Sync 
                      write0_read_non_Sync 
                      write0_write_non_Sync
 
 lemmas Hiding_rules = no_Hiding_read no_Hiding_write Hiding_write Hiding_write0
 
 lemmas mono_rules = mono_read_ref mono_write_ref mono_write0_ref
 
 end
 
diff --git a/thys/HOL-CSP/Conclusion.thy b/thys/HOL-CSP/Conclusion.thy
--- a/thys/HOL-CSP/Conclusion.thy
+++ b/thys/HOL-CSP/Conclusion.thy
@@ -1,114 +1,117 @@
 (*<*)
 \<comment>\<open> ******************************************************************** 
  * Project         : HOL-CSP - A Shallow Embedding of CSP in  Isabelle/HOL
  * Version         : 2.0
  *
  * Author          : Burkhart Wolff, Safouan Taha.
  *
  * This file       : A Combined CSP Theory
  *
  * Copyright (c) 2009 Université Paris-Sud, France
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials provided
  *       with the distribution.
  *
  *     * Neither the name of the copyright holders nor the names of its
  *       contributors may be used to endorse or promote products derived
  *       from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  ******************************************************************************\<close>
 (*>*)
 
 chapter\<open>Conclusion\<close>
 (*<*)
 theory Conclusion
   imports Assertions 
 begin
 (*>*)
 
 section\<open>Related Work\<close>
 text\<open>As mentioned earlier, this work has its very ancient roots in a first formalization 
 of A. Camilieri in the early 90s in HOL. This work was reformulated and substantially
 extended in HOL-CSP 1.0 published in 1997. In 2005, Roggenbach and Isobe published 
 CSP-Prover, a formal theory of a (fragment of) the Failures model of CSP. This work 
 led to a couple of publications culminating in @{cite "IsobeRoggenbach2010"}; emphasis was put
 on actually completing the CSP theory up to the point where it is sufficiently tactically
 supported to serve as a kind of tool. This theory is still maintained and last releases (the 
 latest one was released on 18 February 2019) can be
 found under \<^url>\<open>https://staff.aist.go.jp/y-isobe/CSP-Prover/CSP-Prover.html\<close>. This theory
 represents the first half of Roscoes theory of a Failures/Divergence model, i.e. the Failures part.
 More recently, Pasquale Noce 
 @{cite "Noninterference_CSP-AFP" and "Noninterference_Sequential_Composition-AFP" and 
 "Noninterference_Concurrent_Composition-AFP"}
 developed a theory of non-interference notions based on an abstract denotational model fragment of 
 the Failure/Divergence Model of CSP (without continuity and algebraic laws); this theory could 
 probably be rebuilt on top of our work.
 
 The present work could be another, more "classic" foundation of test-generation techniques
 of this kind paving the way to an interaction with FDR and its possibility to generate
 labelled transition systems as output that could drive specialized tactics in HOL-CSP 2.0.
 \<close>
 
 section\<open>Lessons learned\<close>
 text\<open>We have ported a first formalization in Isabelle/HOL on the Failure/Divergence model of CSP, 
 done with Isabelle93-7 in 1997, to a modern Isabelle version. Particularly, 
 we use the modern declarative proof style available in Isabelle/Isar instead of imperative proof 
 one, the latter being  used in the old version. On the one hand, it is worth noting that some of 
 the old  theories still have a surprisingly high value: Actually it took time to develop the right 
 granularity of abstraction in lemmas, which is thus still quite helpful and valuable to reconstruct 
 the theory in the new version. If a substantially large body of lemmas is available, the degree of 
 automation tends to increase. On the other hand, redevelopment from scratch is unavoidable in parts 
 where basic libraries change. For example, this was a necessary consequence of our decision to base
 HOL-CSP 2.0 on HOLCF instead of continuing the development of an older fixed-point theory; nearly
 all continuity proofs had to be redeveloped. Moreover, a fresh look on old proof-obligations 
 may incite unexpected generalizations and some newly proved lemmas that cannot be constructed in 
 the old version even with several attempts. The influence of the chosen strategy (from scratch
 or refactoring) on the proof length is inconclusive.
 
 Note that our data does not allow to make a prediction on the length of a porting project --- 
 the effort was distributed over a too long period and performed by a team with initially very 
 different knowledge about CSP and interactive theorem proving.
 \<close>
 
 
 section\<open>A Summary on New Results\<close>
 text\<open>Compared to the original version of HOL-CSP 1.0, the present theory is complete relative to
 Roscoe's Book@{cite "roscoe:csp:1998" }. It contains a number of new theorems and some interesting
 (and unexpected) generalizations: 
 \<^enum> @{thm mono_Hiding} is now also valid for the infinite case (arbitrary hide-set A).
 \<^enum> @{term \<open>P \ (A \<union> B) = (P \ A) \ B\<close>} is true for @{term "finite A"} (see @{thm Hiding_Un});
   this was not even proven in HOL-CSP 1.0 for the singleton case! It can be considered as the
   most complex theorem of this theory.
-\<^enum> distribution laws of hiding over synchronisation @{thm Hiding_Sync}; 
+\<^enum> distribution laws of \<^const>\<open>Hiding\<close> over \<^const>\<open>Sync\<close> @{thm Hiding_Sync}; 
   however, this works only in the finite case. A true monster proof.
+\<^enum> distribution of \<^const>\<open>Mprefix\<close> over \<^const>\<open>Sync\<close> @{thm Mprefix_Sync_distr} in the most
+  generalized case. Also a true monster proof, but reworked using symmetries and
+  abstractions to be more reasonable (and faster) 
 \<^enum> the synchronization operator is associative @{thm "Sync_assoc"}.
   (In HOL-CSP 1.0, this had only be shown for special cases like @{thm "Par_assoc"}).
 \<^enum> the generalized non-deterministic choice operator --- relevant for proofs of deadlock-freeness ---
   has been added to the theory @{thm "Mndetprefix_def"}; it is proven monotone in the general case and
   continuous for the special case @{thm Mndetprefix_cont} relevant for the definition of the
   deadlock reference processes @{thm DF_def} and @{thm "DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P_def"}.\<close>
 
   
 end
diff --git a/thys/HOL-CSP/CopyBuffer.thy b/thys/HOL-CSP/CopyBuffer.thy
--- a/thys/HOL-CSP/CopyBuffer.thy
+++ b/thys/HOL-CSP/CopyBuffer.thy
@@ -1,268 +1,269 @@
 (*<*)
 \<comment>\<open> ********************************************************************
  * Project         : HOL-CSP - A Shallow Embedding of CSP in  Isabelle/HOL
  * Version         : 2.0
  *
  * Author          : Burkhart Wolff, Safouan Taha, Lina Ye.
  *                   (Based on HOL-CSP 1.0 by Haykal Tej and Burkhart Wolff)
  *
  * This file       : A Combined CSP Theory
  *
  * Copyright (c) 2009 Université Paris-Sud, France
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials provided
  *       with the distribution.
  *
  *     * Neither the name of the copyright holders nor the names of its
  *       contributors may be used to endorse or promote products derived
  *       from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  ******************************************************************************\<close>
 (*>*)
 
 chapter\<open> Annex: Refinement Example with Buffer over infinite Alphabet\<close>
 
-theory     CopyBuffer
- imports    "Assertions"
+theory     CopyBuffer 
+ imports   CSP "Assertions"
 begin 
 
 section\<open> Defining the Copy-Buffer Example \<close>
 
+
 datatype 'a channel = left 'a | right 'a | mid 'a | ack
 
 definition SYN  :: "('a channel) set"
 where     "SYN  \<equiv> (range mid) \<union> {ack}"
 
 definition COPY :: "('a channel) process"
 where     "COPY \<equiv> (\<mu> COPY. left\<^bold>?x \<rightarrow> (right\<^bold>!x \<rightarrow> COPY))"
 
 definition SEND :: "('a channel) process"
 where     "SEND \<equiv> (\<mu> SEND. left\<^bold>?x \<rightarrow> (mid\<^bold>!x \<rightarrow>( ack \<rightarrow> SEND)))"
 
 definition REC  :: "('a channel) process"
 where     "REC  \<equiv> (\<mu> REC. mid\<^bold>?x \<rightarrow> (right\<^bold>!x \<rightarrow> (ack \<rightarrow> REC)))"
 
 
 definition SYSTEM :: "('a channel) process"
 where     \<open>SYSTEM \<equiv> (SEND \<lbrakk> SYN \<rbrakk> REC) \ SYN\<close>
 
 thm SYSTEM_def
 
 section\<open> The Standard Proof \<close>
 
 subsection\<open> Channels and Synchronization Sets\<close>
 
 text\<open> First part: abstract properties for these events to SYN.
        This kind of stuff could be automated easily by some
        extra-syntax for channels and SYN-sets. \<close>
 
 lemma [simp]: "left x  \<notin>  SYN"
     by(auto simp: SYN_def)
   
 lemma [simp]: "right x  \<notin>  SYN"
     by(auto simp: SYN_def)
 
 lemma [simp]: "ack \<in> SYN"
     by(auto simp: SYN_def)
 
 lemma [simp]: "mid x \<in> SYN"
     by(auto simp: SYN_def)
 
 lemma [simp]: "inj mid"  
   by(auto simp: inj_on_def)
 
 lemma "finite (SYN:: 'a channel set) \<Longrightarrow> finite {(t::'a). True}"
   by (metis (no_types) SYN_def UNIV_def channel.inject(3) finite_Un finite_imageD inj_on_def)
 
 subsection\<open> Definitions by Recursors \<close>
 
 text\<open> Second part: Derive recursive process equations, which
        are easier to handle in proofs. This part IS actually
        automated if we could reuse the fixrec-syntax below. \<close>
 
 lemma COPY_rec:
   "COPY = left\<^bold>?x \<rightarrow> right\<^bold>!x \<rightarrow> COPY"
   by(simp add: COPY_def,rule trans, rule fix_eq, simp)
   
 lemma SEND_rec: 
   "SEND = left\<^bold>?x \<rightarrow> mid\<^bold>!x \<rightarrow> (ack \<rightarrow> SEND)"
   by(simp add: SEND_def,rule trans, rule fix_eq, simp)
 
 lemma REC_rec:
   "REC = mid\<^bold>?x \<rightarrow> right\<^bold>!x \<rightarrow> (ack \<rightarrow> REC)"
   by(simp add: REC_def,rule trans, rule fix_eq, simp)
 
 
 subsection\<open> A Refinement Proof \<close>
 
 text\<open> Third part: No comes the proof by fixpoint induction. 
        Not too bad in automation considering what is inferred,
        but wouldn't scale for large examples. \<close>
 
 lemma impl_refines_spec : "COPY \<sqsubseteq>\<^sub>F\<^sub>D SYSTEM"
   apply(simp add: SYSTEM_def COPY_def)
   apply(rule fix_ind, simp_all)
   apply (intro le_FD_adm, simp_all add: cont_fun monofunI)
   apply (subst SEND_rec, subst REC_rec)
   by (simp add: Sync_rules Hiding_rules)
   
 
 lemma spec_refines_impl : 
   assumes fin: "finite (SYN:: 'a channel set)"
   shows        "SYSTEM \<sqsubseteq>\<^sub>F\<^sub>D (COPY :: 'a channel process)"
   apply(simp add: SYSTEM_def SEND_def)
   apply(rule fix_ind, simp_all)
   apply (intro le_FD_adm)
   apply (simp add: fin)
   apply (simp add: cont2mono)
   apply (simp add: Hiding_set_BOT Sync_BOT Sync_commute)
   apply (subst COPY_rec, subst REC_rec)
   by (simp add: Sync_rules Hiding_rules)
 
 text\<open> Note that this was actually proven for the
        Process ordering, not the refinement ordering. 
        But the former implies the latter.
        And due to anti-symmetry, equality follows
        for the case of finite alphabets \ldots \<close>
 
 lemma spec_equal_impl : 
 assumes fin:  "finite (SYN::('a channel)set)"
 shows         "SYSTEM = (COPY::'a channel process)"
   by (simp add: FD_antisym fin impl_refines_spec spec_refines_impl)
 
 subsection\<open>Deadlock Freeness Proof \<close>
 
 text\<open>HOL-CSP can be used to prove deadlock-freeness of processes with infinite alphabet. In the
 case of the @{term COPY} - process, this can be formulated as the following refinement problem:\<close>
 
-lemma "(DF (range left \<union> range right)) \<sqsubseteq>\<^sub>F\<^sub>D COPY"
+lemma DF_COPY : "(DF (range left \<union> range right)) \<sqsubseteq>\<^sub>F\<^sub>D COPY"
   apply(simp add:DF_def,rule fix_ind2)
 proof -
   show "adm (\<lambda>a. a \<sqsubseteq>\<^sub>F\<^sub>D COPY)"   by(rule le_FD_adm, simp_all add: monofunI)
 next
   show "\<bottom> \<sqsubseteq>\<^sub>F\<^sub>D COPY" by fastforce
 next
   have 1: "(\<sqinter>xa\<in> range left \<union> range right \<rightarrow> \<bottom>) \<sqsubseteq>\<^sub>F\<^sub>D (\<sqinter>xa\<in> range left \<rightarrow>  \<bottom>)"
     by (rule mono_Mndetprefix_FD_set, simp, blast) 
   have 2: "(\<sqinter>xa\<in> range left \<rightarrow>  \<bottom>)  \<sqsubseteq>\<^sub>F\<^sub>D (left\<^bold>?x \<rightarrow>  \<bottom>)" 
     unfolding read_def
     by (meson Mprefix_refines_Mndetprefix_FD BOT_leFD mono_Mndetprefix_FD trans_FD)
   show "(\<Lambda> x. \<sqinter>xa\<in>range left \<union> range right \<rightarrow>  x)\<cdot>\<bottom> \<sqsubseteq>\<^sub>F\<^sub>D COPY" 
     by simp (metis (mono_tags, lifting) 1 2 COPY_rec mono_read_FD BOT_leFD trans_FD)
 next
   fix P::"'a channel process"
   assume  *: "P \<sqsubseteq>\<^sub>F\<^sub>D COPY" and ** : "(\<Lambda> x. \<sqinter>xa\<in>range left \<union> range right \<rightarrow>  x)\<cdot>P \<sqsubseteq>\<^sub>F\<^sub>D COPY"
   have 1:"(\<sqinter>xa\<in> range left \<union> range right \<rightarrow>  P) \<sqsubseteq>\<^sub>F\<^sub>D (\<sqinter>xa\<in> range right \<rightarrow>  P)"
     by (rule mono_Mndetprefix_FD_set, simp, blast)
   have 2:"(\<sqinter>xa\<in> range right \<rightarrow>  P) \<sqsubseteq>\<^sub>F\<^sub>D (right\<^bold>!x \<rightarrow>  P)" for x
     apply (unfold write_def, rule trans_FD[OF mono_Mndetprefix_FD_set[of \<open>{right x}\<close> \<open>range right\<close>]])
     by simp_all
   from 1 2 have ab:"(\<sqinter>xa\<in> range left \<union> range right \<rightarrow>  P) \<sqsubseteq>\<^sub>F\<^sub>D (right\<^bold>!x \<rightarrow>  P)" for x
     using trans_FD by blast
   hence 3:"(left\<^bold>?x \<rightarrow> (\<sqinter>xa\<in> range left \<union> range right \<rightarrow>  P)) \<sqsubseteq>\<^sub>F\<^sub>D (left\<^bold>?x \<rightarrow>(right\<^bold>!x \<rightarrow>  P))" by simp
   have 4:"\<And>X. (\<sqinter>xa\<in> range left \<union> range right \<rightarrow> X) \<sqsubseteq>\<^sub>F\<^sub>D (\<sqinter>xa\<in> range left \<rightarrow> X)"
     by (rule mono_Mndetprefix_FD_set, simp, blast) 
   have 5:"\<And>X. (\<sqinter>xa\<in> range left \<rightarrow> X) \<sqsubseteq>\<^sub>F\<^sub>D (left\<^bold>?x \<rightarrow> X)"
     by (unfold read_def, subst K_record_comp, fact Mprefix_refines_Mndetprefix_FD)
   from 3 4[of "(\<sqinter>xa\<in> range left \<union> range right \<rightarrow>  P)"] 
        5  [of "(\<sqinter>xa\<in> range left \<union> range right \<rightarrow>  P)"] 
   have 6:"(\<sqinter>xa\<in> range left \<union> range right \<rightarrow> 
                   (\<sqinter>xa\<in> range left \<union> range right \<rightarrow>  P)) \<sqsubseteq>\<^sub>F\<^sub>D (left\<^bold>?x \<rightarrow> (right\<^bold>!x \<rightarrow>  P))"
     using trans_FD by blast
   from * ** have 7:"left\<^bold>?x \<rightarrow> right\<^bold>!x \<rightarrow> P \<sqsubseteq>\<^sub>F\<^sub>D left\<^bold>?x \<rightarrow> right\<^bold>!x \<rightarrow> COPY" by simp
                         
   show "(\<Lambda> x. \<sqinter>xa\<in>range left \<union> range right \<rightarrow>  x)\<cdot>
              ((\<Lambda> x. \<sqinter>xa\<in>range left \<union> range right \<rightarrow>  x)\<cdot>P) \<sqsubseteq>\<^sub>F\<^sub>D COPY"
     by simp (metis (mono_tags, lifting) "6" "7" COPY_rec trans_FD)
 qed
 
 section\<open> An Alternative Approach: Using the fixrec-Package \<close>
 
 subsection\<open> Channels and Synchronisation Sets \<close>
 
 text\<open> As before. \<close>
 
 subsection\<open> Process Definitions via fixrec-Package  \<close>
 
 fixrec
   COPY' :: "('a channel) process"
 and
   SEND' :: "('a channel) process"
 and
   REC' :: "('a channel) process"
 where
    COPY'_rec[simp del]:  "COPY' = left\<^bold>?x \<rightarrow> right\<^bold>!x \<rightarrow> COPY'"
 |  SEND'_rec[simp del]:  "SEND' = left\<^bold>?x \<rightarrow> mid\<^bold>!x \<rightarrow> (ack \<rightarrow> SEND')"
 |  REC'_rec[simp del] :  "REC'  = mid\<^bold>?x  \<rightarrow> right\<^bold>!x \<rightarrow> (ack \<rightarrow> REC')"
 
 thm COPY'_rec
 definition SYSTEM' :: "('a channel) process"
 where     \<open>SYSTEM' \<equiv> ((SEND' \<lbrakk> SYN \<rbrakk> REC') \ SYN)\<close>
 
 subsection\<open> Another Refinement Proof on fixrec-infrastructure \<close>
 
 text\<open> Third part: No comes the proof by fixpoint induction. 
        Not too bad in automation considering what is inferred,
        but wouldn't scale for large examples. \<close>
 thm COPY'_SEND'_REC'.induct
 lemma impl_refines_spec' : "(COPY'::'a channel process) \<sqsubseteq>\<^sub>F\<^sub>D SYSTEM'"
   apply (unfold SYSTEM'_def)
   apply (rule_tac P=\<open>\<lambda> a b c. a \<sqsubseteq>\<^sub>F\<^sub>D ((SEND' \<lbrakk>SYN\<rbrakk> REC') \ SYN)\<close> in COPY'_SEND'_REC'.induct)
   apply (subst case_prod_beta')+
   apply (intro le_FD_adm, simp_all add: monofunI)
   apply (subst SEND'_rec, subst REC'_rec)
   by (simp add: Sync_rules Hiding_rules)
 
 lemma spec_refines_impl' : 
 assumes fin:  "finite (SYN::('a channel)set)"
 shows         "SYSTEM' \<sqsubseteq>\<^sub>F\<^sub>D (COPY'::'a channel process)"
 proof(unfold SYSTEM'_def, rule_tac P=\<open>\<lambda> a b c. ((b \<lbrakk>SYN\<rbrakk> REC') \ SYN) \<sqsubseteq>\<^sub>F\<^sub>D COPY'\<close> 
                           in  COPY'_SEND'_REC'.induct, goal_cases)
   case 1
   have aa:\<open>adm (\<lambda>(a::'a channel process). ((a \<lbrakk>SYN\<rbrakk> REC') \ SYN) \<sqsubseteq>\<^sub>F\<^sub>D COPY')\<close>
     apply (intro le_FD_adm)
     by (simp_all add: fin cont2mono)
   thus ?case using adm_subst[of "\<lambda>(a,b,c). b", simplified, OF aa] by (simp add: split_def)
 next
   case 2
   then show ?case by (simp add: Hiding_set_BOT Sync_BOT Sync_commute)
 next
   case (3 a aa b)
   then show ?case 
     apply (subst COPY'_rec, subst REC'_rec)
     by (simp add: Sync_rules Hiding_rules)
 qed
 
 lemma spec_equal_impl' : 
 assumes fin:  "finite (SYN::('a channel)set)"
 shows         "SYSTEM' = (COPY'::'a channel process)"
   apply (rule FD_antisym)
   apply (rule spec_refines_impl'[OF fin])
   apply (rule impl_refines_spec')
 done
 
 
 
 end
diff --git a/thys/HOL-CSP/Det.thy b/thys/HOL-CSP/Det.thy
--- a/thys/HOL-CSP/Det.thy
+++ b/thys/HOL-CSP/Det.thy
@@ -1,298 +1,279 @@
 (*<*)
 \<comment>\<open> ********************************************************************
  * Project         : HOL-CSP - A Shallow Embedding of CSP in  Isabelle/HOL
  * Version         : 2.0
  *
- * Author          : Burkhart Wolff, Safouan Taha, Lina Ye.
+ * Author          : Burkhart Wolff, Safouan Taha.
  *                   (Based on HOL-CSP 1.0 by Haykal Tej and Burkhart Wolff)
  *
  * This file       : A Combined CSP Theory
  *
  * Copyright (c) 2009 Université Paris-Sud, France
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials provided
  *       with the distribution.
  *
  *     * Neither the name of the copyright holders nor the names of its
  *       contributors may be used to endorse or promote products derived
  *       from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  ******************************************************************************\<close>
 (*>*)
 
 section\<open> Deterministic Choice Operator Definition \<close>
 
 theory  Det 
 imports Process
 begin
 
-subsection\<open>Definition\<close>
-definition
+subsection\<open>The Det Operator Definition\<close>
+lift_definition
         Det      :: "['\<alpha> process,'\<alpha> process] \<Rightarrow> '\<alpha> process"   (infixl "[+]" 79)
-where   "P [+] Q \<equiv> Abs_process(  {(s,X). s = [] \<and> (s,X) \<in> \<F> P \<inter> \<F> Q}
-                               \<union> {(s,X). s \<noteq> [] \<and> (s,X) \<in> \<F> P \<union> \<F> Q}
-                               \<union> {(s,X). s = [] \<and> s \<in> \<D> P \<union> \<D> Q}
-                               \<union> {(s,X). s = [] \<and> tick \<notin> X \<and> [tick] \<in> \<T> P \<union> \<T> Q},
-                               \<D> P \<union> \<D> Q)"
+        is   "\<lambda>P Q. (  {(s,X). s = [] \<and> (s,X) \<in> \<F> P \<inter> \<F> Q}
+                     \<union> {(s,X). s \<noteq> [] \<and> (s,X) \<in> \<F> P \<union> \<F> Q}
+                     \<union> {(s,X). s = [] \<and> s \<in> \<D> P \<union> \<D> Q}
+                     \<union> {(s,X). s = [] \<and> tick \<notin> X \<and> [tick] \<in> \<T> P \<union> \<T> Q},
+                     \<D> P \<union> \<D> Q)"
+proof -
+  show \<open>is_process (   {(s,X). s = [] \<and> (s,X) \<in> \<F> (P ::'\<alpha> process) \<inter> \<F> Q}
+                     \<union> {(s,X). s \<noteq> [] \<and> (s,X) \<in> \<F> P \<union> \<F> Q}
+                     \<union> {(s,X). s = [] \<and> s \<in> \<D> P \<union> \<D> Q}
+                     \<union> {(s,X). s = [] \<and> tick \<notin> X \<and> [tick] \<in> \<T> P \<union> \<T> Q},
+                     \<D> P \<union> \<D> Q)\<close> (is \<open>is_process (?f, ?d)\<close>) for P Q
+  proof (simp only: fst_conv snd_conv Rep_process is_process_def 
+                    DIVERGENCES_def FAILURES_def, intro conjI)
+    show "([], {}) \<in> ?f"
+      by(simp add: is_processT1)
+  next
+    show "\<forall>s X. (s, X) \<in> ?f \<longrightarrow> front_tickFree s"
+      by(auto simp: is_processT2)
+  next
+    show "\<forall>s t.   (s @ t, {}) \<in> ?f \<longrightarrow> (s, {}) \<in> ?f"
+      by(auto simp: is_processT1 dest!: is_processT3[rule_format])
+  next
+    show "\<forall>s X Y. (s, Y) \<in> ?f \<and> X \<subseteq> Y  \<longrightarrow>  (s, X) \<in> ?f"
+      by(auto dest: is_processT4[rule_format,OF conj_commute[THEN iffD1],OF conjI])
+  next
+    show "\<forall>sa X Y. (sa, X) \<in> ?f \<and> (\<forall>c. c \<in> Y \<longrightarrow> (sa @ [c], {}) \<notin> ?f) \<longrightarrow> (sa, X \<union> Y) \<in> ?f"
+      by(auto simp: is_processT5 T_F)
+  next
+    show " \<forall>s X. (s @ [tick], {}) \<in> ?f \<longrightarrow> (s, X - {tick}) \<in> ?f"
+      apply((rule allI)+, rule impI, rename_tac s X)
+      apply(case_tac "s=[]", simp_all add: is_processT6[rule_format] T_F_spec)
+      by(auto simp: is_processT6[rule_format] T_F_spec)
+  next
+    show "\<forall>s t. s \<in> ?d \<and> tickFree s \<and> front_tickFree t \<longrightarrow> s @ t \<in> ?d"
+      by(auto simp: is_processT7)
+  next
+    show "\<forall>s X. s \<in> ?d \<longrightarrow> (s, X) \<in> ?f"
+      by(auto simp: is_processT8[rule_format]) 
+  next
+    show "\<forall>s. s @ [tick] \<in> ?d \<longrightarrow> s \<in> ?d"
+      by(auto intro!:is_processT9[rule_format])  
+  qed
+qed
 
 notation
   Det (infixl "\<box>" 79)
 
 term \<open>(A \<box> B) \<box> D' = C\<close>
 
-lemma is_process_REP_Det:
-"is_process ({(s, X). s = [] \<and> (s, X) \<in> \<F> P \<inter> \<F> Q} \<union>
-             {(s, X). s \<noteq> [] \<and> (s, X) \<in> \<F> P \<union> \<F> Q} \<union>
-             {(s, X). s = [] \<and> s \<in> \<D> P \<union> \<D> Q} \<union>
-             {(s, X). s = [] \<and> tick \<notin> X \<and> [tick] \<in> \<T> P \<union> \<T> Q},
-             \<D> P \<union> \<D> Q)"
-(is "is_process(?T,?D)")
-proof (simp only: fst_conv snd_conv Rep_process is_process_def 
-                  DIVERGENCES_def FAILURES_def, intro conjI)
-     show "([], {}) \<in> ?T"
-          by(simp add: is_processT1)
-next
-     show "\<forall>s X. (s, X) \<in> ?T \<longrightarrow> front_tickFree s"
-          by(auto simp: is_processT2)
-next
-     show "\<forall>s t.   (s @ t, {}) \<in> ?T \<longrightarrow> (s, {}) \<in> ?T"
-          by(auto simp: is_processT1 dest!: is_processT3[rule_format])
-next
-     show "\<forall>s X Y. (s, Y) \<in> ?T \<and> X \<subseteq> Y  \<longrightarrow>  (s, X) \<in> ?T"
-          by(auto dest: is_processT4[rule_format,OF conj_commute[THEN iffD1],OF conjI])
-next
-     show "\<forall>sa X Y. (sa, X) \<in> ?T \<and> (\<forall>c. c \<in> Y \<longrightarrow> (sa @ [c], {}) \<notin> ?T) \<longrightarrow> (sa, X \<union> Y) \<in> ?T"
-          by(auto simp: is_processT5 T_F)
-next
-     show " \<forall>s X. (s @ [tick], {}) \<in> ?T \<longrightarrow> (s, X - {tick}) \<in> ?T"
-          apply((rule allI)+, rule impI, rename_tac s X)
-          apply(case_tac "s=[]", simp_all add: is_processT6[rule_format] T_F_spec)
-          by(auto simp: is_processT6[rule_format] T_F_spec)
-next
-     show "\<forall>s t. s \<in> ?D \<and> tickFree s \<and> front_tickFree t \<longrightarrow> s @ t \<in> ?D"
-          by(auto simp: is_processT7)
-next
-     show "\<forall>s X. s \<in> ?D \<longrightarrow> (s, X) \<in> ?T"
-          by(auto simp: is_processT8[rule_format]) 
-next
-     show "\<forall>s. s @ [tick] \<in> ?D \<longrightarrow> s \<in> ?D"
-          by(auto intro!:is_processT9[rule_format])  
-qed
-
-
-lemma Rep_Abs_Det:
-"Rep_process
-     (Abs_process
-       ({(s, X). s = [] \<and> (s, X) \<in> \<F> P \<inter> \<F> Q} \<union>
-        {(s, X). s \<noteq> [] \<and> (s, X) \<in> \<F> P \<union> \<F> Q} \<union>
-        {(s, X). s = [] \<and> s \<in> \<D> P \<union> \<D> Q} \<union>
-        {(s, X). s = [] \<and> tick \<notin> X \<and> [tick] \<in> \<T> P \<union> \<T> Q},
-        \<D> P \<union> \<D> Q)) =
-    ({(s, X). s = [] \<and> (s, X) \<in> \<F> P \<inter> \<F> Q} \<union>
-     {(s, X). s \<noteq> [] \<and> (s, X) \<in> \<F> P \<union> \<F> Q} \<union>
-     {(s, X). s = [] \<and> s \<in> \<D> P \<union> \<D> Q} \<union>
-     {(s, X). s = [] \<and> tick \<notin> X \<and> [tick] \<in> \<T> P \<union> \<T> Q},
-     \<D> P \<union> \<D> Q)"
-  by(simp only: CollectI Rep_process Abs_process_inverse is_process_REP_Det)
-
 
 subsection\<open>The Projections\<close>
 
 lemma F_Det    :
    "\<F> (P \<box> Q) =    {(s,X). s = [] \<and> (s,X) \<in> \<F> P \<inter> \<F> Q}
                  \<union> {(s,X). s \<noteq> [] \<and> (s,X) \<in> \<F> P \<union> \<F> Q}
                  \<union> {(s,X). s = [] \<and> s \<in> \<D> P \<union> \<D> Q}
                  \<union> {(s,X). s = [] \<and> tick \<notin> X \<and> [tick] \<in> \<T> P \<union> \<T> Q}"
-  by(subst Failures_def, simp only: Det_def Rep_Abs_Det FAILURES_def fst_conv)
+  by (subst Failures.rep_eq, simp add: Det.rep_eq FAILURES_def)
 
+lemma D_Det: "\<D> (P \<box> Q) = \<D> P \<union> \<D> Q"
+   by (subst Divergences.rep_eq, simp add: Det.rep_eq DIVERGENCES_def)
+
+lemma T_Det: "\<T> (P \<box> Q) = \<T> P \<union> \<T> Q"
+  apply (subst Traces.rep_eq, simp add: TRACES_def Failures.rep_eq[symmetric] F_Det)
+  apply(auto simp: T_F F_T is_processT1 Nil_elem_T)
+  by(rule_tac x="{}" in exI, simp add: T_F F_T is_processT1 Nil_elem_T)+
+  
 
 subsection\<open>Basic Laws\<close>
 text\<open>The following theorem of Commutativity helps to simplify the subsequent
 continuity proof by symmetry breaking. It is therefore already developed here:\<close>
-lemma D_Det: "\<D> (P \<box> Q) = \<D> P \<union> \<D> Q"
-  by(subst D_def, simp only: Det_def Rep_Abs_Det DIVERGENCES_def snd_conv)
-
-
-lemma T_Det: "\<T> (P \<box> Q) = \<T> P \<union> \<T> Q"
-  apply(subst Traces_def, simp only: Det_def Rep_Abs_Det TRACES_def FAILURES_def
-                                fst_def snd_conv)
-  apply(auto simp: T_F F_T is_processT1 Nil_elem_T)
-  apply(rule_tac x="{}" in exI, simp add: T_F F_T is_processT1 Nil_elem_T)+
-  done
 
 lemma Det_commute:"(P \<box> Q) = (Q \<box> P)"
   by(auto simp: Process_eq_spec F_Det D_Det)
 
 
 subsection\<open>The Continuity-Rule\<close>
 
 lemma mono_Det1: "P \<sqsubseteq> Q \<Longrightarrow> \<D> (Q \<box> S) \<subseteq> \<D> (P \<box> S)"
   apply (drule le_approx1)
   by (auto simp: Process_eq_spec F_Det D_Det)
 
 lemma mono_Det2: 
 assumes ordered: "P \<sqsubseteq> Q"
 shows   "(\<forall> s. s \<notin> \<D> (P \<box> S) \<longrightarrow> Ra (P \<box> S) s = Ra (Q \<box> S) s)"
 proof -
    have A:"\<And>s t. [] \<notin> \<D> P \<Longrightarrow> [] \<notin> \<D> S \<Longrightarrow> s = [] \<Longrightarrow> 
            ([], t) \<in> \<F> P \<Longrightarrow> ([], t) \<in> \<F> S \<Longrightarrow> ([], t) \<in> \<F> Q"
         by (insert ordered,frule_tac X="t" and s="[]" in proc_ord2a, simp_all)
    have B:"\<And>s t. s \<notin> \<D> P \<Longrightarrow> s \<notin> \<D> S \<Longrightarrow>
           (s \<noteq> [] \<and> ((s, t) \<in> \<F> P \<or> (s, t) \<in> \<F> S) \<longrightarrow> (s, t) \<in> \<F> Q \<or> (s, t) \<in> \<F> S) \<and>
           (s = [] \<and> tick \<notin> t \<and> ([tick] \<in> \<T> P \<or> [tick] \<in> \<T> S) \<longrightarrow>
            ([], t) \<in> \<F> Q \<and> ([], t) \<in> \<F> S \<or> [] \<in> \<D> Q \<or>  [tick] \<in> \<T> Q \<or>  [tick] \<in> \<T> S)"
         apply(intro conjI impI, elim conjE disjE, rule disjI1)
         apply(simp_all add: proc_ord2a[OF ordered,symmetric])
         apply(elim conjE disjE,subst le_approx2T[OF ordered])
         apply(frule is_processT9_S_swap, simp_all)
         done
    have C: "\<And>s. s \<notin> \<D> P \<Longrightarrow> s \<notin> \<D> S \<Longrightarrow>
                 {X. s = [] \<and> (s, X) \<in> \<F> Q \<and> (s, X) \<in> \<F> S \<or>
                     s \<noteq> [] \<and> ((s, X) \<in> \<F> Q \<or> (s, X) \<in> \<F> S) \<or>
                     s = [] \<and> s \<in> \<D> Q \<or> s = [] \<and> tick \<notin> X \<and> 
                     ([tick] \<in> \<T> Q \<or> [tick] \<in> \<T> S)}
               \<subseteq> {X. s = [] \<and> (s, X) \<in> \<F> P \<and> (s, X) \<in> \<F> S \<or>
                      s \<noteq> [] \<and> ((s, X) \<in> \<F> P \<or> (s, X) \<in> \<F> S) \<or>
                      s = [] \<and> tick \<notin> X \<and> ([tick] \<in> \<T> P \<or> [tick] \<in> \<T> S)}"
         apply(intro subsetI, frule is_processT9_S_swap, simp)
         apply(elim conjE disjE, simp_all add: proc_ord2a[OF ordered,symmetric] is_processT8_S)
         apply(insert le_approx1[OF ordered] le_approx_lemma_T[OF ordered]) 
         by   (auto simp: proc_ord2a[OF ordered,symmetric])    
     show ?thesis
     apply(simp add: Process_eq_spec F_Det D_Det Ra_def min_elems_def)
     apply(intro allI impI equalityI C, simp_all)
     apply(intro allI impI subsetI, simp)
     apply(metis A B)    
     done
 qed
 
 
 lemma mono_Det3: "P \<sqsubseteq> Q \<Longrightarrow> min_elems (\<D> (P \<box> S)) \<subseteq> \<T> (Q \<box> S)"
 apply (frule le_approx3)
 apply (simp add: Process_eq_spec F_Det T_Det D_Det Ra_def min_elems_def subset_iff)
 apply (auto intro:D_T)
 done
 
 lemma mono_Det[simp]  : "P \<sqsubseteq> Q \<Longrightarrow> (P \<box> S) \<sqsubseteq> (Q \<box> S)"
 by (auto simp: le_approx_def mono_Det1 mono_Det2 mono_Det3)
 
 
 lemma mono_Det_sym[simp] : "P \<sqsubseteq> Q \<Longrightarrow> (S \<box> P) \<sqsubseteq> (S \<box> Q)"
 by (simp add: Det_commute)
 
 
 
 lemma cont_Det0: 
 assumes C : "chain Y"
 shows       "(lim_proc (range Y) \<box> S) = lim_proc (range (\<lambda>i. Y i \<box> S))"
 proof -
   have C':"chain (\<lambda>i. Y i \<box> S)"
           by(auto intro!:chainI simp:chainE[OF C])
   show ?thesis
   apply (subst Process_eq_spec)
   apply (simp add: D_Det F_Det)
   apply(simp add: F_LUB[OF C]  D_LUB[OF C] T_LUB[OF C] F_LUB[OF C']  D_LUB[OF C'] T_LUB[OF C'])
   apply(safe)
   apply(auto simp: D_Det F_Det T_Det)
   using NF_ND apply blast
   using is_processT6_S2 is_processT8 apply blast
   apply (metis D_T append_Nil front_tickFree_single process_charn tickFree_Nil)
   using NF_ND is_processT6_S2 apply blast
   using NF_ND is_processT6_S2 by blast
 qed
 
 lemma cont_Det: 
 assumes C: "chain Y"
 shows   " ((\<Squnion> i. Y i) \<box> S) = (\<Squnion> i. (Y i \<box> S))"
 apply(insert C)
 apply(subst limproc_is_thelub, simp)
 apply(subst limproc_is_thelub)
 apply(rule chainI)
 apply(frule_tac i="i" in chainE)
 apply(simp)
 apply(erule cont_Det0)
 done
 
 
 lemma cont_Det': 
 assumes chain:"chain Y"
 shows "((\<Squnion> i. Y i) \<box> S) = (\<Squnion> i. (Y i \<box> S))"
 proof -
    have chain':"chain (\<lambda>i. Y i \<box> S)"
           by(auto intro!:chainI simp: chainE[OF chain])
    have B:"\<F> (lim_proc (range Y) \<box> S) \<subseteq>  \<F> (lim_proc (range (\<lambda>i. Y i \<box> S)))"
           apply(simp add: D_Det F_Det F_LUB T_LUB D_LUB chain chain')
           apply(intro conjI subsetI, simp_all)
           by(auto split:prod.split prod.split_asm)
    have C:"\<F> (lim_proc (range (\<lambda>i. Y i \<box> S))) \<subseteq> \<F>(lim_proc (range Y) \<box> S)"
       proof -
       have C1 : "\<And>ba ab ac. \<forall>a. ([], ba) \<in> \<F> (Y a) \<and> ([], ba) \<in> \<F> S \<or> [] \<in> \<D> (Y a) \<Longrightarrow>
                    [] \<notin> \<D> (Y ab) \<Longrightarrow> [] \<notin> \<D> S \<Longrightarrow>  tick \<in> ba \<Longrightarrow> ([], ba) \<in> \<F> (Y ac) "
                 using is_processT8 by auto
       have C2 : "\<And>ba ab ac ad D. \<forall>a. ([], ba) \<in> \<F> (Y a) \<and> ([], ba) \<in> \<F> S \<or> [] \<in> \<D> (Y a) 
                                \<or> tick \<notin> ba \<and> [tick] \<in> \<T> (Y a) \<Longrightarrow>
                    []\<notin>D(Y ab) \<Longrightarrow> []\<notin>D S \<Longrightarrow> ([],ba)\<notin> \<F>(Y ac) \<Longrightarrow> [tick] \<notin> \<T> S \<Longrightarrow> [tick]\<in>\<T>(Y ad)"
                 using NF_ND is_processT6_S2 by blast
       have C3: "\<And>ba ab ac. \<forall>a. [] \<in> \<D> (Y a) \<or> tick \<notin> ba \<and> [tick] \<in> \<T> (Y a) \<Longrightarrow>
                    [] \<notin> \<D> (Y ab) \<Longrightarrow> [] \<notin> \<D> S \<Longrightarrow> ([], ba) \<notin> \<F> S \<Longrightarrow> 
                    [tick] \<notin> \<T> S \<Longrightarrow> [tick] \<in> \<T> (Y ac)"
                 by (metis D_T append_Nil front_tickFree_single process_charn tickFree_Nil)
       show ?thesis
           apply(simp add: D_Det F_Det F_LUB T_LUB D_LUB chain chain')
           apply(rule subsetI, simp)
           apply(simp split:prod.split prod.split_asm)
           apply(intro allI impI,simp)
           by (metis C3 is_processT6_S2 is_processT8_S)
       qed
    have D:"\<D> (lim_proc (range Y) \<box> S) = \<D> (lim_proc (range (\<lambda>i. Y i \<box> S)))"
           by(simp add: D_Det F_Det F_LUB T_LUB D_LUB chain chain')
    show ?thesis
    by(simp add: chain chain' limproc_is_thelub Process_eq_spec equalityI B C D)
 qed
 
 lemma Det_cont[simp]: 
 assumes f:"cont f"
 and     g:"cont g"
 shows     "cont (\<lambda>x. f x \<box> g x)"
 proof -
    have A : "\<And>x. cont f \<Longrightarrow> cont (\<lambda>y. y \<box> f x)"
        apply (rule contI2,rule monofunI)
        apply (auto)
        apply (subst Det_commute,subst cont_Det)
        apply (auto simp: Det_commute)
        done
    have B : "\<And>y. cont f \<Longrightarrow> cont (\<lambda>x. y \<box> f x)"
        apply (rule_tac c="(\<lambda> x. y \<box> x)" in cont_compose)
        apply (rule contI2,rule monofunI)
        apply (auto)
        apply (subst Det_commute,subst cont_Det)
        by (simp_all add: Det_commute)
    show ?thesis using f g 
       apply(rule_tac f="(\<lambda>x. (\<lambda> g. f x \<box> g))" in cont_apply)
       apply(auto intro:contI2 monofunI simp:Det_commute A B)
       done
 qed
 
 end
\ No newline at end of file
diff --git a/thys/HOL-CSP/Hiding.thy b/thys/HOL-CSP/Hiding.thy
--- a/thys/HOL-CSP/Hiding.thy
+++ b/thys/HOL-CSP/Hiding.thy
@@ -1,660 +1,653 @@
 (*<*)
 \<comment>\<open> ******************************************************************** 
  * Project         : HOL-CSP - A Shallow Embedding of CSP in  Isabelle/HOL
  * Version         : 2.0
  *
- * Author          : Burkhart Wolff, Safouan Taha, Lina Ye.
+ * Author          : Burkhart Wolff, Safouan Taha.
  *                   (Based on HOL-CSP 1.0 by Haykal Tej and Burkhart Wolff)
  *
  * This file       : A Combined CSP Theory
  *
  * Copyright (c) 2009 Université Paris-Sud, France
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials provided
  *       with the distribution.
  *
  *     * Neither the name of the copyright holders nor the names of its
  *       contributors may be used to endorse or promote products derived
  *       from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  ******************************************************************************\<close>
 (*>*)
 
 chapter\<open>Concurrent CSP Operators\<close>
 
 section\<open>The Hiding Operator\<close>
 
 theory  Hiding
 imports Process
 begin
 
 subsection\<open>Preliminaries : primitives and lemmas\<close>
 
 abbreviation "trace_hide t A \<equiv> filter (\<lambda>x. x \<notin> A) t"
 
 lemma Hiding_tickFree : "tickFree s \<longleftrightarrow> tickFree (trace_hide s (ev`A))"
   by (auto simp add: tickFree_def)
 
 lemma Hiding_fronttickFree : "front_tickFree s \<Longrightarrow> front_tickFree (trace_hide s (ev`A))"
   apply(auto simp add: front_tickFree_charn tickFree_def split:if_splits)
   by (metis Hiding_tickFree list_nonMt_append tickFree_append tickFree_def)
 
 lemma trace_hide_union[simp] : "trace_hide t (ev ` (A \<union> B)) = trace_hide (trace_hide t (ev ` A)) (ev ` B)" 
   by (subgoal_tac "ev ` (A \<union> B) = (ev ` A) \<union> (ev ` B)") auto
 
 abbreviation "isInfHiddenRun f P A \<equiv> strict_mono f \<and> (\<forall> i. f i \<in> \<T> P) \<and> 
                                       (\<forall> i. trace_hide (f i) (ev ` A) = trace_hide (f (0::nat)) (ev ` A))"
 
 lemma isInfHiddenRun_1: "isInfHiddenRun f P A \<longleftrightarrow> strict_mono f \<and> (\<forall> i. f i \<in> \<T> P) \<and>  
                                                   (\<forall>i. \<exists>t. f i = f 0 @ t \<and> set t \<subseteq>  (ev ` A))"
                          (is "?A \<longleftrightarrow> ?B")
 proof
   assume A: ?A
   {
     fix i
     from A have "f 0 \<le> f i" using strict_mono_less_eq by blast
     then obtain t where B:"f i = f 0 @ t" by (metis le_list_def)
     hence "trace_hide (f i) (ev ` A) = (trace_hide (f 0) (ev ` A)) @ (trace_hide t (ev ` A))" by simp
     with A have "trace_hide t (ev ` A) = []" by (metis append_self_conv)
     with B have "\<exists>t. f i = f 0 @ t \<and> set t \<subseteq>  (ev ` A)"
       using filter_empty_conv[of "\<lambda>x. x \<notin> (ev ` A)"] by auto
   }
   with A show ?B by simp
 next
   assume B: ?B
   {
     fix i
     from B obtain t where B:"f i = f 0 @ t" and "set t \<subseteq>  (ev ` A)" by blast
     hence "trace_hide (f i) (ev ` A) = (trace_hide (f 0) (ev ` A))" by (simp add: subset_iff)
   }
   with B show ?A by simp
 qed
 
-subsection\<open>The Hiding Operator Definition\<close>
 
 abbreviation "div_hide P A \<equiv> {s. \<exists> t u. front_tickFree u \<and>
                                         tickFree t \<and> s = trace_hide t (ev ` A) @ u \<and> 
                                         (t \<in> \<D> P \<or> (\<exists> f. isInfHiddenRun f P A \<and> t \<in> range f))}"
 
-definition Hiding  :: "['\<alpha> process ,'\<alpha> set] => '\<alpha> process"     (\<open>_ \ _\<close> [57,56] 57)  where  
-  \<open>P \ A \<equiv> Abs_process ({(s,X). \<exists> t. s = trace_hide t (ev`A) \<and> (t,X \<union> (ev`A)) \<in> \<F> P} \<union>
-                        {(s,X). s \<in> div_hide P A}, div_hide P A)\<close>
-
 lemma inf_hidden:
   assumes as1:"\<forall>t. trace_hide t (ev ` A) = trace_hide s (ev ` A) \<longrightarrow> (t, ev ` A) \<notin> \<F> P"
       and as2:"s \<in> \<T> P"
     shows "\<exists>f. isInfHiddenRun f P A \<and> s \<in> range f"
 proof
   define f where A:"f = rec_nat s (\<lambda>i t. (let e = SOME e. e \<in> ev`A \<and> t @ [e] \<in> \<T> P in t @ [e]))"
   hence B:"strict_mono f" by (simp add:strict_mono_def lift_Suc_mono_less_iff)
   from A have C:"s \<in> range f" 
     by (metis (mono_tags, lifting) old.nat.simps(6) range_eqI)
   { fix i
     have "f i \<in> \<T> P \<and> trace_hide (f i) (ev ` A) = (trace_hide s (ev ` A))"
     proof(induct i, simp add: A Nil_elem_T as2)
       case (Suc i)
       with as1[THEN spec, of "f i"] have a:"\<exists>e. e \<in> ev`A \<and> f i @ [e] \<in> \<T> P" 
         using is_processT5_S7 by force
       from A have b:"f (Suc i) = (let e = SOME e. e \<in> ev`A \<and> f i @ [e] \<in> \<T> P in  f i @ [e])"
         by simp
       with Suc a[THEN someI_ex] show ?case by simp
     qed
   } 
   with B C show "isInfHiddenRun f P A \<and> s \<in> range f" by simp
 qed
 
-subsection\<open>Consequences\<close>
+
 
 lemma trace_hide_append: "s @ t = trace_hide ta (ev ` A) \<Longrightarrow> \<exists>ss tt. ta = ss@tt \<and> 
                                                                      s = trace_hide ss (ev ` A) \<and> 
                                                                      t = trace_hide tt (ev ` A)"
 proof(induct "ta" arbitrary:s t)
   case Nil thus ?case by simp
 next
   case (Cons a ta) thus ?case
   proof(cases "a \<in> (ev ` A)")
     case True
     hence "s @ t = trace_hide ta (ev ` A)" by (simp add: Cons)
     with Cons obtain ss tt where "ta = ss @ tt \<and> s = trace_hide ss (ev ` A) 
                                   \<and> t = trace_hide tt (ev ` A)" by blast
     with True Cons show ?thesis by (rule_tac x="a#ss" in exI, rule_tac x=tt in exI, auto)
   next
     case False thus ?thesis 
     proof(cases s)
       case Nil thus ?thesis using Cons by fastforce
     next
       case Cons2:(Cons aa tls)
       with False have A:"a = aa \<and> tls @ t = trace_hide ta (ev ` A)" using Cons by auto
       with Cons obtain ss tt where "ta = ss @ tt \<and> tls = trace_hide ss (ev ` A) 
                                   \<and> t = trace_hide tt (ev ` A)" by blast
       with Cons2 A False show ?thesis by (rule_tac x="a#ss" in exI, rule_tac x=tt in exI, auto)
     qed
   qed
 qed
 
-lemma Hiding_maintains_is_process:
-      "is_process     ({(s,X). \<exists> t. s = trace_hide t (ev`A) \<and> (t,X \<union> (ev`A)) \<in> \<F> P} \<union>
-                          {(s,X). s \<in> div_hide P A}, div_hide P A)" (is "is_process(?f, ?d)")
-proof (simp only: fst_conv snd_conv Failures_def is_process_def FAILURES_def DIVERGENCES_def,
-      fold FAILURES_def DIVERGENCES_def,fold Failures_def,intro conjI, goal_cases)
-  case 1 thus ?case
-  proof (auto, rule not_not[THEN iffD1], rule notI, simp, goal_cases)
-    case 1
-    from inf_hidden[of A "[]" P] obtain f where A:"isInfHiddenRun f P A \<and> [] \<in> range f"
-      using "1"(2) Nil_elem_T by auto
-    from A 1(1)[THEN spec, of "[]"] filter.simps(1) tickFree_Nil show ?case by auto
-  qed
-next
-  case 2 thus ?case
-    using is_processT2 Hiding_fronttickFree front_tickFree_append Hiding_tickFree by blast+
-next
-  case 3 thus ?case
-  proof(auto del:disjE, goal_cases)
-    case (1 s t ta) show ?case
-    proof(cases "tickFree s")
-      case True
-      from 1(2) obtain ss tt where A:"ta = ss@tt \<and> s = trace_hide ss (ev ` A) \<and> ss \<in> \<T> P"
-        using trace_hide_append[of s t A ta, OF 1(1)] by (metis F_T is_processT3_SR)
-      with True have B:"tickFree ss"
-        by (metis event.distinct(1) filter_set imageE member_filter tickFree_def)
-      show ?thesis 
-        using 1(3) A B inf_hidden[of A ss P] by (metis append_Nil2 front_tickFree_Nil)
-    next
-      case False
-      with 1(1,2) obtain ss tt where A:"s = ss@[tick] \<and> ta = tt@[tick]"
-        by (metis append_Nil2 contra_subsetD filter_is_subset front_tickFree_mono 
-                  Hiding_fronttickFree is_processT nonTickFree_n_frontTickFree tickFree_def)
-      with 1(1,2) have "ss = trace_hide tt (ev ` A)"
-        by (metis (no_types, lifting) butlast_append butlast_snoc contra_subsetD 
-                  filter.simps(2) filter_append filter_is_subset front_tickFree_implies_tickFree 
-                  front_tickFree_single is_processT nonTickFree_n_frontTickFree non_tickFree_tick 
-                  self_append_conv2 tickFree_append tickFree_def)
-      with False 1(1,2) A show ?thesis
-        by (metis append_Nil2 front_tickFree_mono Hiding_fronttickFree is_processT)
+subsection\<open>The Hiding Operator Definition\<close>
+
+lift_definition Hiding  :: "['\<alpha> process ,'\<alpha> set] => '\<alpha> process"     (\<open>_ \ _\<close> [57,56] 57)  is  
+  \<open>\<lambda>P A. ({(s,X). \<exists> t. s = trace_hide t (ev`A) \<and> (t,X \<union> (ev`A)) \<in> \<F> P} \<union>
+                        {(s,X). s \<in> div_hide P A}, div_hide P A)\<close>
+proof - 
+  show "is_process ({(s,X). \<exists> t. s = trace_hide t (ev`(A :: '\<alpha> set)) \<and> (t,X \<union> (ev`A)) \<in> \<F> P} \<union>
+                    {(s,X). s \<in> div_hide P A}, div_hide P A)" (is "is_process(?f, ?d)") for P A
+  proof (simp only: is_process_def FAILURES_def DIVERGENCES_def fst_conv snd_conv, 
+         intro conjI, goal_cases)
+    case 1 thus ?case
+    proof (auto, rule not_not[THEN iffD1], rule notI, simp, goal_cases)
+      case 1
+      from inf_hidden[of A "[]" P] obtain f where A:"isInfHiddenRun f P A \<and> [] \<in> range f"
+        using "1"(2) Nil_elem_T by auto
+      from A 1(1)[THEN spec, of "[]"] filter.simps(1) tickFree_Nil show ?case by auto
     qed
   next
-    case (2 s t ta u) show ?case
-    proof(cases "length s \<le> length (trace_hide ta (ev ` A))")
-      case True
-      with append_eq_append_conv2[THEN iffD1, OF 2(3)] 
-        obtain tt where "s@tt = trace_hide ta (ev ` A)" by auto
-      with 2(4) obtain ss ttt where A:"ta = ss@ttt \<and> s = trace_hide ss (ev ` A) \<and> ss \<in> \<T> P"
-        using trace_hide_append[of s tt A ta] by (metis D_T imageE is_processT3_ST)
-      with 2(2) have B:"tickFree ss" using tickFree_append by blast
-      show ?thesis 
-        using 2(4,5) A B inf_hidden[of A ss P]
-        by (metis (no_types, lifting) append_Nil2 is_processT)
+    case 2 thus ?case
+      using is_processT2 Hiding_fronttickFree front_tickFree_append Hiding_tickFree by blast+
+  next
+    case 3 thus ?case
+    proof(auto del:disjE, goal_cases)
+      case (1 s t ta) show ?case
+      proof(cases "tickFree s")
+        case True
+        from 1(2) obtain ss tt where A:"ta = ss@tt \<and> s = trace_hide ss (ev ` A) \<and> ss \<in> \<T> P"
+          using trace_hide_append[of s t A ta, OF 1(1)] by (metis F_T is_processT3_SR)
+        with True have B:"tickFree ss"
+          by (metis event.distinct(1) filter_set imageE member_filter tickFree_def)
+        show ?thesis 
+          using 1(3) A B inf_hidden[of A ss P] by (metis append_Nil2 front_tickFree_Nil)
+      next
+        case False
+        with 1(1,2) obtain ss tt where A:"s = ss@[tick] \<and> ta = tt@[tick]"
+          by (metis append_Nil2 contra_subsetD filter_is_subset front_tickFree_mono 
+                    Hiding_fronttickFree is_processT nonTickFree_n_frontTickFree tickFree_def)
+        with 1(1,2) have "ss = trace_hide tt (ev ` A)"
+          by (metis (no_types, lifting) butlast_append butlast_snoc contra_subsetD 
+                    filter.simps(2) filter_append filter_is_subset front_tickFree_implies_tickFree 
+                    front_tickFree_single is_processT nonTickFree_n_frontTickFree non_tickFree_tick 
+                    self_append_conv2 tickFree_append tickFree_def)
+        with False 1(1,2) A show ?thesis
+          by (metis append_Nil2 front_tickFree_mono Hiding_fronttickFree is_processT)
+      qed
     next
-      case False
-      with 2(3) obtain uu uuu where A:"s = trace_hide ta (ev ` A) @ uu \<and> u = uu @ uuu"
-        by (auto simp add: append_eq_append_conv2, metis le_length_mono le_list_def)          
-      with 2(1,2,4) 2(5)[rule_format, of ta uu] show ?thesis
-        using front_tickFree_dw_closed by blast
+      case (2 s t ta u) show ?case
+      proof(cases "length s \<le> length (trace_hide ta (ev ` A))")
+        case True
+        with append_eq_append_conv2[THEN iffD1, OF 2(3)] 
+          obtain tt where "s@tt = trace_hide ta (ev ` A)" by auto
+        with 2(4) obtain ss ttt where A:"ta = ss@ttt \<and> s = trace_hide ss (ev ` A) \<and> ss \<in> \<T> P"
+          using trace_hide_append[of s tt A ta] by (metis D_T imageE is_processT3_ST)
+        with 2(2) have B:"tickFree ss" using tickFree_append by blast
+        show ?thesis 
+          using 2(4,5) A B inf_hidden[of A ss P]
+          by (metis (no_types, lifting) append_Nil2 is_processT)
+      next
+        case False
+        with 2(3) obtain uu uuu where A:"s = trace_hide ta (ev ` A) @ uu \<and> u = uu @ uuu"
+          by (auto simp add: append_eq_append_conv2, metis le_length_mono le_list_def)          
+        with 2(1,2,4) 2(5)[rule_format, of ta uu] show ?thesis
+          using front_tickFree_dw_closed by blast
+      qed
     qed
-  qed
-next
-  case 4 thus ?case
-    by (auto, metis (mono_tags) Un_subset_iff is_processT4 sup.cobounded2 sup.coboundedI1)
-next
-  case 5 thus ?case
-  proof(intro impI allI, auto, rule not_not[THEN iffD1], rule notI, simp, goal_cases)
-    case (1 X Y t)
-    from 1(3) 1(4)[THEN spec, of t, simplified] obtain c where A1:"c \<in> Y" and A2:"c \<notin> (ev`A)" 
-                                                           and A3:"t@[c] \<in> \<T> P"
-      using is_processT5_S7'[of t "X \<union> (ev`A)" P Y] by (metis UnCI sup_commute sup_left_commute)
-    hence "trace_hide t (ev ` A) @ [c] = trace_hide (t@[c]) (ev ` A)" by simp
-    thus ?case using 1(1)[rule_format, OF A1] inf_hidden[of A "t@[c]", rotated, OF A3]
-      by (metis (no_types, lifting) append.right_neutral append_T_imp_tickFree 
-                                    front_tickFree_Nil is_processT5_S7 not_Cons_self2 rangeE)
-  qed
-next
-  case 6 thus ?case
-  proof (auto, goal_cases)
-    case (1 s X t)
-    hence "front_tickFree t" by (simp add:is_processT2)
-    with 1(1) obtain t' where A:"t = t'@[tick]"
-      by (metis filter_is_subset nonTickFree_n_frontTickFree non_tickFree_tick 
-          subset_iff tickFree_append tickFree_def)
-    with 1(1,2) have B:"s = trace_hide t' (ev ` A)" 
-      by (auto simp add:tickFree_def split:if_splits)
-    with A 1(1,2) is_processT6[of P, THEN spec, THEN spec, of t' "X \<union> ev ` A"] 
-         is_processT4_empty[of t "ev ` A" P] show ?case
-    by (auto simp add: Un_Diff split:if_splits) 
   next
-    case (2 s X t u) 
-    then obtain u' where A:"u = u'@[tick]"
-      by (metis filter_is_subset nonTickFree_n_frontTickFree non_tickFree_tick           
-          subset_iff tickFree_append tickFree_def)
-     with 2(3) have B:"s = trace_hide t (ev ` A) @ u'" 
-       by (auto simp add:tickFree_def split:if_splits)
-     with 2(1,2,5) 2(4)[THEN spec, THEN spec, of t u'] show ?case
-       using front_tickFree_dw_closed A by blast
+    case 4 thus ?case
+      by (auto, metis (mono_tags) Un_subset_iff is_processT4 sup.cobounded2 sup.coboundedI1)
   next
-    case (3 s X u f x)
-    then obtain u' where A:"u = u'@[tick]"
-      by (metis filter_is_subset nonTickFree_n_frontTickFree non_tickFree_tick           
-          subset_iff tickFree_append tickFree_def)
-     with 3(3) have B:"s = trace_hide (f x) (ev ` A) @ u'" 
-       by (auto simp add:tickFree_def split:if_splits)
-     with 3(1,2,3,5,6,7) 3(4)[THEN spec, THEN spec, of "f x" u'] show ?case
-       using front_tickFree_dw_closed[of u' "[tick]"] by auto
-  qed
-next
-  case 7 thus ?case using front_tickFree_append by (auto, blast +)
-next
-  case 8 thus ?case by simp
-next
-  case 9 thus ?case 
-  proof (intro allI impI, simp, elim exE, goal_cases)
-    case (1 s t u)
-    then obtain u' where "u = u'@[tick]"
-      by (metis Hiding_tickFree nonTickFree_n_frontTickFree non_tickFree_tick tickFree_append)
-    with 1 show ?case
-      apply(rule_tac x=t in exI, rule_tac x=u' in exI)
-      using front_tickFree_dw_closed by auto
+    case 5 thus ?case
+    proof(intro impI allI, auto, rule not_not[THEN iffD1], rule notI, simp, goal_cases)
+      case (1 X Y t)
+      from 1(3) 1(4)[THEN spec, of t, simplified] obtain c where A1:"c \<in> Y" and A2:"c \<notin> (ev`A)" 
+                                                             and A3:"t@[c] \<in> \<T> P"
+        using is_processT5_S7'[of t "X \<union> (ev`A)" P Y] by (metis UnCI sup_commute sup_left_commute)
+      hence "trace_hide t (ev ` A) @ [c] = trace_hide (t@[c]) (ev ` A)" by simp
+      thus ?case using 1(1)[rule_format, OF A1] inf_hidden[of A "t@[c]", rotated, OF A3]
+        by (metis (no_types, lifting) append.right_neutral append_T_imp_tickFree 
+                                      front_tickFree_Nil is_processT5_S7 not_Cons_self2 rangeE)
+    qed
+  next
+    case 6 thus ?case
+    proof (auto, goal_cases)
+      case (1 s X t)
+      hence "front_tickFree t" by (simp add:is_processT2)
+      with 1(1) obtain t' where A:"t = t'@[tick]"
+        by (metis filter_is_subset nonTickFree_n_frontTickFree non_tickFree_tick 
+            subset_iff tickFree_append tickFree_def)
+      with 1(1,2) have B:"s = trace_hide t' (ev ` A)" 
+        by (auto simp add:tickFree_def split:if_splits)
+      with A 1(1,2) is_processT6[of P, THEN spec, THEN spec, of t' "X \<union> ev ` A"] 
+           is_processT4_empty[of t "ev ` A" P] show ?case
+      by (auto simp add: Un_Diff split:if_splits) 
+    next
+      case (2 s X t u) 
+      then obtain u' where A:"u = u'@[tick]"
+        by (metis filter_is_subset nonTickFree_n_frontTickFree non_tickFree_tick           
+            subset_iff tickFree_append tickFree_def)
+       with 2(3) have B:"s = trace_hide t (ev ` A) @ u'" 
+         by (auto simp add:tickFree_def split:if_splits)
+       with 2(1,2,5) 2(4)[THEN spec, THEN spec, of t u'] show ?case
+         using front_tickFree_dw_closed A by blast
+    next
+      case (3 s X u f x)
+      then obtain u' where A:"u = u'@[tick]"
+        by (metis filter_is_subset nonTickFree_n_frontTickFree non_tickFree_tick           
+            subset_iff tickFree_append tickFree_def)
+       with 3(3) have B:"s = trace_hide (f x) (ev ` A) @ u'" 
+         by (auto simp add:tickFree_def split:if_splits)
+       with 3(1,2,3,5,6,7) 3(4)[THEN spec, THEN spec, of "f x" u'] show ?case
+         using front_tickFree_dw_closed[of u' "[tick]"] by auto
+    qed
+  next
+    case 7 thus ?case using front_tickFree_append by (auto, blast +)
+  next
+    case 8 thus ?case by simp
+  next
+    case 9 thus ?case 
+    proof (intro allI impI, simp, elim exE, goal_cases)
+      case (1 s t u)
+      then obtain u' where "u = u'@[tick]"
+        by (metis Hiding_tickFree nonTickFree_n_frontTickFree non_tickFree_tick tickFree_append)
+      with 1 show ?case
+        apply(rule_tac x=t in exI, rule_tac x=u' in exI)
+        using front_tickFree_dw_closed by auto
+    qed
   qed
 qed
 
-lemma Rep_Abs_Hiding: "Rep_process (Abs_process 
-                                  ({(s,X). \<exists> t. s = trace_hide t (ev`A) \<and> (t,X \<union> (ev`A)) \<in> \<F> P} \<union>
-                                   {(s,X). s \<in> div_hide P A}, div_hide P A))
-                                  = ({(s,X). \<exists> t. s = trace_hide t (ev`A) \<and> (t,X \<union> (ev`A)) \<in> \<F> P} \<union>
-                                     {(s,X). s \<in> div_hide P A}, div_hide P A)"
-  by (simp only:CollectI Rep_process Abs_process_inverse Hiding_maintains_is_process)
 
 subsection\<open>Projections\<close>
 
 lemma F_Hiding: \<open>\<F> (P \ A) = {(s,X). \<exists> t. s = trace_hide t (ev`A) \<and> (t,X \<union> (ev`A)) \<in> \<F> P} \<union>
                               {(s,X). s \<in> div_hide P A}\<close>
-  by (subst Failures_def, simp only: Hiding_def Rep_Abs_Hiding FAILURES_def fst_conv)
+  by (simp add: Failures.rep_eq Hiding.rep_eq FAILURES_def)
 
 lemma D_Hiding: \<open>\<D> (P \ A) = div_hide P A\<close>
-  by (subst D_def, simp only: Hiding_def Rep_Abs_Hiding DIVERGENCES_def snd_conv)
+  by (simp add: Divergences.rep_eq Hiding.rep_eq DIVERGENCES_def)
 
 lemma T_Hiding: \<open>\<T> (P \ A) = {s. \<exists>t. s = trace_hide t (ev`A) \<and>  (t, ev`A) \<in> \<F> P} \<union> div_hide P A\<close>
-  apply (unfold Traces_def, simp only:Rep_Abs_Hiding Hiding_def TRACES_def FAILURES_def fst_conv, auto)
-     apply (metis is_processT sup.cobounded2)
-    apply (metis FAILURES_def Failures_def NF_NT range_eqI)
-   apply (metis sup.idem)
-  by (metis FAILURES_def F_T Failures_def range_eqI)
+  by (auto simp add: Traces.rep_eq TRACES_def Failures.rep_eq[symmetric] F_Hiding)
+     (metis is_processT4 sup_ge2, metis sup_bot_left)
+ 
 
 subsection\<open>Continuity Rule\<close>
 
 lemma mono_Hiding[simp]: \<open>(P::'a process) \<sqsubseteq> Q \<Longrightarrow> (P \ A) \<sqsubseteq> (Q \ A)\<close>
 proof (auto simp only:le_approx_def D_Hiding Ra_def F_Hiding T_Hiding, goal_cases)
   case (1 t u) thus ?case by blast
 next
   case (2 u f xa) thus ?case 
     apply(rule_tac x="f xa" in exI, rule_tac x=u in exI)
     by (metis D_T Ra_def le_approx2T le_approx_def rangeI)
 next
   case (3 x t) 
   hence A:"front_tickFree t" by (meson is_processT2)
   show ?case 
   proof(cases "tickFree t")
     case True thus ?thesis
       by (metis "3"(2) "3"(4) "3"(5) "3"(6) front_tickFree_charn mem_Collect_eq self_append_conv)
   next
     case False
     with A obtain t' where "t = t'@[tick]" using nonTickFree_n_frontTickFree by blast
     with 3 show ?thesis
       by (metis (no_types, lifting) filter.simps(1) filter.simps(2) front_tickFree_mono
           front_tickFree_Nil filter_append is_processT9 list.distinct(1) local.A mem_Collect_eq)
   qed
 next
   case (4 x t) thus ?case using NF_ND by blast
 next
   case (5 x t u) thus ?case by blast 
 next
   case (6 x u f xa) thus ?case by (metis D_T Ra_def le_approx2T le_approx_def rangeI)
 next
   case (7 x)
   from 7(4) have A:"x \<in> min_elems (div_hide P A)" by simp
   from elem_min_elems[OF 7(4), simplified] obtain t u 
     where B1:"x = trace_hide t (ev ` A) @ u" and B2:"tickFree t" and B3:"front_tickFree u" and 
              B4:"(t \<in> \<D> P \<or> (\<exists>(f:: nat \<Rightarrow> 'a event list). strict_mono f \<and> (\<forall>i. f i \<in> \<T> P) \<and>
              (\<forall>i. trace_hide (f i) (ev ` A) = trace_hide (f 0) (ev ` A)) \<and> t \<in> range f))" by blast
   show ?case proof(cases "t \<in> \<D> P")
     case True
     then obtain t' t'' where C1:"t'@t''=t" and C2:"t' \<in> min_elems (\<D> P)" by (metis min_elems_charn)
     hence C3:"trace_hide t' (ev ` A) \<in> div_hide P A" 
       apply (simp, rule_tac x=t' in exI, rule_tac x="[]" in exI, simp)
       using B2 elem_min_elems tickFree_append by blast 
     from C1 B1 have D1:"trace_hide t' (ev ` A) @ trace_hide t'' (ev ` A) = trace_hide t (ev ` A)"
       by fastforce
     from B1 C1 D1 min_elems_no[OF A C3] have E1:"x=trace_hide t' (ev ` A)"
       by (metis (no_types, lifting) append.assoc le_list_def)
     with B1 B2 B3 C1 D1 7(5)[simplified, rule_format, of "t'" "[]"] 
       have E2:"(\<forall>(f:: nat \<Rightarrow> 'a event list). strict_mono f \<longrightarrow> (\<exists>i. f i \<notin> \<T> Q) \<or>
               (\<exists>i. trace_hide (f i) (ev ` A) \<noteq> trace_hide (f 0) (ev ` A)) \<or> t' \<notin> range f)"
       apply simp
       using front_tickFree_append Hiding_tickFree tickFree_append by blast
     with E1 7(3) C2 inf_hidden[of A t' Q] show ?thesis 
       by (metis (no_types, lifting) contra_subsetD)
   next
     case False
     from B1 B2 B3 B4 have  C:"trace_hide t (ev ` A) \<in> div_hide P A"
       by (simp, rule_tac x=t in exI, rule_tac x="[]" in exI, simp)
     from B1 min_elems_no[OF A C] have E1:"x=trace_hide t (ev ` A)"
       using le_list_def by auto
     from B4 False 7(2)[rule_format, of t, OF False] have "t \<in> \<T> Q" using F_T T_F by blast
     with E1 7(5)[simplified, rule_format, of t "[]", simplified, OF E1 B2] inf_hidden[of A t Q] show ?thesis
       by metis
   qed
 qed
 
 lemma cont_Hiding1 :\<open>chain Y \<Longrightarrow> chain (\<lambda> i. (Y i \ A))\<close>
   by (simp add: po_class.chain_def)
 
 lemma KoenigLemma: 
   assumes *:"infinite (Tr::'a list set)" and **:"\<forall>i. finite{t. \<exists>t'\<in>Tr. t = take i t'}"
   shows "\<exists>(f::nat \<Rightarrow> 'a list). strict_mono f \<and> range f \<subseteq> {t. \<exists>t'\<in>Tr. t \<le> t'}"
 proof -
   define Tr' where "Tr' = {t. \<exists>t'\<in>Tr. t \<le> t'}" (* prefix closure *)
   have a:"infinite Tr'"
     by (metis (mono_tags, lifting) * Tr'_def infinite_super mem_Collect_eq order_refl subsetI) 
   { fix i
     have "{t \<in> Tr'. length t = i} \<subseteq> {t. \<exists>t'\<in>Tr. t = take i t'}" 
       by (auto simp add:Tr'_def, metis append_eq_conv_conj le_list_def)
     with ** have "finite({t\<in>Tr'. length t = i})" using infinite_super by blast     
   } note b=this
   { fix t
     define E where "E = {e |e. t@[e]\<in> Tr'}" 
     have aa:"finite E"
       proof - 
         have "inj_on (\<lambda>e. t @ [e]) E" by (simp add: inj_on_def)
         
         with b[of "Suc (length t)"] inj_on_finite[of "\<lambda>e. t@[e]" E "{t' \<in> Tr'. length t' = Suc (length t)}"]
         show ?thesis  by (simp add: E_def image_Collect_subsetI)
       qed 
     hence bb:"finite {t@[e] |e. e\<in>E}" by simp
     have "{t'\<in>Tr'. t < t'} = {t@[e] |e. e\<in>E} \<union> (\<Union>e\<in>E. {t'\<in>Tr'. t@[e] < t'})"
       proof (auto simp add:Let_def E_def Tr'_def, goal_cases)
         case (1 x xa)
         then obtain u e where "x = t @ [e] @ u"
           by (metis A append_Cons append_Nil append_Nil2 le_list_def list.exhaust) 
         with 1 1(4)[rule_format, of e] show ?case by (metis append_assoc le_list_def less_list_def)
       next
         case (2 x xa xb xc)
         thus ?case by (meson less_self less_trans) 
       qed     
     with aa bb have "infinite {t'\<in>Tr'. t < t'} \<Longrightarrow> \<exists>e. infinite {t'\<in>Tr'. t@[e] < t'}" by auto
   } note c=this
   define ff where d:"ff =rec_nat [] (\<lambda>i t. (let e = SOME e. infinite {t'\<in>Tr'. t@[e] < t'} in t @ [e]))"
   hence dd:"\<forall>n. ff (Suc n) > ff n" by simp (* funny *)
   hence e:"strict_mono ff" by (simp add: lift_Suc_mono_less strict_monoI)
   { fix n
     have "ff n \<in> Tr' \<and> infinite {t' \<in> Tr'. ff n < t'}" 
     proof(induct n)
       case 0
       from a Tr'_def have  "Tr' = {t' \<in> Tr'. [] < t'} \<union> {[]}" by (auto simp add: le_neq_trans)
       with a have "infinite {t' \<in> Tr'. [] < t'}"
         by (metis (no_types, lifting) finite.emptyI finite.insertI finite_UnI)
       with d Tr'_def show ?case by auto        
     next
       case (Suc n)
       from d have "ff (Suc n) = (let e = SOME e. infinite {t'\<in>Tr'. ff n@[e] < t'} in ff n @ [e])" by simp 
       with c[rule_format, of "ff n"] obtain e where 
         a1:"ff (Suc n) = (ff n) @ [e] \<and> infinite {t' \<in> Tr'. ff n @ [e] < t'}"
         by (metis (no_types, lifting) Suc.hyps someI_ex)
       then obtain i where "i \<in> Tr' \<and> ff (Suc n) < i" using not_finite_existsD by auto 
       with Tr'_def have "ff (Suc n) \<in> Tr'" using dual_order.trans less_imp_le by fastforce
       with a1 show ?case by simp
     qed
   } note g=this
   hence h:"range ff \<subseteq> Tr'" by auto
   show ?thesis using Tr'_def e h by blast
 qed
 
 lemma div_Hiding_lub :  
    \<open>finite (A::'a set) \<Longrightarrow> chain Y \<Longrightarrow> \<D> (\<Squnion> i. (Y i \ A)) \<subseteq> \<D> ((\<Squnion> i. Y i) \ A)\<close>
 proof (auto simp add:limproc_is_thelub cont_Hiding1 D_Hiding T_Hiding D_LUB T_LUB, goal_cases)
   case (1 x)
   { fix xa t u f
     assume a:"front_tickFree u \<and> tickFree t \<and> x = trace_hide t (ev ` A) @ u \<and>
               isInfHiddenRun f (Y xa) A \<and> (\<forall> i. f i \<notin> \<D> (Y xa)) \<and> t \<in> range f"
     hence "(\<forall>i n. f i \<in> \<T> (Y n))" using 1(2) NT_ND chain_lemma le_approx2T by blast
     with a have ?case by blast
   } note aa=this 
   { fix xa t u f j
     assume a:"front_tickFree u \<and> tickFree t \<and> x = trace_hide t (ev ` A) @ u \<and> 
               isInfHiddenRun f (Y xa) A \<and> (f j \<in> \<D> (Y xa)) \<and> t \<in> range f"
     hence "\<exists>t u. front_tickFree u \<and> tickFree t \<and> x = trace_hide t (ev ` A) @ u \<and> t \<in> \<D> (Y xa)"
       apply(rule_tac x="f j" in exI, rule_tac x=u in exI) 
       using Hiding_tickFree[of "f j" A] Hiding_tickFree[of t A] by (metis imageE)
   } note bb=this
   have cc: "\<forall>xa. \<exists>t u. front_tickFree u \<and> tickFree t \<and> x = trace_hide t (ev ` A) @ u \<and> t \<in> \<D>(Y xa)
            \<Longrightarrow> ?case" (is "\<forall>xa. \<exists>t. ?S t xa \<Longrightarrow> ?case")
     proof -
       assume dd:"\<forall>xa. \<exists>t u. front_tickFree u \<and> tickFree t \<and> x = trace_hide t (ev ` A) @ u \<and> t \<in> \<D>(Y xa)"
              (is "\<forall>xa. \<exists>t. ?S t xa")
       define f where "f = (\<lambda>n. SOME t. ?S t n)"
       thus ?case 
       proof (cases "finite(range f)")
         case True
         obtain t where gg:"infinite (f -` {t})" using f_def True inf_img_fin_dom by blast 
         then obtain k where "f k = t" using finite_nat_set_iff_bounded_le by blast
         then obtain u where uu:"front_tickFree u \<and> x = trace_hide t (ev ` A) @ u \<and> tickFree t"
           using f_def dd[rule_format, of k] some_eq_ex[of "\<lambda>t. ?S t k"] by blast
         { fix m
           from gg obtain n where gg:"n \<ge> m \<and> n \<in> (f -` {t})"
             by (meson finite_nat_set_iff_bounded_le nat_le_linear)
           hence "t \<in> \<D> (Y n)" using f_def dd[rule_format, of n] some_eq_ex[of "\<lambda>t. ?S t n"] by auto
           with gg 1(2) have "t \<in> \<D> (Y m)" by (meson contra_subsetD le_approx_def po_class.chain_mono)
         }
         with gg uu show ?thesis by blast
       next
         case False
         { fix t
           assume "t \<in> range f"
           then obtain k where "f k = t" using finite_nat_set_iff_bounded_le by blast
           then obtain u where uu:"front_tickFree u \<and> x = trace_hide t (ev ` A) @ u \<and> tickFree t"
             using f_def dd[rule_format, of k] some_eq_ex[of "\<lambda>t. ?S t k"] by blast
           hence "set t \<subseteq> set x \<union> (ev ` A)" by auto
         } note ee=this
         { fix i
           have "finite {(take i t)|t. t \<in> range f}" 
           proof(induct i, simp)
             case (Suc i)
             have ff:"{take (Suc i) t|t. t \<in> range f} \<subseteq> {(take i t)|t. t \<in> range f} \<union>
                         (\<Union>e\<in>(set x \<union> (ev ` A)). {(take i t)@[e]|t. t \<in> range f})" (is "?AA \<subseteq> ?BB")
               proof
                 fix t
                 assume "t \<in> ?AA"
                 then obtain t' where hh:"t' \<in> range f \<and> t = take (Suc i) t'" 
                   using finite_nat_set_iff_bounded_le by blast
                 with ee[of t'] show "t \<in> ?BB"
                   proof(cases "length t' > i")
                     case True
                     hence ii:"take (Suc i) t' = take i t' @ [t'!i]" by (simp add: take_Suc_conv_app_nth)
                     with ee[of t'] have "t'!i \<in> set x \<union> (ev ` A)" 
                       by (meson True contra_subsetD hh nth_mem)
                     with ii hh show ?thesis by blast
                   next
                     case False
                     hence "take (Suc i) t' = take i t'" by fastforce
                     with hh show ?thesis by auto
                   qed
               qed
             { fix e 
               have "{x @ [e] |x. \<exists>t. x = take i t \<and> t \<in> range f} = {take i t' @ [e] |t'. t' \<in> range f}"
                 by auto
               hence "finite({(take i t') @ [e] |t'. t'\<in>range f})"
                 using finite_image_set[of _ "\<lambda>t. t@[e]", OF Suc] by auto 
             } note gg=this
             have "finite(set x \<union> (ev ` A))" using 1(1) by simp
             with ff gg Suc show ?case by (metis (no_types, lifting) finite_UN finite_Un finite_subset)
           qed
         } note ff=this
         hence "\<forall>i. {take i t |t. t \<in> range f} = {t. \<exists>t'. t = take i (f t')}" by auto
         with KoenigLemma[of "range f", OF False] ff
         obtain f' where gg:"strict_mono (f':: nat \<Rightarrow> 'a event list) \<and> 
                                             range f' \<subseteq> {t. \<exists>t'\<in>range f. t \<le> t'}" by auto
         { fix n
           define M where "M = {m. f' n \<le> f m }"
           assume "finite M"
           hence l1:"finite {length (f m)|m. m \<in> M}" by simp
           obtain lm where l2:"lm = Max {length (f m)|m. m \<in> M}" by blast
           { fix k
             have "length (f' k) \<ge> k" 
               by(induct k, simp, metis (full_types) gg lessI less_length_mono linorder_not_le 
                                         not_less_eq_eq order_trans strict_mono_def)
           }
           with gg obtain m where r1:"length (f' m) > lm" by (meson lessI less_le_trans)
           from gg obtain r where r2:"f' (max m n) \<le> f r" by blast
           with gg have r3: "r \<in> M" 
             by (metis (no_types, lifting) M_def max.bounded_iff mem_Collect_eq order_refl 
                                           order_trans strict_mono_less_eq)
           with l1 l2 have f1:"length (f r) \<le> lm" using Max_ge by blast
           from r1 r2 have f2:"length (f r) > lm"
             by (meson dual_order.strict_trans1 gg le_length_mono max.bounded_iff order_refl 
                       strict_mono_less_eq) 
           from f1 f2 have False by simp
         } note ii=this
         { fix i n
           from ii obtain m where jj:"m \<ge> n \<and> f m \<ge> f' i" 
             by (metis finite_nat_set_iff_bounded_le mem_Collect_eq nat_le_linear)
           have kk: "(f m) \<in> \<D> (Y m)" using f_def dd[rule_format, of m] some_eq_ex[of "\<lambda>t. ?S t m"] by auto 
           with jj gg have "(f' i) \<in> \<T> (Y m)" by (meson D_T is_processT3_ST_pref)
           with jj 1(2) have  "(f' i) \<in> \<T> (Y n)" using D_T le_approx2T po_class.chain_mono by blast
         } note jj=this
         from gg have kk:"mono (\<lambda>n. trace_hide (f' n) (ev ` A))" 
           unfolding strict_mono_def mono_def
           by (metis (no_types, lifting) filter_append gg le_list_def mono_def strict_mono_mono)
         { fix n
           from gg obtain k r where "f k = f' n @ r" by (metis ii le_list_def not_finite_existsD)
           hence "trace_hide (f' n) (ev ` A) \<le> x" 
             using f_def dd[rule_format, of k] some_eq_ex[of "\<lambda>t. ?S t k"] le_list_def by auto blast
         } note ll=this
         { assume llll:"\<forall>m. \<exists>n. trace_hide (f' n) (ev ` A) > trace_hide (f' m) (ev ` A)"
           hence lll:"\<forall>m. \<exists>n. length (trace_hide (f' n) (ev ` A)) > length (trace_hide (f' m) (ev ` A))"
             using less_length_mono by blast
           define ff where lll':"ff = rec_nat (length (trace_hide (f' 0) (ev ` A))) 
                 (\<lambda>i t. (let n = SOME n. (length (trace_hide (f' n) (ev ` A))) > t 
                          in length (trace_hide (f' n) (ev ` A))))"
           { fix n
             from lll' lll[rule_format, of n] have "ff (Suc n) > ff n" 
               apply simp apply (cases n)
               apply (metis (no_types, lifting) old.nat.simps(6) someI_ex)
               by (metis (no_types, lifting) llll less_length_mono old.nat.simps(7) someI_ex)
           } note lll''=this
           with lll'' have "strict_mono ff" by (simp add: lll'' lift_Suc_mono_less strict_monoI)
           hence lll''':"infinite(range ff)" using finite_imageD strict_mono_imp_inj_on by auto
           from lll lll' have "range ff \<subseteq> range (\<lambda>n. length (trace_hide (f' n) (ev ` A)))" 
             by (auto, metis (mono_tags, lifting) old.nat.exhaust old.nat.simps(6) old.nat.simps(7) range_eqI)
           with lll''' have "infinite (range (\<lambda>n. length (trace_hide (f' n) (ev ` A))))"
             using finite_subset by auto
           hence "\<exists>m. length (trace_hide (f' m) (ev ` A)) > length x"
             using finite_nat_set_iff_bounded_le by (metis (no_types, lifting) not_less rangeE)
           with ll have False using le_length_mono not_less by blast
         }
         then obtain m where mm:"\<forall>n. trace_hide (f' n) (ev ` A) \<le> trace_hide (f' m) (ev ` A)"
           by (metis (mono_tags, lifting) A kk le_cases mono_def)
         with gg obtain k where nn:"f k \<ge> f' m" by blast
         then obtain u where oo:"front_tickFree u \<and> x = trace_hide (f' m) (ev ` A) @ u \<and> tickFree (f' m)"
           using f_def dd[rule_format, of k] some_eq_ex[of "\<lambda>t. ?S t k"] 
           by (auto, metis (no_types, lifting) contra_subsetD filter_is_subset front_tickFree_append 
                           front_tickFree_mono le_list_def ll tickFree_Nil tickFree_append 
                           tickFree_def tickFree_implies_front_tickFree)        
         show ?thesis
           apply(rule_tac x="f' m" in exI, rule_tac x=u in exI)
           apply(simp add:oo, rule disjI2, rule_tac x="\<lambda>n. f' (n + m)" in exI)
           using gg jj kk mm apply (auto simp add: strict_mono_def dual_order.antisym mono_def)
           by (metis plus_nat.add_0 rangeI)
       qed
     qed
   show ?case 
   proof (cases "\<exists> xa t u f. front_tickFree u \<and> tickFree t \<and> (\<forall> i. f i \<notin> \<D> (Y xa)) \<and> t \<in> range f \<and>
                             x = trace_hide t (ev ` A) @ u \<and> isInfHiddenRun f (Y xa) A")
     case True
     then show ?thesis using aa by blast
   next
     case False
     have dd:"\<forall>xa. \<exists>t u. front_tickFree u \<and> tickFree t \<and> x = trace_hide t (ev ` A) @ u \<and>
              (t \<in> \<D> (Y xa) \<or> (\<exists>f. isInfHiddenRun f (Y xa) A \<and> (\<exists>i. f i \<in> \<D> (Y xa)) \<and> t \<in> range f))" 
             (is "\<forall>xa. ?dd xa")
       proof (rule_tac allI)
         fix xa
         from 1(3) obtain t u where 
               "front_tickFree u \<and> tickFree t \<and> x = trace_hide t (ev ` A) @ u \<and>
               (t \<in> \<D> (Y xa) \<or> (\<exists>f. isInfHiddenRun f (Y xa) A \<and> t \<in> range f))" 
           by blast
         thus "?dd xa"
           apply(rule_tac x=t in exI, rule_tac x=u in exI, intro conjI, simp_all, elim conjE disjE, simp_all)
           using 1(1) False NT_ND chain_lemma le_approx2T by blast
       qed
     hence ee:"\<forall>xa. \<exists>t u. front_tickFree u \<and> tickFree t \<and> x = trace_hide t (ev ` A) @ u \<and> t \<in> \<D>(Y xa)"
       using bb by blast
     with cc show ?thesis by simp
   qed
 qed
 
 lemma cont_Hiding2 : \<open>finite A \<Longrightarrow> chain Y \<Longrightarrow> ((\<Squnion> i. Y i) \ A) = (\<Squnion> i. (Y i \ A))\<close>
 proof(auto simp add:limproc_is_thelub cont_Hiding1 Process_eq_spec 
                     D_Hiding Ra_def F_Hiding T_Hiding F_LUB  D_LUB T_LUB, goal_cases)
   case (1 b x t u) thus ?case by blast
 next
   case (2 b x u f xa) thus ?case by blast
 next
   case (3 s X)
   hence \<open>s \<notin> \<D> ((\<Squnion> i. Y i) \ A)\<close>
     by (simp add:limproc_is_thelub cont_Hiding1 F_LUB  D_LUB T_LUB D_Hiding)
   with 3(1,2) obtain n where a: \<open>s \<notin> \<D> (Y n \ A)\<close>
     by (metis (no_types, lifting) D_LUB_2 div_Hiding_lub subsetCE limproc_is_thelub cont_Hiding1) 
   with 3(3) obtain t where b:"s = trace_hide t (ev ` A) \<and> (t, X \<union> ev ` A) \<in> \<F> (Y n)" 
     unfolding D_Hiding by blast
   hence c:"front_tickFree t" using is_processT2 by blast
   have d:"t \<notin> \<D>(Y n)"
     proof(cases "tickFree t")
       case True
       with a b show ?thesis using front_tickFree_Nil 
         by (simp add: D_Hiding)
     next
       case False
       with c obtain t' where "t = t'@[tick]" using nonTickFree_n_frontTickFree by blast
       with a b show ?thesis
         apply(simp add: D_Hiding, erule_tac x=t' in allE, erule_tac x="[tick]" in allE, simp)
         by (metis event.distinct(1) filter.simps(1) front_tickFree_implies_tickFree imageE is_processT)
     qed
     with b show ?case using 3(2) NF_ND chain_lemma proc_ord2a by blast   
 next
   case (4 xa t u) thus ?case by blast
 next
   case (5 xa u f xb) thus ?case by blast
 next
   case (6 s)
   hence \<open>s \<in> \<D> (\<Squnion> i. (Y i \ A))\<close>
     by (simp add:limproc_is_thelub cont_Hiding1 6(1) D_Hiding D_LUB)
   with div_Hiding_lub[OF 6(1,2)] have  \<open>s \<in> \<D> ((\<Squnion>i. Y i) \ A)\<close> by blast
   thus ?case by (simp add:limproc_is_thelub 6(2) D_Hiding D_LUB T_LUB)
 qed
 
 lemma cont_Hiding_base[simp] : \<open>finite A \<Longrightarrow> cont (\<lambda>x. x \ A)\<close>
   by (simp add: cont_def cont_Hiding1 cont_Hiding2 cpo_lubI)
 
 lemma Hiding_cont[simp]:  \<open>finite A \<Longrightarrow> cont f \<Longrightarrow> cont (\<lambda>x. f x \ A)\<close>
   by (rule_tac f=f in cont_compose, simp_all)
 
 end
\ No newline at end of file
diff --git a/thys/HOL-CSP/Introduction.thy b/thys/HOL-CSP/Introduction.thy
--- a/thys/HOL-CSP/Introduction.thy
+++ b/thys/HOL-CSP/Introduction.thy
@@ -1,314 +1,316 @@
 (*<*)
 \<comment>\<open> ********************************************************************
  * Project         : HOL-CSP - A Shallow Embedding of CSP in  Isabelle/HOL
  * Version         : 2.0
  *
  * Author          : Burkhart Wolff, Safouan Taha, Lina Ye.
  *                   (Based on HOL-CSP 1.0 by Haykal Tej and Burkhart Wolff)
  *
  * This file       : A Combined CSP Theory
  *
  * Copyright (c) 2009 Université Paris-Sud, France
  * Copyright (c) 2023 Université Paris-Saclay, France
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials provided
  *       with the distribution.
  *
  *     * Neither the name of the copyright holders nor the names of its
  *       contributors may be used to endorse or promote products derived
  *       from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  ******************************************************************************\<close>
 (*>*)
 
 chapter\<open>Context\<close>
 (*<*)
 theory Introduction
   imports HOLCF
 begin
 (*>*)
 
 section\<open>Preface\<close>
 text\<open>
    This is a formalization in Isabelle/HOL of the work of Hoare and Roscoe
    on the denotational semantics of the Failure/Divergence Model of CSP. 
    It follows essentially the presentation of CSP in Roscoe's
    Book "Theory and Practice of Concurrency" @{cite "roscoe:csp:1998" }
    and the semantic details in a joint Paper of Roscoe and Brooks
    "An improved failures model for communicating processes"
    @{cite "brookes-roscoe85"}.
 
    The original version of this formalization, called HOL-CSP 1.0 
    @{cite "tej.ea:corrected:1997"}, revealed minor, but omnipresent foundational errors
    in key concepts like the process invariant. A correction was
    proposed slightly before the apparition of Roscoe's book (all three authors  were
    in e-mail contact at that time).
 \<close>
 
 text\<open>
   In recent years, a team of authors undertook the task to port HOL-CSP 1.0
   to modern Isabelle/HOL and structured proof techniques. This results in the
   present version are called HOL-CSP 2.0.
  
   The effort is motivated by the following assets of CSP:
   \<^item> the theory is interesting in itself, and reworking its formal
     structure might help to make it more widely accessible, given
     that it is a particularly advanced example of the shallow embedding
     technique using the denotational semantics of a language,
   \<^item> it is interesting to \<^emph>\<open>compare\<close> the ancient, imperative, ML-heavy 
     proof style to the more recent declarative one in Isabelle/Isar;
     this comparison (not presented here) gives a source of empirical
     evidence that such proofs are more stable wrt. the constant
     changes in the Isabelle itself,
   \<^item> the \<^emph>\<open>semantic\<close> presentation of CSP lends itself to a semantically
     clean and well-understood \<^emph>\<open>combination\<close> of specification languages,
     which represents a major step to our longterm goal of heterogenuous,
     yet semantically clean system specifications consisting of
     different formalisms describing components or system aspects separately,
   \<^item> the resulting HOL-CSP environment could one day be used as a tool that 
     certifies traces of other CSP model-checkers such as FDR4 or PAT.
 \<close>
 
 text\<open> 
   In contrast to HOL-CSP 1.0, which came with
   an own fixpoint theory partly inspired by previous work of Alberto Camilieri under 
   HOL4 @{cite"Camilleri91"}, it is the goal of the redesign of HOL-CSP 2.0  to reuse 
   the HOLCF theory  that emmerged from Franz Regensburgers work and was substantially 
   extended by Brian Huffman. Thus, the footprint of the HOL-CSP 2.0
   theory should be reduced drastically. Moreover, all proofs
   have been heavily revised or re-constructed to reflect the
   drastically improved state of the art of interactive
   theory development with Isabelle. \<close>
 
 section\<open>Introduction\<close>
 text\<open>DRAWN FROM THE PAPER @{cite "tej.ea:corrected:1997"}\<close>
 text\<open>
   In his invited lecture at FME'96, C.A.R. Hoare presented his view on the status 
   quo of formal methods in industry. With respect to formal proof methods, he ruled 
   that they "are now sufficiently advanced that a [...] formal methodologist could 
   occasionally detect [...] obscure latent errors before they occur in practice" 
   and asked for their publication as a possible "milestone in the acceptance of formal 
   methods" in industry.
   
   In this paper, we report of a larger verification effort as part of the  UniForM project 
   @{cite "KriegBrueckner95"}. It revealed an obscure latent error that was not detected 
   within a decade. It cannot be said that the object of interest is a "large software 
   system" whose failure may "cost millions", but it is a well-known subject in the center 
   of academic interest considered foundational for several formal methods tools: the 
   theory of the failure- divergence model of CSP (@{cite "Hoare:1985:CSP:3921"}, 
   @{cite "brookes-roscoe85"}). And indeed we hope that this work may further encourage the use 
   of formal proof methods at least in the academic community working on formal methods.
   
   Implementations of proof support for a formal method can roughly be divided into two 
   categories. In direct tools like FDR @{cite "FDRTutorial2000"}, the logical rules of a 
   method (possibly integrated into complex proof techniques) are hard-wired into the code of 
   their implementation. Such tools tend to be difficult to modify and to formally reason 
   about, but can possess enviable automatic proof power in specific problem domains 
   and comfortable user interfaces. 
 
   The other category can be labelled as logical embeddings. Formal methods such as CSP 
   or Z can be logically embedded into an LCF-style tactical theorem prover such as HOL 
   @{cite "gordon.ea:hol:1993"} or Isabelle@{cite "nipkow.ea:isabelle:2002"}. Coming with 
   an open system design going back to Milner, these provers allow for user-programmed 
   extensions in a logically sound way. Their  strength is flexibility, generality and 
   expressiveness that makes them to symbolic programming environments.
   
   In this paper we present a tool of the latter category (as a step towards a future 
   combination with the former). After a brief introduction into the failure divergence 
   semantics in the traditional CSP-literature, we will discuss the revealed problems 
   and present a correction. Although the error is not "mathematically deep", it stings 
   since its correction affects many definitions. It is shown that the corrected CSP 
   still fulfils the desired algebraic laws. The addition of fixpoint-theory and 
   specialised tactics extends the embedding in Isabelle/HOL to a formally proven 
   consistent proof environment for CSP. Its use is demonstrated in a final example.
 \<close>
 
 section\<open>An Outline of Failure-Divergence Semantics\<close>
 
 text\<open> 
   A very first approach to give denotational semantics to CSP is to view it as a kind 
   of a regular expression. This way, it can be understood as an automata and the 
   denotations are just the language of the automaton; this way, synchronization 
   and concurrency can be basically understood as the construction of a product automaton 
   with potential interleaving. The semantics becomes compositional, and internal communication
   between sub-components of a component can be modeled by the concealment operator. 
 
   Hoares work @{cite "Hoare:1985:CSP:3921"} was strongly inspired by this initial idea.
   However, it became quickly clear that the simplistic automata vision is not a satisfying
   paradigm for all aspects of concurrency. Particularly regarding the nature of communication,
   where one "sends" actively information and the other "receives" it, the bi-directional 
   product construction seems to be misleading. Furthermore, it is an obvious difference
   if a group of processes remains in a passive deadlock because all possible communications 
   contradict each other, or if a group of processes is too busy with internal chatter and
   never reaches the point where this component is again ready for communication. 
   
   Hoare solved these apparent problems by presenting a multi-layer approach, in which the
   denotational models were refined more and more allowing to distinguish the above 
   critical situations. An ingenious concept in the overall scheme is to distinguish
   \<^emph>\<open>non-deterministic\<close> choice from \<^emph>\<open>deterministic\<close> one \<^footnote>\<open>which in itself produces
   problems with recursion which had to be overcome by some restrictions on its use.\<close> in order to 
   solve the sender/receiver problem. 
 
   Hoare proposed 3 denotational semantics for CSP:
   \<^item> the \<^emph>\<open>trace\<close> model, which is basically the above naive automata model not allowing
     to distinguish non-deterministic choice from deterministic one, neither to distinguish deadlock 
     from infinite internal chatter,
   \<^item> the \<^emph>\<open>failure\<close> model is able to distinguish non-deterministic choice from deterministic one by 
     different maximum refusal sets, which is however cannot differentiate deadlock from infinite 
     internal chatter,   
   \<^item> the \<^emph>\<open>failure-divergence\<close> model overcomes additionally the unresolved problem of failure model.
 
 
 In the sequel, we explain these two problems in more detail, giving some
 motivation for the daunting complexity of the latter model.
 It is this complexity which finally raises general interest in a 
 formal verification.
 \<close>
 
 subsection\<open>Non-Determinism\<close>
 (*<*)
 consts dummyPrefix :: "'a::cpo \<Rightarrow> 'b::cpo \<Rightarrow> 'b::cpo"
 consts dummyDet :: "'a::cpo \<Rightarrow> 'b::cpo \<Rightarrow> 'b::cpo"
 consts dummyNDet :: "'a::cpo \<Rightarrow> 'b::cpo \<Rightarrow> 'b::cpo"
 consts dummyHide :: "'b::cpo \<Rightarrow> 'a \<Rightarrow> 'b::cpo"
 
 notation dummyPrefix (infixr  "\<rightarrow>" 50)
 notation dummyDet    (infixr  "\<box>" 50)
 notation dummyNDet   (infixr  "\<sqinter>" 50)
 notation dummyHide   (infixr  "\<setminus>" 50)
 (*>*)
 
 text\<open>
    Let a and b be any two events in some set of events @{term "\<Sigma>"}. The two processes
 
    \<^descr>    @{term   "(a \<rightarrow> Stop) \<box> (b \<rightarrow> Stop)"}   \hspace{7cm}            (1)
 
    and
 
    \<^descr>    @{term   "(a \<rightarrow> Stop) \<sqinter> (b \<rightarrow> Stop)"}  \hspace{7cm}            (2)
 
 
 \<close>
 text\<open>
    cannot be distinguished under the trace semantics, in which both processes 
    are capable of performing the same sequences of events, i.e. both have the 
    same set of traces @{term "{{},{a},{b}}"}. This is because both processes can either 
    engage in @{term "a"} and then @{term "Stop"}, or engage in @{term "b"} and 
    then @{term "Stop"}. We would, however, like to distinguish between @{term "a"} 
    \<^emph>\<open>deterministic\<close> choice of @{term "a"} or @{term "b"} (1) and @{term "a"} 
    \<^emph>\<open>non-deterministic\<close> choice of @{term "a"} or @{term "b"} (2).
    
    
    This can be done by considering the events that a process can refuse to engage 
    in when these events are offered by the environment; it cannot refuse either, 
    so we say its maximal refusal set is the set containing all elements of @{term "\<Sigma>"} other 
    than @{term "a"} and @{term "b"}, written @{term "\<Sigma>-{a,b}"}, i.e. it can 
    refuse all elements in @{term "\<Sigma>"} other than @{term "a"} or @{term "b"}. In the case 
    of the non-deterministic process (2), however, we wish to express that if the environment 
    offers the event @{term "a"} say, the process non-deterministically chooses either to engage in 
    @{term "a"}, to refuse it and engage in @{term "b"} (likewise for @{term "b"}). We say 
    therefore, that process (2) has two maximal refusal sets, @{term "\<Sigma>-{a}"} and 
    @{term "\<Sigma>-{b}"}, because it can refuse to engage in either @{term "a"} or 
    @{term "b"}, but not both. The notion of refusal sets is in this way used to distinguish 
    non-determinism from determinism in choices.
 \<close>
 
 subsection\<open>Infinite Chatter\<close>
 
 text\<open>
    Consider the infinite process @{term "\<mu> X. a \<rightarrow> X"}
    which performs an infinite stream of @{term "a"}'s. If one now conceals the event a in 
    this process by writing
    \<^descr>      @{term "(\<mu> X. a \<rightarrow> X) \<setminus> a"}    \hspace{7.8cm}            (3)
 \<close>   
 text\<open>
    it no longer becomes possible to distinguish the behaviour of this process 
    from that of the deadlock process Stop. We would like to be able to make such 
    a distinction, since the former process has clearly not stopped but is engaging 
    in an unbounded sequence of internal actions invisible to the environment. We say 
    the process has diverged, and introduce the notion of a divergence set to denote 
    all sequences events that can cause a process to diverge. Hence, the process Stop 
    is assigned the divergence set @{term "{}"}, since it can not diverge, whereas the process 
    (3) above diverges on any sequence of events since the process begins to diverge 
    immediately, i.e. its divergence set is @{term "\<Sigma>\<^sup>*"} , where @{term "\<Sigma>\<^sup>*"} denotes the 
    set of all  sequences with elements in @{term "\<Sigma>"}. Divergence is undesirable and so 
    it is essential to be able to express it to ensure that it is avoided.
 \<close>
 
 subsection\<open>The Global Architecture of HOL-CSP 2.0\<close>
 text\<open>
    The global architecture of HOL-CSP 2.0 has been substantially simplified compared 
    to HOL-CSP 1.0: the fixpoint reasoning is now entirely based on HOLCF (which meant that
    the continuity proofs for CSP operators had basically been re-done).\<close>
 
 text\<open>
    The theory \<^verbatim>\<open>Process\<close> establishes the basic common notions for events, traces, ticks and
    tickfree-ness, the type definitions for failures and divergences as well as the
    global constraints on them (called the "axioms" in Hoare's Book.) captured in a 
    predicate \<^verbatim>\<open>is_process\<close>. On this basis, the set of failures and divergences satisfying
    \<^verbatim>\<open>is_process\<close> is turned into the type \<^verbatim>\<open>'a process\<close> via a type-definition 
    (making \<^verbatim>\<open>is_process\<close> as the central data invariant). In the sequel, it is shown that
    \<^verbatim>\<open>'a process\<close> belongs to the type-class @{class "cpo"} stemming from @{theory HOLCF} which 
    makes  the concepts of complete partial order, continuity, fixpoint-induction and general 
    recursion available to all expressions of type \<^verbatim>\<open>'a process\<close>. \<close>
 
 text\<open> 
    The theory \<^verbatim>\<open>Process\<close> also establishes the two partial orderings @{term "P \<le> P'"} for 
    refinements and @{term "P \<sqsubseteq> P'"} for the approximation on processes used to give semantics
    to recursion. The latter is well-known to be logically weaker than the former.
    Note that, unfortunately, the use of these two symbols in HOL-CSP 2.0, where the 
    latter is already used in the @{theory HOLCF}-theory, is just the other way round as 
    in the literature. \<close>
 
 text\<open>
    Each CSP operator is described in an own theory which comprises:
    \<^item> The denotational core definition in terms of a pair of Failures and Divergences
    \<^item> The establishment of  \<^verbatim>\<open>is_process\<close> for the  Failures and Divergences in the
-     range of the given operator (thus, the invariance of  \<^verbatim>\<open>is_process\<close> for this operator)
+     range of the given operator (thus, the invariance of  \<^verbatim>\<open>is_process\<close> for this operator).
+     In this new version, the proof is required immediatly after the definition of the
+     operator since we use lift\_definition instead of definition
    \<^item> The proof of the projections \<^verbatim>\<open>T\<close> and  \<^verbatim>\<open>F\<close> and \<^verbatim>\<open>D\<close> for this operator
    \<^item> The proof of continuity of the operator (which is always possible except for
-     hide if applied to infinite hide-sets).\<close>
+     Hiding if applied to infinite hide-sets).\<close>
 
 text\<open>
    Finally, the theory CSP contains the "Laws" of CSP, i.e. the derived rules 
    allowing abstractly to reason over CSP processes. The overall dependency graph 
    is shown in \autoref{fig:fig1}.\<close>
 
 text\<open>
    \begin{figure}[ht]
    	\centering
      \includegraphics[width=0.9\textwidth]{session_graph}
    	\caption{The HOL-CSP 2.0 Theory Graph}
    	\label{fig:fig1}
    \end{figure}\<close>
 
 (*<*)
 no_notation dummyPrefix  (infixr  "\<rightarrow>" 50)
 no_notation dummyDet     (infixr  "\<box>" 50)
 no_notation dummyNDet    (infixr  "\<sqinter>" 50)
 no_notation dummyHide    (infixr  "\<setminus>" 50)
 
 end
 (*>*)
diff --git a/thys/HOL-CSP/Mndetprefix.thy b/thys/HOL-CSP/Mndetprefix.thy
--- a/thys/HOL-CSP/Mndetprefix.thy
+++ b/thys/HOL-CSP/Mndetprefix.thy
@@ -1,252 +1,235 @@
 (*<*)
 \<comment>\<open> ******************************************************************** 
  * Project         : HOL-CSP - A Shallow Embedding of CSP in  Isabelle/HOL
  * Version         : 2.0
  *
- * Author          : Burkhart Wolff, Safouan Taha, Lina Ye.
+ * Author          : Burkhart Wolff, Safouan Taha.
  *                   (Based on HOL-CSP 1.0 by Haykal Tej and Burkhart Wolff)
  *
  * This file       : A Combined CSP Theory
  *
  * Copyright (c) 2009 Université Paris-Sud, France
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials provided
  *       with the distribution.
  *
  *     * Neither the name of the copyright holders nor the names of its
  *       contributors may be used to endorse or promote products derived
  *       from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  ******************************************************************************\<close>
 (*>*)
 
 theory Mndetprefix
   imports Process Stop Mprefix Ndet
 begin
 
 section\<open>Multiple non deterministic operator\<close>
 
-definition
-        Mndetprefix   :: "['\<alpha> set, '\<alpha> \<Rightarrow> '\<alpha> process] \<Rightarrow> '\<alpha> process" 
-        where   "Mndetprefix A P \<equiv> if A = {} 
-                                   then STOP
-                                   else Abs_process(\<Union> x\<in>A.  \<F>(x \<rightarrow> P x),
-                                                    \<Union> x\<in>A.  \<D>(x \<rightarrow> P x))"
-syntax
-  "_Mndetprefix"       :: "pttrn \<Rightarrow> 'a set \<Rightarrow> 'a process \<Rightarrow> 'a process" 
-                          ("(3\<sqinter>_\<in>_ \<rightarrow> / _)" [0, 0, 70] 70)
-
-translations
-  "\<sqinter>x\<in>A\<rightarrow> P" \<rightleftharpoons> "CONST Mndetprefix A (\<lambda>x. P)"
-
-lemma mt_Mndetprefix[simp] : "Mndetprefix {} P = STOP"
-  unfolding Mndetprefix_def   by simp
-
-lemma Mndetprefix_is_process : "A \<noteq> {} \<Longrightarrow> is_process (\<Union> x\<in>A. \<F>(x \<rightarrow> P x), \<Union> x\<in>A.   \<D>(x \<rightarrow> P x))"
+lift_definition Mndetprefix   :: "['\<alpha> set, '\<alpha> \<Rightarrow> '\<alpha> process] \<Rightarrow> '\<alpha> process" 
+  is "\<lambda>A P.   if A = {} then Rep_process STOP 
+            else (\<Union> x\<in>A.  \<F>(x \<rightarrow> P x), \<Union> x\<in>A.  \<D>(x \<rightarrow> P x))"
+  apply auto
+  using Rep_process apply blast
   unfolding is_process_def FAILURES_def DIVERGENCES_def
   apply auto
   using is_processT1 apply auto[1]
   using is_processT2 apply blast
   using is_processT3_SR apply blast
   using is_processT4 apply blast  
   using is_processT5_S1 apply blast
   using is_processT6 apply blast
   using is_processT7 apply blast
   using NF_ND apply auto[1]
   using is_processT9 by blast  
 
-lemma T_Mndetprefix1 : "\<T> (Mndetprefix {} P) = {[]}"
-  unfolding Mndetprefix_def by(simp add: T_STOP)
+syntax
+  "_Mndetprefix"       :: "pttrn \<Rightarrow> 'a set \<Rightarrow> 'a process \<Rightarrow> 'a process" 
+                          ("(3\<sqinter>_\<in>_ \<rightarrow> / _)" [0, 0, 70] 70)
 
-lemma rep_abs_Mndetprefix[simp]: "A \<noteq> {} \<Longrightarrow>
+translations
+  "\<sqinter>x\<in>A\<rightarrow> P" \<rightleftharpoons> "CONST Mndetprefix A (\<lambda>x. P)"
+
+lemma mt_Mndetprefix[simp] : "Mndetprefix {} P = STOP"
+  by (simp add: Mndetprefix_def Rep_process_inverse)
+
+lemma rep_abs_Mndetprefix: "A \<noteq> {} \<Longrightarrow>
      (Rep_process (Abs_process(\<Union>x\<in>A. \<F>(x \<rightarrow> P x),\<Union>x\<in>A. \<D> (x \<rightarrow> P x)))) = 
       (\<Union>x\<in>A. \<F>(x \<rightarrow> P x), \<Union>x\<in>A. \<D> (x \<rightarrow> P x))"
-  apply(subst Process.process.Abs_process_inverse)
-  by(auto intro: Mndetprefix_is_process[simplified])
+  by (metis (mono_tags, lifting) Abs_process_inverse Mndetprefix.rep_eq Rep_process)
   
-lemma T_Mndetprefix: "A\<noteq>{} \<Longrightarrow> \<T> (Mndetprefix A P) = (\<Union> x\<in>A. \<T> (x \<rightarrow> P x))"
-  unfolding Mndetprefix_def
-  apply(simp, subst Traces_def, simp add: TRACES_def FAILURES_def)
-  apply(auto intro: Mndetprefix_is_process[simplified])
-  unfolding TRACES_def FAILURES_def apply(cases "A = {}") 
-   apply(auto intro: F_T D_T simp: Nil_elem_T)
-  using NF_NT by blast
-
-lemma F_Mndetprefix1 : "\<F> (Mndetprefix {} P) = {(s, X). s = []}"
-  unfolding Mndetprefix_def by(simp add: F_STOP)
-
-lemma F_Mndetprefix: "A\<noteq>{} \<Longrightarrow> \<F> (Mndetprefix A P) = (\<Union> x\<in>A. \<F>(x \<rightarrow> P x))"
-  unfolding Mndetprefix_def 
-  by(simp, subst Failures_def, auto simp : FAILURES_def F_Mndetprefix1)
 
 
-lemma D_Mndetprefix1 : "\<D> (Mndetprefix {} P) = {}"
-  unfolding Mndetprefix_def by(simp add: D_STOP)
+lemma F_Mndetprefix:
+  "\<F> (Mndetprefix A P) = (if A = {} then {(s, X). s = []} else \<Union> x\<in>A. \<F> (x \<rightarrow> P x))"
+  by (simp add: Failures.rep_eq FAILURES_def STOP.rep_eq Mndetprefix.rep_eq)
 
-lemma D_Mndetprefix : "A\<noteq>{} \<Longrightarrow> \<D>(Mndetprefix A P) = (\<Union> x\<in>A. \<D> (x \<rightarrow> P x))"
-  unfolding Mndetprefix_def 
-  apply(simp, subst D_def, subst Process.process.Abs_process_inverse)
-   by(auto intro: Mndetprefix_is_process[simplified] simp: DIVERGENCES_def)
+lemma D_Mndetprefix : "\<D> (Mndetprefix A P) = (if A = {} then {} else \<Union> x\<in>A. \<D> (x \<rightarrow> P x))"
+  by (simp add: Divergences.rep_eq DIVERGENCES_def STOP.rep_eq Mndetprefix.rep_eq)
+
+lemma T_Mndetprefix: "\<T> (Mndetprefix A P) = (if A = {} then {[]} else \<Union> x\<in>A. \<T> (x \<rightarrow> P x))"
+  by (auto simp add: Traces.rep_eq TRACES_def Failures.rep_eq[symmetric] F_Mndetprefix)
+
   
 
 text\<open> Thus we know now, that Mndetprefix yields processes. Direct consequences are the following
   distributivities: \<close>
 
 lemma Mndetprefix_unit : "(\<sqinter> x \<in> {a} \<rightarrow> P x)  = (a \<rightarrow> P a)" 
   by(auto simp : Process.Process_eq_spec F_Mndetprefix D_Mndetprefix)
 
 lemma Mndetprefix_Un_distrib : "A \<noteq>{} \<Longrightarrow> B \<noteq>{} \<Longrightarrow> (\<sqinter> x \<in> A\<union>B \<rightarrow> P x) = ((\<sqinter> x \<in> A \<rightarrow> P x) \<sqinter> (\<sqinter> x \<in> B \<rightarrow> P x))"
   by(auto simp : Process.Process_eq_spec F_Ndet D_Ndet F_Mndetprefix D_Mndetprefix)
 
 text\<open> The two lemmas @{thm Mndetprefix_unit} and @{thm Mndetprefix_Un_distrib} together give us that @{const Mndetprefix} 
       can be represented by a fold in the finite case. \<close>                                         
 
 lemma Mndetprefix_distrib_unit : "A-{a} \<noteq> {}  \<Longrightarrow> (\<sqinter> x \<in> insert a A \<rightarrow> P x) = ((a \<rightarrow> P a) \<sqinter> (\<sqinter> x \<in> A-{a} \<rightarrow> P x))"
   by (metis Un_Diff_cancel insert_is_Un insert_not_empty Mndetprefix_Un_distrib Mndetprefix_unit)
 
 subsection\<open>Finite case Continuity\<close>
 
 text\<open> This also implies that Mndetprefix is continuous for the
       finite @{term A} and an arbitrary body @{term f}: \<close>
 
 lemma Mndetprefix_cont_finite[simp]:
 assumes "finite A"
  and    "\<And>x. cont (f x)"
 shows   "cont (\<lambda>y. \<sqinter> z \<in> A \<rightarrow> f z y)"
 proof(rule Finite_Set.finite_induct[OF `finite A`])
   show  "cont (\<lambda>y. \<sqinter>z\<in>{} \<rightarrow> f z y)" by auto
 next
   fix A fix a 
   assume "cont (\<lambda>y. \<sqinter>z\<in>A \<rightarrow> f z y)" and "a \<notin> A"
   show   "cont (\<lambda>y. \<sqinter>z\<in>insert a A \<rightarrow> f z y)"
   proof(cases "A={}")
     case True
     then show ?thesis by(simp add: Mndetprefix_unit True `\<And>x. cont (f x)`)
   next
     case False
     have *  : "A-{a} \<noteq> {}" by (simp add: False \<open>a \<notin> A\<close>)
     have ** : "A-{a} = A"  by (simp add: \<open>a \<notin> A\<close>)
     show ?thesis
       apply(simp only: Mndetprefix_distrib_unit[OF *], simp only: **)  
       by (simp add: \<open>cont (\<lambda>y. \<sqinter>z\<in>A \<rightarrow> f z y)\<close> assms(2))
   qed
 qed
 
 subsection\<open>General case Continuity\<close>
 
 lemma mono_Mndetprefix[simp] : "monofun (Mndetprefix (A::'a set))" 
 proof(cases "A={}")
   case True
   then show ?thesis by(auto simp: monofun_def)
 next
   case False
   then show ?thesis apply(simp add: monofun_def, intro allI impI) 
     unfolding le_approx_def
     proof(simp add:T_Mndetprefix F_Mndetprefix D_Mndetprefix, intro conjI)
       fix x::"'a \<Rightarrow> 'a process" and y::"'a \<Rightarrow> 'a process"  
       assume "A \<noteq> {}" and "x \<sqsubseteq> y"
       show "(\<Union>x\<in>A.  \<D> (x\<rightarrow> y x)) \<subseteq> (\<Union>xa\<in>A. \<D> (xa \<rightarrow> x xa))" 
         by (metis (mono_tags, lifting) SUP_mono \<open>x \<sqsubseteq> y\<close> fun_below_iff le_approx1 mono_Mprefix0 write0_def)
     next
       fix x::"'a \<Rightarrow> 'a process" and y::"'a \<Rightarrow>  'a process"  
       assume *:"A \<noteq> {}" and **:"x \<sqsubseteq> y"
       have *** : "\<And>z. z \<in> A \<Longrightarrow> x z \<sqsubseteq> y z " by (simp add: \<open>x \<sqsubseteq> y\<close> fun_belowD)
       with * show "\<forall>s. (\<forall>xa\<in>A. s \<notin> \<D> (xa \<rightarrow> x xa)) \<longrightarrow> Ra (Mndetprefix A x) s = Ra (Mndetprefix A y) s"
         unfolding Ra_def
         by (auto simp:proc_ord2a mono_Mprefix0 write0_def F_Mndetprefix) 
            (meson le_approx2 mono_Mprefix0 write0_def)+
     next
       fix x::"'a \<Rightarrow> 'a process" and y::"'a \<Rightarrow>  'a process"  
       assume *:"A \<noteq> {}" and "x \<sqsubseteq> y"
       have *** : "\<And>z. z \<in> A \<Longrightarrow> (z \<rightarrow> x z) \<sqsubseteq> (z \<rightarrow> y z) "
         by (metis \<open>x \<sqsubseteq> y\<close> fun_below_iff mono_Mprefix0 write0_def)
       with * show "min_elems (\<Union>xa\<in>A. \<D> (xa \<rightarrow> x xa)) \<subseteq> (\<Union>x\<in>A. \<T> (x \<rightarrow> y x))"
         unfolding min_elems_def apply auto 
         by (metis Set.set_insert elem_min_elems insert_subset le_approx3 le_less min_elems5)
     qed
 qed  
 
 lemma Mndetprefix_chainpreserving: "chain Y \<Longrightarrow> chain (\<lambda>i. (\<sqinter> z \<in> A \<rightarrow> Y i z))"
   apply(rule chainI, rename_tac i)
   apply(frule_tac i="i" in chainE)
   by (simp add: below_fun_def mono_Mprefix0 write0_def monofunE)
 
 lemma contlub_Mndetprefix : "contlub (Mndetprefix A)"
 proof(cases "A={}")
   case True
   then show ?thesis by(auto simp: contlub_def)
 next
   case False
   show ?thesis
   proof(rule contlubI, rule proc_ord_proc_eq_spec)
     fix Y :: "nat \<Rightarrow> 'a \<Rightarrow> 'a process"
     assume a:"chain Y"
     show "(\<sqinter>x\<in>A \<rightarrow> (\<Squnion>i. Y i) x) \<sqsubseteq> (\<Squnion>i. \<sqinter>x\<in>A \<rightarrow> Y i x)"
     proof(simp add:le_approx_def, intro conjI allI impI)
       show "\<D> (\<Squnion>i. \<sqinter>x\<in>A \<rightarrow> Y i x) \<subseteq> \<D> (\<sqinter>x\<in>A \<rightarrow> Lub Y x)"
         using a False D_LUB[OF Mndetprefix_chainpreserving[OF a], of A] 
               limproc_is_thelub[OF Mndetprefix_chainpreserving[OF a], of A] 
         
 
         apply (auto simp add:write0_def D_Mprefix D_LUB[OF ch2ch_fun[OF a]] 
                              limproc_is_thelub_fun[OF a] D_Mndetprefix) 
 
         by (metis (mono_tags, opaque_lifting) event.inject)
     next
       fix s :: "'a event list"
       assume "s \<notin> \<D> (\<sqinter>x\<in>A \<rightarrow> Lub Y x)"
       show "Ra (\<sqinter>x\<in>A \<rightarrow> Lub Y x) s = Ra (\<Squnion>i. \<sqinter>x\<in>A \<rightarrow> Y i x) s" 
         unfolding Ra_def 
         using a False F_LUB[OF Mndetprefix_chainpreserving[OF a], of A] 
               limproc_is_thelub[OF Mndetprefix_chainpreserving[OF a], of A] 
         apply (auto simp add:write0_def F_Mprefix F_LUB[OF ch2ch_fun[OF a]] 
                              limproc_is_thelub_fun[OF a] F_Mndetprefix)
         by (metis (mono_tags, opaque_lifting) event.inject)
     next
       show "min_elems (\<D> (\<sqinter>x\<in>A \<rightarrow> Lub Y x)) \<subseteq> \<T> (\<Squnion>i. \<sqinter>x\<in>A \<rightarrow> Y i x)"
         unfolding min_elems_def
         using a False limproc_is_thelub[OF Mndetprefix_chainpreserving[OF a], of A]
               D_LUB[OF Mndetprefix_chainpreserving[OF a], of A] 
               F_LUB[OF Mndetprefix_chainpreserving[OF a], of A] 
         by (auto simp add:D_T write0_def D_Mprefix F_Mprefix D_Mndetprefix F_Mndetprefix 
                           D_LUB[OF ch2ch_fun[OF a]] F_LUB[OF ch2ch_fun[OF a]] 
                           limproc_is_thelub_fun[OF a])
     qed
   next
     fix Y :: "nat \<Rightarrow> 'a \<Rightarrow> 'a process"
     assume a:"chain Y"      
     show "\<D> (\<sqinter>x\<in>A \<rightarrow> (\<Squnion>i. Y i) x) \<subseteq> \<D> (\<Squnion>i. \<sqinter>x\<in>A \<rightarrow> Y i x)"
         using a False D_LUB[OF Mndetprefix_chainpreserving[OF a], of A] 
               limproc_is_thelub[OF Mndetprefix_chainpreserving[OF a], of A] 
         by (auto simp add:write0_def D_Mprefix D_Mndetprefix D_LUB[OF ch2ch_fun[OF a]] 
                            limproc_is_thelub_fun[OF a])
   qed
 qed
 
 lemma Mndetprefix_cont[simp]: "(\<And>x. cont (f x)) \<Longrightarrow> cont (\<lambda>y. (\<sqinter> z \<in> A \<rightarrow> (f z y)))"
   apply(rule_tac f = "\<lambda>z y. (f y z)" in Cont.cont_compose, rule monocontlub2cont) 
   by (auto intro: mono_Mndetprefix contlub_Mndetprefix Fun_Cpo.cont2cont_lambda)
 
 end
\ No newline at end of file
diff --git a/thys/HOL-CSP/Mprefix.thy b/thys/HOL-CSP/Mprefix.thy
--- a/thys/HOL-CSP/Mprefix.thy
+++ b/thys/HOL-CSP/Mprefix.thy
@@ -1,439 +1,434 @@
 (*<*)
 \<comment>\<open> ******************************************************************** 
  * Project         : HOL-CSP - A Shallow Embedding of CSP in  Isabelle/HOL
  * Version         : 2.0
  *
- * Author          : Burkhart Wolff, Safouan Taha, Lina Ye.
+ * Author          : Burkhart Wolff.
  *                   (Based on HOL-CSP 1.0 by Haykal Tej and Burkhart Wolff)
  *
  * This file       : A Combined CSP Theory
  *
  * Copyright (c) 2009 Université Paris-Sud, France
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials provided
  *       with the distribution.
  *
  *     * Neither the name of the copyright holders nor the names of its
  *       contributors may be used to endorse or promote products derived
  *       from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  ******************************************************************************\<close>
 (*>*)
 
 
 section\<open> The Multi-Prefix Operator Definition \<close>
 
 theory  Mprefix 
 imports Process 
 begin 
 
 subsection\<open> The Definition and some Consequences \<close>
 
-definition   Mprefix     :: "['a set,'a => 'a process] => 'a process" where
-  "Mprefix A P \<equiv>  Abs_process(  
-                              {(tr,ref). tr = [] \<and> ref Int (ev ` A) = {}} \<union>
-                              {(tr,ref). tr \<noteq> [] \<and> hd tr \<in> (ev ` A) \<and>
-                                         (\<exists> a. ev a = (hd tr)\<and>(tl tr,ref)\<in>\<F>(P a))},
-                              {d. d \<noteq> [] \<and>  hd d  \<in> (ev ` A) \<and>
-                                         (\<exists> a. ev a = hd d \<and> tl d \<in> \<D> (P a))})"
-
-syntax
-  "_Mprefix" :: "[pttrn,'a set,'a process] \<Rightarrow> 'a process"	("(3\<box>(_/\<in>_)/ \<rightarrow> (_))"[0,0,64]64)
-
-term "Ball A (\<lambda>x. P)"
-
-translations
-  "\<box>x\<in>A \<rightarrow> P" \<rightleftharpoons> "CONST Mprefix A (\<lambda>x. P)"
-
-text\<open>Syntax Check:\<close>
-term \<open>\<box>x\<in>A \<rightarrow> \<box>y\<in>A \<rightarrow> \<box>z\<in>A \<rightarrow> P z x y = Q\<close>
-
-subsection\<open> Well-foundedness of Mprefix \<close>
-
-lemma is_process_REP_Mprefix  :
-"is_process ({(tr,ref). tr=[] \<and>  ref \<inter> (ev ` A) = {}} \<union>
-             {(tr,ref). tr \<noteq> [] \<and> hd tr \<in> (ev ` A) \<and>
-                        (\<exists> a. ev a = (hd tr) \<and> (tl tr,ref) \<in> \<F>(P a))},
-             {d. d \<noteq>  [] \<and>  hd d \<in> (ev ` A) \<and>
-                        (\<exists> a. ev a = hd d  \<and> tl d \<in> \<D>(P a))})"
- (is "is_process(?f, ?d)")
-proof  (simp only:is_process_def FAILURES_def DIVERGENCES_def
-                  Product_Type.fst_conv Product_Type.snd_conv,
+lift_definition   Mprefix     :: "['a set,'a => 'a process] => 'a process"
+  is "\<lambda>A P. ({(tr,ref). tr = [] \<and> ref Int (ev ` A) = {}} \<union>
+             {(tr,ref). tr \<noteq> [] \<and> hd tr \<in> (ev ` A) \<and> 
+                        (\<exists> a. ev a = (hd tr)\<and>(tl tr,ref)\<in>\<F>(P a))},
+             {d. d \<noteq> [] \<and>  hd d  \<in> (ev ` A) \<and> (\<exists> a. ev a = hd d \<and> tl d \<in> \<D> (P a))})"
+proof -
+  show \<open>is_process ({(tr, ref). tr = [] \<and> ref \<inter> ev ` (A :: 'a set) = {}} \<union>
+                    {(tr, ref). tr \<noteq> [] \<and> hd tr \<in> ev ` A \<and> 
+                                (\<exists>a. ev a = hd tr \<and> (tl tr, ref) \<in> \<F> (P a))},
+                    {d. d \<noteq> [] \<and> hd d \<in> ev ` A \<and> (\<exists>a. ev a = hd d \<and> tl d \<in> \<D> (P a))}) \<close> 
+    (is \<open>is_process(?f, ?d)\<close>) for A P
+proof  (simp only: is_process_def FAILURES_def DIVERGENCES_def
+                   Product_Type.fst_conv Product_Type.snd_conv,
         intro conjI allI impI)
     show "([],{}) \<in> ?f" by(simp)
 next  
     fix    s:: "'a event list" fix X::"'a event set"
     assume H : "(s, X) \<in> ?f"
     show       "front_tickFree s"
                apply(insert H, auto simp:  front_tickFree_def tickFree_def
                                     dest!:list_nonMt_append)
                apply(rename_tac aa ta x, case_tac "ta", auto simp: front_tickFree_charn
                                     dest! : is_processT2[rule_format])
                apply(simp add: tickFree_def)
                done 
 next
     fix s t :: "'a event list" 
     assume     "(s @ t, {}) \<in> ?f"
     then show  "(s, {}) \<in> ?f"
                by(auto elim: is_processT3[rule_format])
 next
     fix    s:: "'a event list" fix X Y::"'a event set"
     assume     "(s, Y) \<in> ?f \<and> X \<subseteq> Y"
     then show  "(s, X) \<in> ?f"
                by(auto intro: is_processT4[rule_format])
 next
     fix    s:: "'a event list" fix X Y::"'a event set"
     assume     "(s, X) \<in> ?f \<and> (\<forall> c. c\<in>Y \<longrightarrow> (s @ [c], {}) \<notin> ?f)"
     then show  "(s, X \<union> Y) \<in> ?f "
                by(auto intro!: is_processT1 is_processT5[rule_format]) 
 next
     fix s::    "'a event list" fix X::"'a event set"
     assume     "(s @ [tick], {}) \<in> ?f"
     then show  "(s, X - {tick}) \<in> ?f"
                by(cases s, auto dest!: is_processT6[rule_format])
 next
     fix s t::  "'a event list" fix X::"'a event set"
     assume     "s \<in>  ?d \<and> tickFree s \<and> front_tickFree t"
     then show  "s @ t \<in> ?d"
                by(auto intro!: is_processT7_S, cases s, simp_all)
 next
     fix s::    "'a event list" fix X::"'a event set"
     assume     "s \<in> ?d"
     then show  "(s, X) \<in> ?f"
                by(auto simp: is_processT8_S)
 next
     fix s::    "'a event list" 
     assume     "s @ [tick] \<in> ?d"
     then show  "s \<in> ?d"
                apply(auto)
                apply(cases s, simp_all)
                apply(cases s, auto intro: is_processT9[rule_format])
                done
 
-qed
+           qed
+         qed
+
+
+syntax
+  "_Mprefix" :: "[pttrn,'a set,'a process] \<Rightarrow> 'a process"	("(3\<box>(_/\<in>_)/ \<rightarrow> (_))"[0,0,64]64)
+
+term "Ball A (\<lambda>x. P)"
+
+translations
+  "\<box>x\<in>A \<rightarrow> P" \<rightleftharpoons> "CONST Mprefix A (\<lambda>x. P)"
+
+text\<open>Syntax Check:\<close>
+term \<open>\<box>x\<in>A \<rightarrow> \<box>y\<in>A \<rightarrow> \<box>z\<in>A \<rightarrow> P z x y = Q\<close>
 
 
 (* bizarre exercise in style proposed by Makarius... *)
 lemma is_process_REP_Mprefix'  :
      "is_process ({(tr,ref). tr=[] \<and>  ref \<inter> (ev ` A) = {}} \<union>
                   {(tr,ref). tr \<noteq> [] \<and> hd tr \<in> (ev ` A) \<and>
                         (\<exists> a. ev a = (hd tr) \<and> (tl tr,ref) \<in> \<F>(P a))},
                   {d. d \<noteq>  [] \<and>  hd d \<in> (ev ` A) \<and>
                         (\<exists> a. ev a = hd d  \<and> tl d \<in> \<D>(P a))})"
  (is "is_process(?f, ?d)")
 proof  (simp only:is_process_def FAILURES_def DIVERGENCES_def
                   Product_Type.fst_conv Product_Type.snd_conv,
         intro conjI allI impI,goal_cases)
   case 1
     show "([],{}) \<in> ?f" by(simp)
 next  
   case (2 s X) 
     assume H : "(s, X) \<in> ?f"
     have       "front_tickFree s"
       apply(insert H, auto simp:  front_tickFree_def tickFree_def
                            dest!:list_nonMt_append)
       apply(rename_tac aa ta x, case_tac "ta", auto simp: front_tickFree_charn
                            dest! : is_processT2[rule_format])
       apply(simp add: tickFree_def)
       done    
     then show "front_tickFree s"  by(auto) 
 next
   case (3 s t) 
     assume H : "(s @ t, {}) \<in> ?f"
     show "(s, {}) \<in> ?f" using H  by(auto elim: is_processT3[rule_format])
 next
   case (4 s X Y) 
     assume H1: "(s, Y) \<in> ?f \<and> X \<subseteq> Y"
     then show "(s, X) \<in> ?f"  by(auto intro: is_processT4[rule_format])
 next
   case (5 s X Y)   
     assume  "(s, X) \<in> ?f \<and> (\<forall> c. c\<in>Y \<longrightarrow> (s @ [c], {}) \<notin> ?f)"
     then show "(s, X \<union> Y) \<in> ?f"  by(auto intro!: is_processT1 is_processT5[rule_format]) 
 next
   case (6 s X)   
     assume  "(s @ [tick], {}) \<in> ?f"   
     then show "(s, X - {tick}) \<in> ?f"  by(cases s, auto dest!: is_processT6[rule_format])
 next
   case (7 s t) 
     assume H1 : "s \<in>  ?d \<and> tickFree s \<and> front_tickFree t"
     have 7:     "s @ t \<in> ?d"
       using H1  by(auto intro!: is_processT7_S, cases s, simp_all)
     then show "s @ t \<in> ?d" using H1  by(auto)
 next
   case (8 s X)   
     assume H : "s \<in> ?d"
     then show "(s, X) \<in> ?f" using H by(auto simp: is_processT8_S)
 next
   case (9 s)  
     assume H: "s @ [tick] \<in> ?d"
     then have 9:   "s \<in> ?d"
        apply(auto)
        apply(cases s, simp_all)
        apply(cases s, auto intro: is_processT9[rule_format])
        done
     then show "s \<in> ?d" by(auto)
 qed
 
-lemmas  Rep_Abs_Mprefix[simp] = Abs_process_inverse[simplified, OF is_process_REP_Mprefix]
-thm Rep_Abs_Mprefix
    
 lemma Rep_Abs_Mprefix'' : 
 assumes H1 : "f = {(tr, ref). tr = [] \<and> ref \<inter> ev ` A = {}} \<union>
                   {(tr, ref). tr \<noteq> [] \<and> hd tr \<in> ev ` A 
                              \<and> (\<exists>a. ev a = hd tr \<and> (tl tr, ref) \<in> \<F> (P a))}"
     and H2 : "d = {d. d \<noteq>  [] \<and>  hd d \<in> (ev ` A) \<and> 
                      (\<exists> a. ev a = hd d  \<and> tl d \<in> \<D>(P a))}"
-shows "Rep_process (Abs_process (f,d)) = (f,d)"
-by(subst Abs_process_inverse, 
-   simp_all only: H1 H2 CollectI Rep_process is_process_REP_Mprefix)
+  shows "Rep_process (Abs_process (f,d)) = (f,d)"
+  using Abs_process_inverse H1 H2 is_process_REP_Mprefix' by blast
+
 
 
 subsection \<open> Projections in Prefix \<close>
 
 lemma F_Mprefix : 
   "\<F> (\<box> x \<in> A \<rightarrow> P x) = {(tr,ref). tr=[] \<and>  ref \<inter> (ev ` A) = {}} \<union>
                          {(tr,ref). tr \<noteq> [] \<and> hd tr \<in> (ev ` A) \<and> 
                                    (\<exists> a. ev a = (hd tr) \<and> (tl tr,ref) \<in> \<F>(P a))}"
-  by(simp add:Mprefix_def Failures_def Rep_Abs_Mprefix'' FAILURES_def)
-
+  by (subst Failures.rep_eq, simp add: Mprefix.rep_eq FAILURES_def)
 
 lemma D_Mprefix:
   "\<D> (\<box> x \<in> A \<rightarrow> P x) = {d. d \<noteq>  [] \<and>  hd d \<in> (ev ` A) \<and> 
-                           (\<exists> a. ev a = hd d  \<and> tl d \<in> \<D>(P a))}"
-  by(simp add:Mprefix_def D_def Rep_Abs_Mprefix'' DIVERGENCES_def)
+                             (\<exists> a. ev a = hd d  \<and> tl d \<in> \<D>(P a))}"
+  by (subst Divergences.rep_eq, simp add: Mprefix.rep_eq DIVERGENCES_def)
 
 
 lemma T_Mprefix:
   "\<T> (\<box> x \<in> A \<rightarrow> P x)={s. s=[] \<or> (\<exists> a. a\<in>A \<and> s\<noteq>[] \<and> hd s = ev a \<and> tl s \<in> \<T>(P a))}"
-  by(auto simp: T_F_spec[symmetric] F_Mprefix)
+  by (subst Traces.rep_eq, auto simp add: TRACES_def Failures.rep_eq[symmetric] F_Mprefix)
+     (use F_T T_F in \<open>blast+\<close>)
+  
 
 subsection \<open> Basic Properties \<close>
 
 lemma tick_T_Mprefix [simp]: "[tick] \<notin> \<T> (\<box> x \<in> A \<rightarrow> P x)"
   by(simp add:T_Mprefix)
 
 
 lemma Nil_Nin_D_Mprefix [simp]: "[] \<notin> \<D> (\<box> x \<in> A \<rightarrow> P x)"
   by(simp add: D_Mprefix)
 
 subsection\<open> Proof of Continuity Rule \<close>
 
 subsubsection\<open> Backpatch Isabelle 2009-1\<close>
 
 \<comment>\<open>re-introduced from Isabelle/HOLCF 2009-1; clearly
    a derived concept, but still a useful shortcut\<close>
 
 definition
   contlub :: "('a::cpo \<Rightarrow> 'b::cpo) \<Rightarrow> bool" 
   where
   "contlub f = (\<forall>Y. chain Y \<longrightarrow> f (\<Squnion> i. Y i) = (\<Squnion> i. f (Y i)))"
 
 lemma contlubE:
   "\<lbrakk>contlub f; chain Y\<rbrakk> \<Longrightarrow> f (\<Squnion> i. Y i) = (\<Squnion> i. f (Y i))"
   by (simp add: contlub_def)
 
 
 lemma monocontlub2cont: "\<lbrakk>monofun f; contlub f\<rbrakk> \<Longrightarrow> cont f"
 apply (rule contI)
 apply (rule thelubE)
 apply (erule (1) ch2ch_monofun)
 apply (erule (1) contlubE [symmetric])
 done
 
 lemma contlubI:
   "(\<And>Y. chain Y \<Longrightarrow> f (\<Squnion> i. Y i) = (\<Squnion> i. f (Y i))) \<Longrightarrow> contlub f"
 by (simp add: contlub_def)
 
 
 lemma cont2contlub: "cont f \<Longrightarrow> contlub f"
 apply (rule contlubI)
 apply (rule Porder.po_class.lub_eqI [symmetric])
 apply (erule (1) contE)
 done
 
 
 subsubsection\<open> Core of Proof  \<close>
 
 lemma mono_Mprefix1:
 "\<forall>a\<in>A. P a \<sqsubseteq> Q a \<Longrightarrow> \<D> (Mprefix A Q) \<subseteq> \<D> (Mprefix A P)"
   apply(auto simp: D_Mprefix) using le_approx1 by blast
 
 lemma mono_Mprefix2:
 "\<forall>x\<in>A. P x \<sqsubseteq> Q x \<Longrightarrow>
  \<forall>s. s \<notin> \<D> (Mprefix A P) \<longrightarrow> Ra (Mprefix A P) s = Ra (Mprefix A Q) s"          
   apply (auto simp: Ra_def D_Mprefix F_Mprefix) using proc_ord2a by blast+
 
 lemma mono_Mprefix3 :
 assumes H:"\<forall>x\<in>A. P x \<sqsubseteq> Q x"
 shows " min_elems (\<D> (Mprefix A P)) \<subseteq> \<T> (Mprefix A Q)"
 proof(auto simp: min_elems_def D_Mprefix T_Mprefix image_def, goal_cases)
   case (1 x a)
   with H[rule_format, of a, OF 1(2)] show ?case 
     apply(auto dest!: le_approx3 simp: min_elems_def)
     apply(subgoal_tac "\<forall>t. t \<in> \<D> (P a) \<longrightarrow> \<not> t < tl x", auto)
     apply(rename_tac t, erule_tac x="(ev a)#t" in allE, auto)
     using less_cons hd_Cons_tl by metis
 qed
 
 lemma mono_Mprefix0:
 "\<forall>x\<in>A. P x \<sqsubseteq> Q x \<Longrightarrow> Mprefix A P \<sqsubseteq> Mprefix A Q" 
 apply(simp add: le_approx_def mono_Mprefix1 mono_Mprefix3)
 apply(rule mono_Mprefix2)
 apply(auto simp: le_approx_def)
 done
 
 
 lemma mono_Mprefix[simp]: "monofun(Mprefix A)"
 by(auto simp: Fun_Cpo.below_fun_def monofun_def mono_Mprefix0)
 
 
 lemma proc_ord2_set: 
 "P \<sqsubseteq> Q \<Longrightarrow> {(s, X). s \<notin> \<D> P \<and> (s, X) \<in> \<F> P} = {(s, X). s \<notin> \<D> P \<and> (s, X) \<in> \<F> Q}"
 by(auto simp: le_approx2)
 
 
 lemma proc_ord_proc_eq_spec: "P \<sqsubseteq> Q \<Longrightarrow> \<D> P \<subseteq> \<D> Q \<Longrightarrow> P = Q"
 by (metis (mono_tags, lifting) below_antisym below_refl le_approx_def subset_antisym)
 
 
 lemma Mprefix_chainpreserving: "chain Y \<Longrightarrow> chain (\<lambda>i. Mprefix A (Y i))"
 apply(rule chainI, rename_tac i)
 apply(frule_tac i="i" in chainE)
 by(simp add: mono_Mprefix0 fun_belowD)
 
 
 lemma limproc_is_thelub_fun: 
 assumes     "chain S" 
 shows       "(Lub S c) = lim_proc (range (\<lambda>x. (S x c)))"
 proof -
   have    "\<And>xa. chain (\<lambda>x. S x xa)"
                   using `chain S` by(auto intro!: chainI  simp: chain_def fun_belowD )
   then     show ?thesis  by (metis contlub_lambda limproc_is_thelub)
 qed
 
 
 lemma contlub_Mprefix : "contlub(%P. Mprefix A P)"
 proof(rule contlubI, rule proc_ord_proc_eq_spec)
    fix Y   :: "nat \<Rightarrow> 'a \<Rightarrow> 'a process" 
    assume C : "chain Y" 
    have   C': "\<And>xa. chain (\<lambda>x. Y x xa)"
                  apply(insert C,rule chainI)
                  by(auto simp: chain_def fun_belowD)
    show       "Mprefix A (\<Squnion> i. Y i) \<sqsubseteq> (\<Squnion> i. Mprefix A (Y i))"
                  by(auto simp: Process.le_approx_def F_Mprefix D_Mprefix T_Mprefix C C'
                                Mprefix_chainpreserving limproc_is_thelub limproc_is_thelub_fun
                                D_T D_LUB D_LUB_2 F_LUB T_LUB_2 Ra_def min_elems_def)
 next
    fix Y   :: "nat \<Rightarrow> 'a \<Rightarrow> 'a process" 
    assume C : "chain Y" 
    show       "\<D> (Mprefix A (\<Squnion> i. Y i)) \<subseteq> \<D> (\<Squnion> i. Mprefix A (Y i))"
                  apply(auto simp: Process.le_approx_def F_Mprefix D_Mprefix T_Mprefix 
                                   C Mprefix_chainpreserving limproc_is_thelub D_LUB_2)
                  by (meson C fun_below_iff in_mono is_ub_thelub le_approx1)
 qed
 
 
 
 lemma Mprefix_cont [simp]: 
 "(\<And>x. cont (f x)) \<Longrightarrow> cont (\<lambda>y. \<box> z \<in>  A \<rightarrow> f z y)"
 apply(rule_tac f = "\<lambda>z y. (f y z)" in Cont.cont_compose)
 apply(rule monocontlub2cont)
 apply(auto intro: mono_Mprefix contlub_Mprefix Fun_Cpo.cont2cont_lambda)
 done
 
 
 subsection\<open> High-level Syntax for Read and Write \<close>
 
 text\<open> The following syntax introduces the usual channel notation for CSP.
 Slightly deviating from conventional wisdom, we view a channel not as a tag in
 a pair, rather than as a function of type @{typ "'a\<Rightarrow>'b"}. This paves the way
 for \emph{typed} channels over a common universe of events. \<close>
 
 definition  read     :: "['a \<Rightarrow> 'b,'a set, 'a \<Rightarrow> 'b process] \<Rightarrow> 'b process"
 where      "read c A P  \<equiv> Mprefix(c ` A) (P o (inv_into A c))"
 definition "write"    :: "['a \<Rightarrow> 'b, 'a, 'b process] \<Rightarrow> 'b process"
 where      "write c a P \<equiv> Mprefix {c a} (\<lambda> x. P)"
 definition  write0   :: "['a, 'a process] \<Rightarrow> 'a process"
 where      "write0 a P \<equiv> Mprefix {a} (\<lambda> x. P)"
 
 
 syntax
   "_read"   :: "[id, pttrn, 'a process] => 'a process"
                                         ("(3(_\<^bold>?_) /\<rightarrow> _)" [0,0,78] 78)
   "_readX"  :: "[id, pttrn, bool,'a process] => 'a process"
                                         ("(3(_\<^bold>?_)\<^bold>|_ /\<rightarrow> _)" [0,0,78] 78)
   "_readS"  :: "[id, pttrn, 'b set,'a process] => 'a process"
                                         ("(3(_\<^bold>?_)\<in>_ /\<rightarrow> _)" [0,0,78] 78)
   "_write"  :: "[id, 'b, 'a process] => 'a process"
                                         ("(3(_\<^bold>!_) /\<rightarrow> _)" [0,0,78] 78)
   "_writeS" :: "['a, 'a process] => 'a process"
                                         ("(3_ /\<rightarrow> _)" [0,78]78)
 
 subsection\<open>CSP$_M$-Style Syntax for Communication Primitives\<close>
 translations
   "_read c p P"     \<rightleftharpoons> "CONST read c CONST UNIV (\<lambda>p. P)"
   "_write c p P"    \<rightleftharpoons> "CONST write c p P"
   "_readX c p b P"  => "CONST read c {p. b} (\<lambda>p. P)"
   "_writeS a P"     \<rightleftharpoons> "CONST write0 a P"
   "_readS c p A P"  => "CONST read c A (\<lambda>p. P)"
 
 text\<open>Syntax Check:\<close>
 term\<open> d\<^bold>?y \<rightarrow> c\<^bold>!x \<rightarrow> P = Q\<close>
 
 
 lemma read_cont[simp]: "cont P \<Longrightarrow> cont (\<lambda>y. read c A (P y))"
   unfolding read_def o_def
   by (rule Mprefix_cont) (rule cont2cont_fun) 
 
 
 lemma read_cont'[simp]: "(\<And>x. cont (f x)) \<Longrightarrow> cont (\<lambda>y. c\<^bold>?x \<rightarrow> f x y)" by simp
 
 
 lemma write_cont[simp]: "cont (P::('b::cpo \<Rightarrow> 'a process))  \<Longrightarrow> cont(\<lambda>x. (c\<^bold>!a \<rightarrow> P x))"
 by(simp add:write_def)
 
 
 corollary write0_cont_lub : "contlub(Mprefix {a})"
   using contlub_Mprefix by blast
 
 
 lemma write0_contlub : "contlub(write0 a)"
   unfolding write0_def contlub_def
 proof (auto)
   fix Y :: "nat \<Rightarrow> 'a process"
   assume   "chain Y"
   have * : "chain (\<lambda>i. (\<lambda>_. Y i)::'b \<Rightarrow> 'a process)"
            by (meson \<open>chain Y\<close> fun_below_iff po_class.chain_def)
   have **: "(\<lambda>x. Lub Y) = Lub (\<lambda>i. (\<lambda>_. Y i))"
            by(rule ext,metis * ch2ch_fun limproc_is_thelub limproc_is_thelub_fun lub_eq)
   show "Mprefix {a} (\<lambda>x. Lub Y) = (\<Squnion>i. Mprefix {a} (\<lambda>x. Y i))"
     apply(subst **, subst contlubE[OF contlub_Mprefix])
     by (simp_all add: *)
 qed
   
 lemma write0_cont[simp]: "cont (P::('b::cpo \<Rightarrow> 'a process)) \<Longrightarrow> cont(\<lambda>x. (a \<rightarrow> P x))"
 by(simp add:write0_def)
 
 end
diff --git a/thys/HOL-CSP/Ndet.thy b/thys/HOL-CSP/Ndet.thy
--- a/thys/HOL-CSP/Ndet.thy
+++ b/thys/HOL-CSP/Ndet.thy
@@ -1,180 +1,170 @@
 (*<*)
 \<comment>\<open> ********************************************************************
  * Project         : HOL-CSP - A Shallow Embedding of CSP in  Isabelle/HOL
  * Version         : 2.0
  *
- * Author          : Burkhart Wolff, Safouan Taha, Lina Ye.
+ * Author          : Burkhart Wolff, Safouan Taha.
  *                   (Based on HOL-CSP 1.0 by Haykal Tej and Burkhart Wolff)
  *
  * This file       : A Combined CSP Theory
  *
  * Copyright (c) 2009 Université Paris-Sud, France
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials provided
  *       with the distribution.
  *
  *     * Neither the name of the copyright holders nor the names of its
  *       contributors may be used to endorse or promote products derived
  *       from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  ******************************************************************************\<close>
 (*>*)
 
 section\<open> Nondeterministic Choice Operator Definition \<close>
 
 theory  Ndet 
 imports Process
 begin
 
 
-subsection\<open> Definition and Consequences \<close>
-definition
+subsection\<open>The Ndet Operator Definition\<close>
+lift_definition
         Ndet     :: "['\<alpha> process,'\<alpha> process] \<Rightarrow> '\<alpha> process"   (infixl "|-|" 80)
-where   "P |-| Q \<equiv> Abs_process(\<F> P \<union> \<F> Q , \<D> P \<union> \<D> Q)"
-
-notation
-  Ndet (infixl "\<sqinter>" 80)
-
-
-lemma is_process_REP_Ndet:
-"is_process (\<F> P \<union> \<F> Q , \<D> P \<union> \<D> Q)"
+is   "\<lambda>P Q. (\<F> P \<union> \<F> Q , \<D> P \<union> \<D> Q)"
 proof(simp only: fst_conv snd_conv Rep_process is_process_def DIVERGENCES_def FAILURES_def,
       intro conjI)
-    show "([], {}) \<in> (\<F> P \<union> \<F> Q)"
+    show "\<And>P Q. ([], {}) \<in> (\<F> P \<union> \<F> Q)"
          by(simp add: is_processT1)
 next
-    show "\<forall>s X. (s, X) \<in> (\<F> P \<union> \<F> Q) \<longrightarrow> front_tickFree s"
+    show "\<And>P Q. \<forall>s X. (s, X) \<in> (\<F> P \<union> \<F> Q) \<longrightarrow> front_tickFree s"
          by(auto simp: is_processT2)
 next
-    show "\<forall>s t.   (s @ t, {}) \<in>(\<F> P \<union> \<F> Q) \<longrightarrow> (s, {}) \<in> (\<F> P \<union> \<F> Q)"
+    show "\<And>P Q. \<forall>s t.   (s @ t, {}) \<in>(\<F> P \<union> \<F> Q) \<longrightarrow> (s, {}) \<in> (\<F> P \<union> \<F> Q)"
          by (auto simp: is_processT1 dest!: is_processT3[rule_format])
 next
-    show "\<forall>s X Y. (s, Y) \<in> (\<F> P \<union> \<F> Q) \<and> X \<subseteq> Y \<longrightarrow> (s, X) \<in> (\<F> P \<union> \<F> Q)"
+    show "\<And>P Q. \<forall>s X Y. (s, Y) \<in> (\<F> P \<union> \<F> Q) \<and> X \<subseteq> Y \<longrightarrow> (s, X) \<in> (\<F> P \<union> \<F> Q)"
          by(auto dest: is_processT4[rule_format,OF conj_commute[THEN iffD1], OF conjI])
 next
-    show "\<forall>sa X Y. (sa, X) \<in> (\<F> P \<union> \<F> Q) \<and> (\<forall>c. c \<in> Y \<longrightarrow> (sa @ [c], {}) \<notin> (\<F> P \<union> \<F> Q))
+    show "\<And>P Q. \<forall>sa X Y. (sa, X) \<in> (\<F> P \<union> \<F> Q) \<and> (\<forall>c. c \<in> Y \<longrightarrow> (sa @ [c], {}) \<notin> (\<F> P \<union> \<F> Q))
           \<longrightarrow> (sa, X \<union> Y) \<in> (\<F> P \<union> \<F> Q)"
          by(auto simp: is_processT5 T_F)
 next
-    show "\<forall>s X. (s @ [tick], {}) \<in> (\<F> P \<union> \<F> Q) \<longrightarrow> (s, X - {tick}) \<in> (\<F> P \<union> \<F> Q)"
+    show "\<And>P Q. \<forall>s X. (s @ [tick], {}) \<in> (\<F> P \<union> \<F> Q) \<longrightarrow> (s, X - {tick}) \<in> (\<F> P \<union> \<F> Q)"
          apply((rule allI)+, rule impI)
          apply(rename_tac s X, case_tac "s=[]", simp_all add: is_processT6[rule_format] T_F_spec)
          apply(erule disjE,simp_all add: is_processT6[rule_format] T_F_spec)
          apply(erule disjE,simp_all add: is_processT6[rule_format] T_F_spec)
          done
 next
-    show "\<forall>s t. s \<in> \<D> P \<union> \<D> Q \<and> tickFree s \<and> front_tickFree t \<longrightarrow> s @ t \<in> \<D> P \<union> \<D> Q"
+    show "\<And>P Q. \<forall>s t. s \<in> \<D> P \<union> \<D> Q \<and> tickFree s \<and> front_tickFree t \<longrightarrow> s @ t \<in> \<D> P \<union> \<D> Q"
          by(auto simp: is_processT7)
 next
-    show "\<forall>s X. s \<in> \<D> P \<union> \<D> Q \<longrightarrow> (s, X) \<in> (\<F> P \<union> \<F> Q)"
+    show "\<And>P Q. \<forall>s X. s \<in> \<D> P \<union> \<D> Q \<longrightarrow> (s, X) \<in> (\<F> P \<union> \<F> Q)"
          by(auto simp: is_processT8[rule_format])
 next
-    show "\<forall>s. s @ [tick] \<in> \<D> P \<union> \<D> Q \<longrightarrow> s \<in> \<D> P \<union> \<D> Q"
+    show "\<And>P Q. \<forall>s. s @ [tick] \<in> \<D> P \<union> \<D> Q \<longrightarrow> s \<in> \<D> P \<union> \<D> Q"
          by(auto intro!:is_processT9[rule_format])
-qed
+     qed
+
+notation
+  Ndet (infixl "\<sqinter>" 80)
 
 
-lemma Rep_Abs_Ndet:
-"Rep_process(Abs_process(\<F> P \<union> \<F> Q , \<D> P \<union> \<D> Q)) = (\<F> P \<union> \<F> Q , \<D> P \<union> \<D> Q)"
-  by(simp only:CollectI Rep_process Abs_process_inverse is_process_REP_Ndet)
+subsection \<open>The Projections\<close>
+
+lemma F_Ndet : "\<F> (P \<sqinter> Q) = \<F> P \<union> \<F> Q"
+  by (simp add: FAILURES_def Failures.rep_eq Ndet.rep_eq)
+ 
+lemma D_Ndet : "\<D> (P \<sqinter> Q) = \<D> P \<union> \<D> Q"
+  by (simp add: DIVERGENCES_def Divergences.rep_eq Ndet.rep_eq)
+
+lemma T_Ndet : "\<T> (P \<sqinter> Q) = \<T> P \<union> \<T> Q"
+  apply (subst Traces.rep_eq, simp add: TRACES_def Failures.rep_eq[symmetric] F_Ndet)
+  apply(auto simp: T_F F_T is_processT1 Nil_elem_T)
+  by(rule_tac x="{}" in exI, simp add: T_F F_T is_processT1 Nil_elem_T)+
 
 
-subsection\<open>Some Laws\<close>
+subsection\<open>Basic Laws\<close>
 text \<open>The commutativity of the operator helps to simplify the subsequent
       continuity proof and is therefore developed here: \<close>
-lemma F_Ndet : "\<F> (P \<sqinter> Q) = \<F> P \<union> \<F> Q"
-  apply (subst Failures_def)
-  apply (simp only: Ndet_def)
-  by (simp add: FAILURES_def Rep_Abs_Ndet)
-
-
-lemma D_Ndet : "\<D>(P \<sqinter> Q) = \<D> P \<union> \<D> Q"
-  by(subst D_def, simp only: Ndet_def Rep_Abs_Ndet DIVERGENCES_def snd_conv)
-
-
-lemma T_Ndet : "\<T> (P \<sqinter> Q) = \<T> P \<union> \<T> Q"
-apply(subst Traces_def, simp only: Ndet_def Rep_Abs_Ndet TRACES_def FAILURES_def
-                             fst_def snd_conv)
-apply(auto simp: T_F F_T is_processT1 Nil_elem_T)
-apply(rule_tac x="{}" in exI, simp add: T_F F_T is_processT1 Nil_elem_T)+
-done
 
 lemma Ndet_commute: "(P \<sqinter> Q) = (Q \<sqinter> P)"
-by(auto simp: Process_eq_spec F_Ndet D_Ndet)
+  by(auto simp: Process_eq_spec F_Ndet D_Ndet)
+
 
 subsection\<open>The Continuity Rule\<close>
 lemma  mono_Ndet1: "P \<sqsubseteq> Q \<Longrightarrow> \<D> (Q \<sqinter> S) \<subseteq> \<D> (P \<sqinter> S)"
 apply(drule le_approx1)
 by (auto simp: Process_eq_spec F_Ndet D_Ndet)
 
 lemma mono_Ndet2: "P \<sqsubseteq> Q \<Longrightarrow> (\<forall> s. s \<notin> \<D> (P \<sqinter> S) \<longrightarrow> Ra (P \<sqinter> S) s = Ra (Q \<sqinter> S) s)"
 apply(subst (asm) le_approx_def)
 by (auto simp: Process_eq_spec F_Ndet D_Ndet Ra_def)
 
 lemma mono_Ndet3: "P \<sqsubseteq> Q \<Longrightarrow> min_elems (\<D> (P \<sqinter> S)) \<subseteq> \<T> (Q \<sqinter> S)"
 apply(auto dest!:le_approx3 simp: min_elems_def subset_iff F_Ndet D_Ndet T_Ndet)
 apply(erule_tac x="t" in allE, auto)
 by (erule_tac x="[]" in allE, auto simp: less_list_def Nil_elem_T D_T)
 
 lemma mono_Ndet[simp] : "P \<sqsubseteq> Q \<Longrightarrow> (P \<sqinter> S) \<sqsubseteq> (Q \<sqinter> S)"
 by(auto simp:le_approx_def mono_Ndet1 mono_Ndet2 mono_Ndet3)
 
 lemma mono_Ndet_sym[simp] : "P \<sqsubseteq> Q \<Longrightarrow> (S \<sqinter> P) \<sqsubseteq> (S \<sqinter> Q)"
 by (auto simp: Ndet_commute)
 
 
 lemma cont_Ndet1: 
 assumes chain:"chain Y"
 shows  "((\<Squnion> i. Y i) \<sqinter> S) = (\<Squnion> i. (Y i \<sqinter> S))"
 proof -
    have A : "chain (\<lambda>i. Y i \<sqinter> S)"
         apply(insert chain,rule chainI)
         apply(frule_tac i="i" in chainE)
         by(simp)
    show ?thesis using chain
         by(auto simp add: limproc_is_thelub Process_eq_spec D_Ndet F_Ndet F_LUB D_LUB A)
 qed
 
 
 lemma Ndet_cont[simp]: 
 assumes f: "cont f"
 and     g: "cont g"
 shows      "cont (\<lambda>x. f x \<sqinter> g x)"
 proof -
    have A:"\<And>x. cont f \<Longrightarrow> cont g \<Longrightarrow> cont (\<lambda>X. (f x)\<sqinter> X)"
           apply(rule contI2, rule monofunI)
           apply(auto)
           apply(subst Ndet_commute, subst cont_Ndet1)
           by   (auto simp:Ndet_commute)
    have B:"\<And>y. cont f \<Longrightarrow> cont g \<Longrightarrow> cont (\<lambda>x. f x \<sqinter> y)"
           apply(rule_tac c="(\<lambda> g. g \<sqinter> y)" in cont_compose)
           apply(rule contI2,rule monofunI)
           by   (simp_all add: cont_Ndet1)
    show ?thesis using f g
    by (rule_tac f="(\<lambda> x. (\<lambda> g. f x \<sqinter> g))" in cont_apply, auto simp: A B)
 qed
 
 
 end
diff --git a/thys/HOL-CSP/Process.thy b/thys/HOL-CSP/Process.thy
--- a/thys/HOL-CSP/Process.thy
+++ b/thys/HOL-CSP/Process.thy
@@ -1,1293 +1,1306 @@
 (*<*)
 \<comment>\<open> ********************************************************************
  * Project         : HOL-CSP - A Shallow Embedding of CSP in  Isabelle/HOL
  * Version         : 2.0
  *
- * Author          : Benoit Ballenghien, Safouan Taha, Burkhart Wolff & Lina Ye
+ * Author          : Benoit Ballenghien, Safouan Taha, Burkhart Wolff
  *                   (Based on HOL-CSP 1.0 by Haykal Tej and Burkhart Wolff)
  *
  * This file       : A Combined CSP Theory
  *
  * Copyright (c) 2009 Université Paris-Sud, France
  * Copyright (c) 2023 Université Paris-Saclay, France
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials provided
  *       with the distribution.
  *
  *     * Neither the name of the copyright holders nor the names of its
  *       contributors may be used to endorse or promote products derived
  *       from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  ******************************************************************************\<close>
 (*>*)
 
 chapter\<open>The Notion of Processes\<close>
 
 text\<open>As mentioned earlier, we base the theory of CSP on HOLCF, a Isabelle/HOL library
 providing a theory of continuous functions, fixpoint induction and recursion.\<close>
 
 theory Process
   imports HOLCF
 begin
 
 text\<open>Since HOLCF sets the default type class to @{class "cpo"}, while our 
 Process theory establishes links between standard types and @{class "pcpo"} 
 types. Consequently, we reset the default type class to the default in HOL.\<close>
 
 default_sort type
 
 section\<open>Pre-Requisite: Basic Traces and tick-Freeness\<close>
 
 text\<open>The denotational semantics of CSP assumes a distinguishable
 special event, called \verb+tick+ and written $\checkmark$, that is required
 to occur only in the end of traces in order to signalize successful termination of
 a process. (In the original text of Hoare, this treatment was more
 liberal and lead to foundational problems: the process invariant
 could not be established for the sequential composition operator
 of CSP; see @{cite "tej.ea:corrected:1997"} for details.)\<close>
 
 datatype '\<alpha> event = ev '\<alpha> | tick
 
 type_synonym '\<alpha> trace = "('\<alpha> event) list"
 
 text\<open>We chose as standard ordering on traces the prefix ordering.\<close>
 
 instantiation  list :: (type) order
 begin 
 
 definition  le_list_def  : "(s::'a list) \<le> t \<longleftrightarrow> (\<exists> r. s @ r = t)"
 
 definition  less_list_def: "(s::'a list) < t \<longleftrightarrow> s \<le> t \<and> s \<noteq> t" 
 
 lemma A : "((x::'a list) < y) = (x \<le> y \<and> \<not> y \<le> x)"
 by(auto simp: le_list_def less_list_def)
 
 instance 
 proof
    fix x y z ::"'a list"
    show "(x < y) = (x \<le> y \<and> \<not> y \<le> x)" 
      by(auto simp: le_list_def less_list_def)
    show "x \<le> x"  by(simp add: le_list_def)
    assume A:"x \<le> y" and B:"y \<le> z" thus "x \<le> z"
      apply(insert A B, simp add: le_list_def, safe)  
      apply(rename_tac r ra, rule_tac x="r@ra" in exI, simp)
      done
    assume A:"x \<le> y" and B:"y \<le> x" thus "x = y"
      by(insert A B, auto simp: le_list_def)  
 qed
 
 end
 
 text\<open>Some facts on the prefix ordering.\<close>
 
 lemma nil_le[simp]: "[] \<le> s"
 by(induct "s", simp_all, auto simp: le_list_def) 
 
 lemma nil_le2[simp]: "s \<le> [] = (s = [])"
 by(induct "s", auto simp:le_list_def)
 
 lemma nil_less[simp]: "\<not> t < []"
 by(simp add: less_list_def)
 
 lemma nil_less2[simp]: "[] < t @ [a]"
 by(simp add: less_list_def)
 
 lemma less_self[simp]: "t < t@[a]"
 by(simp add:less_list_def le_list_def)
    
 lemma le_length_mono: "s \<le> t \<Longrightarrow> length s \<le> length t"
 by(auto simp: le_list_def)
 
 lemma less_length_mono: "s < t \<Longrightarrow> length s < length t"
 by(auto simp: less_list_def le_list_def)
 
 lemma less_cons: "s < t \<Longrightarrow> a # s < a # t"
 by (simp add: le_list_def less_list_def)
 
 lemma less_append: "s < t \<Longrightarrow> a @ s < a @ t"
 by (simp add: le_list_def less_list_def)
 
 lemma less_tail: "s \<noteq> [] \<Longrightarrow> s < t \<Longrightarrow> tl s < tl t"
 by (auto simp add: le_list_def less_list_def)
 
 \<comment>\<open>should be in the List library\<close>
 lemma list_nonMt_append: "s \<noteq> [] \<Longrightarrow> \<exists> a t. s = t @ [a]"
 by(erule rev_mp,induct "s",simp_all,case_tac "s = []",auto)
 
 lemma append_eq_first_pref_spec[rule_format]: "s @ t = r @ [x] \<and> t \<noteq> [] \<longrightarrow> s \<le> r"
   apply(rule_tac x=s in spec)
   apply(induct r,auto)
     apply(erule rev_mp)
     apply(rename_tac xa, rule_tac list=xa in list.induct, simp_all)
   apply(simp add: le_list_def)
   apply(drule list_nonMt_append, auto)
   done
 
 lemma prefixes_fin: "let prefixes = {t. \<exists>t2. x = t @ t2} in finite prefixes \<and> card prefixes = length x + 1"  
 proof(induct x, simp)
   case (Cons a x)
   hence A:"finite {t. (\<exists>t2. x = t @ t2)}" using not_add_less2 by fastforce
   have B:"inj_on Cons UNIV" by (metis injI list.inject)
   from Cons A B inj_on_iff_eq_card have  C:"card ((\<lambda>x. a#x)`{t. (\<exists>t2. x = t @ t2)}) = length x + 1"
     by fastforce
   have D:"{t. \<exists>t2. a # x = t @ t2} = {[]} \<union> (\<lambda>x. a#x)`{t. (\<exists>t2. x = t @ t2)}" 
     by(intro set_eqI iffI, auto simp add:Cons_eq_append_conv) 
   from C D card_insert_if[of "(\<lambda>x. a#x)`{t. (\<exists>t2. x = t @ t2)}"] show ?case 
     by (metis (no_types, lifting) One_nat_def Suc_eq_plus1 Un_insert_left finite.insertI 
         finite_imageI image_iff list.distinct(1) list.size(4) local.A sup_bot.left_neutral)
 qed
 
 lemma sublists_fin: "finite {t. \<exists>t1 t2. x = t1 @ t @ t2}"
   proof(induct x, simp)
     case (Cons a x)
     have "{t. \<exists>t1 t2. a # x = t1 @ t @ t2} \<subseteq> {t. \<exists>t1 t2. x = t1 @ t @ t2} \<union> {t. \<exists>t2. a#x = t @ t2}"
       apply(auto) by (metis Cons_eq_append_conv)
     with Cons prefixes_fin[of "a#x"] show ?case by (meson finite_UnI finite_subset)
   qed
 
 lemma suffixes_fin: "finite {t. \<exists>t1. x = t1 @ t}"
   apply(subgoal_tac "{t. \<exists>t1. x = t1 @ t} \<subseteq> {t. \<exists>t1 t2. x = t1 @ t @ t2}")
   using infinite_super sublists_fin apply blast
   by blast
 
 text\<open>For the process invariant, it is a key element to
 reduce the notion of traces to traces that may only contain
 one tick event at the very end. This is captured by the definition
 of the predicate \verb+front_tickFree+ and its stronger version
 \verb+tickFree+. Here is the theory of this concept.\<close>
 
 definition tickFree :: "'\<alpha> trace \<Rightarrow> bool"
   where "tickFree s = (tick \<notin> set s)"
 
 definition front_tickFree :: "'\<alpha> trace \<Rightarrow> bool"
   where "front_tickFree s = (s =[] \<or> tickFree(tl(rev s)))"
 
 lemma tickFree_Nil [simp]: "tickFree []"
 by(simp add: tickFree_def)
 
 lemma tickFree_Cons [simp]: "tickFree (a # t) = (a \<noteq> tick \<and> tickFree t)"
 by(auto simp add: tickFree_def)
 
-lemma tickFree_tl : "[|s ~= [] ; tickFree s|] ==> tickFree(tl s)"
+lemma tickFree_tl : "tickFree s \<Longrightarrow> tickFree(tl s)"
 by(case_tac s, simp_all)
   
 lemma tickFree_append[simp]: "tickFree(s@t) = (tickFree s \<and> tickFree t)"
 by(simp add: tickFree_def member_def)
 
 lemma non_tickFree_tick [simp]: "\<not> tickFree [tick]"
 by(simp add: tickFree_def)
 
 lemma non_tickFree_implies_nonMt: "\<not> tickFree s \<Longrightarrow> s \<noteq> []"
 by(simp add:tickFree_def,erule rev_mp, induct s, simp_all)
 
 lemma  tickFree_rev : "tickFree(rev t) = (tickFree t)"
 by(simp  add: tickFree_def member_def)
 
 lemma front_tickFree_Nil[simp]: "front_tickFree []"
 by(simp add: front_tickFree_def)
 
 lemma front_tickFree_single[simp]: "front_tickFree [a]"
 by(simp add: front_tickFree_def)
 
 lemma tickFree_implies_front_tickFree: "tickFree s \<Longrightarrow> front_tickFree s"
 apply(simp add: tickFree_def front_tickFree_def member_def,safe)
 apply(erule contrapos_np, simp,(erule rev_mp)+)
 apply(rule_tac xs=s in List.rev_induct,simp_all)
 done
 
 lemma front_tickFree_charn: "front_tickFree s = (s = [] \<or> (\<exists>a t. s = t @ [a] \<and> tickFree t))"
 apply(simp add: front_tickFree_def)
 apply(cases "s=[]", simp_all)
 apply(drule list_nonMt_append, auto simp: tickFree_rev)
 done
 
 lemma front_tickFree_implies_tickFree: "front_tickFree (t @ [a]) \<Longrightarrow> tickFree t"
 by(simp add: tickFree_def front_tickFree_def member_def)
 
 lemma tickFree_implies_front_tickFree_single: "tickFree t \<Longrightarrow> front_tickFree (t @ [a])"
 by(simp add:front_tickFree_charn) 
 
 
 lemma nonTickFree_n_frontTickFree: "\<lbrakk>\<not> tickFree s; front_tickFree s \<rbrakk> \<Longrightarrow> \<exists>t. s = t @ [tick]"
 apply(frule non_tickFree_implies_nonMt)
 apply(drule front_tickFree_charn[THEN iffD1], auto)
 done
 
 lemma front_tickFree_dw_closed : "front_tickFree (s @ t) \<Longrightarrow>  front_tickFree s"
 apply(erule rev_mp, rule_tac x= s in spec)
 apply(rule_tac xs=t in List.rev_induct, simp, safe)
 apply(rename_tac x xs xa)
 apply(simp only: append_assoc[symmetric])
 apply(rename_tac x xs xa, erule_tac x="xa @ xs" in all_dupE)
 apply(drule front_tickFree_implies_tickFree)
 apply(erule_tac x="xa" in allE, auto)
 apply(auto dest!:tickFree_implies_front_tickFree)
 done
 
 lemma front_tickFree_append: "\<lbrakk> tickFree s; front_tickFree t\<rbrakk> \<Longrightarrow> front_tickFree (s @ t)"
 apply(drule front_tickFree_charn[THEN iffD1], auto)
 apply(erule tickFree_implies_front_tickFree)
 apply(subst append_assoc[symmetric])
 apply(rule tickFree_implies_front_tickFree_single)
 apply(auto intro: tickFree_append)
 done
 
 lemma front_tickFree_mono: "front_tickFree (t @ r) \<and> r \<noteq> [] \<longrightarrow> tickFree t \<and> front_tickFree r"
 by(metis append_assoc append_butlast_last_id front_tickFree_charn 
          front_tickFree_implies_tickFree tickFree_append)
 
 
+lemma tickFree_butlast: \<open>tickFree s \<longleftrightarrow> tickFree (butlast s) \<and> (s \<noteq> [] \<longrightarrow> last s \<noteq> tick)\<close>
+  by (induct s, simp_all)
+
+lemma front_tickFree_butlast: \<open>front_tickFree s \<longleftrightarrow> tickFree (butlast s)\<close>
+  by (induct s, auto simp add: front_tickFree_def)
+
+
 section\<open> Basic Types, Traces, Failures and Divergences \<close>
 
 type_synonym '\<alpha> refusal = "('\<alpha> event) set"
 type_synonym '\<alpha> failure = "'\<alpha> trace \<times> '\<alpha> refusal"
 type_synonym '\<alpha> divergence = "'\<alpha> trace set"
 type_synonym '\<alpha> process\<^sub>0 = "'\<alpha> failure set \<times> '\<alpha> divergence"
  
 definition FAILURES :: "'\<alpha> process\<^sub>0 \<Rightarrow> ('\<alpha> failure set)"
   where "FAILURES P = fst P"
 
 definition TRACES :: "'\<alpha> process\<^sub>0 \<Rightarrow> ('\<alpha> trace set)"
   where "TRACES P = {tr. \<exists> a. a \<in> FAILURES P \<and> tr = fst a}"
 
 definition DIVERGENCES :: "'\<alpha> process\<^sub>0 \<Rightarrow> '\<alpha> divergence"
   where "DIVERGENCES P = snd P"
 
 definition REFUSALS :: "'\<alpha> process\<^sub>0 \<Rightarrow> ('\<alpha> refusal set)"
   where "REFUSALS P = {ref.  \<exists> F. F \<in> FAILURES P \<and> F = ([],ref)}"
 
 section\<open> The Process Type Invariant \<close>
 
 definition is_process :: "'\<alpha> process\<^sub>0 \<Rightarrow> bool" where
   "is_process P =
       (([],{}) \<in> FAILURES P \<and>
        (\<forall> s X.  (s,X) \<in> FAILURES P \<longrightarrow> front_tickFree s) \<and>
        (\<forall> s t . (s@t,{}) \<in> FAILURES P \<longrightarrow> (s,{}) \<in> FAILURES P) \<and>
        (\<forall> s X Y. (s,Y) \<in> FAILURES P & X <= Y \<longrightarrow> (s,X) \<in> FAILURES P) \<and> 
        (\<forall> s X Y. (s,X) \<in> FAILURES P \<and>
        (\<forall> c.      c \<in> Y \<longrightarrow> ((s@[c],{})\<notin>FAILURES P)) \<longrightarrow> 
                                          (s,X \<union> Y)\<in>FAILURES P) \<and>
        (\<forall> s X.  (s@[tick],{}) : FAILURES P \<longrightarrow> (s,X-{tick}) \<in> FAILURES P) \<and>
        (\<forall> s t.  s \<in> DIVERGENCES P \<and> tickFree s \<and> front_tickFree t 
                                       \<longrightarrow> s@t \<in> DIVERGENCES P)  \<and>
        (\<forall> s X. s \<in> DIVERGENCES P \<longrightarrow> (s,X) \<in> FAILURES P) \<and>
        (\<forall> s. s @ [tick] : DIVERGENCES P \<longrightarrow> s \<in> DIVERGENCES P))"
 
 
 lemma is_process_spec:
  "is_process P = 
        (([],{}) \<in>  FAILURES P \<and>
        (\<forall> s X. (s,X) \<in>  FAILURES P \<longrightarrow> front_tickFree s) \<and>
        (\<forall> s t . (s @ t,{}) \<notin> FAILURES P \<or>   (s,{}) \<in> FAILURES P) \<and>
        (\<forall> s X Y. (s,Y)  \<notin>  FAILURES P \<or> \<not>(X\<subseteq>Y) | (s,X) \<in> FAILURES P) \<and>
        (\<forall> s X Y.(s,X) \<in> FAILURES P \<and> 
        (\<forall> c. c \<in>  Y \<longrightarrow> ((s@[c],{}) \<notin>  FAILURES P)) \<longrightarrow>(s,X \<union> Y) \<in>  FAILURES P) \<and>
        (\<forall> s X. (s@[tick],{}) \<in>  FAILURES P \<longrightarrow> (s,X - {tick}) \<in>  FAILURES P) \<and>
        (\<forall> s t. s \<notin> DIVERGENCES P \<or> \<not>tickFree s \<or> \<not>front_tickFree t 
                                  \<or> s @ t \<in> DIVERGENCES P) \<and>
        (\<forall> s X. s \<notin> DIVERGENCES P \<or> (s,X) \<in>  FAILURES P) \<and>
        (\<forall> s. s @ [tick] \<notin>  DIVERGENCES P \<or> s \<in>  DIVERGENCES P))"
 by(simp  only: is_process_def  HOL.nnf_simps(1)  HOL.nnf_simps(3) [symmetric]  
                       HOL.imp_conjL[symmetric])
 
 lemma Process_eqI :
 assumes A: "FAILURES P = FAILURES Q "
 assumes B: "DIVERGENCES P = DIVERGENCES Q"
 shows      "(P::'\<alpha> process\<^sub>0) = Q"
 apply(insert A B, unfold FAILURES_def DIVERGENCES_def) 
 apply(rule_tac t=P in surjective_pairing[symmetric,THEN subst])
 apply(rule_tac t=Q in surjective_pairing[symmetric,THEN subst])
 apply(simp)
 done
 
 lemma process_eq_spec:
 "((P::'a process\<^sub>0) = Q) = (FAILURES P = FAILURES Q \<and> DIVERGENCES P = DIVERGENCES Q)"
 apply(auto simp: FAILURES_def DIVERGENCES_def)
 apply(rule_tac t=P in surjective_pairing[symmetric,THEN subst])
 apply(rule_tac t=Q in surjective_pairing[symmetric,THEN subst])
 apply(simp)
 done
 
 lemma process_surj_pair: "(FAILURES P,DIVERGENCES P) = P"
 by(auto simp:FAILURES_def DIVERGENCES_def)
 
 lemma Fa_eq_imp_Tr_eq: "FAILURES P = FAILURES Q \<Longrightarrow> TRACES P = TRACES Q"
 by(auto simp:FAILURES_def DIVERGENCES_def TRACES_def) 
 
 lemma is_process1:  "is_process P \<Longrightarrow> ([],{})\<in> FAILURES P "
 by(auto simp: is_process_def)
 
 lemma is_process2: "is_process P \<Longrightarrow> \<forall> s X. (s,X) \<in> FAILURES P \<longrightarrow> front_tickFree s "
 by(simp only: is_process_spec, metis)
 
 lemma is_process3: "is_process P \<Longrightarrow> \<forall> s t. (s @ t,{}) \<in> FAILURES P \<longrightarrow> (s, {}) \<in> FAILURES P"
 by(simp only: is_process_spec, metis)
 
 
 lemma is_process3_S_pref: "\<lbrakk>is_process P; (t, {}) \<in> FAILURES P; s \<le> t\<rbrakk> \<Longrightarrow> (s, {}) \<in> FAILURES P"
 by(auto simp: le_list_def intro: is_process3 [rule_format])
 
 lemma is_process4: "is_process P \<Longrightarrow> \<forall>s X Y. (s, Y) \<notin> FAILURES P \<or> \<not> X \<subseteq> Y \<or> (s, X) \<in> FAILURES P"
 by(simp only: is_process_spec, simp)
 
 lemma is_process4_S: "\<lbrakk>is_process P; (s, Y) \<in> FAILURES P; X \<subseteq> Y\<rbrakk> \<Longrightarrow> (s, X) \<in> FAILURES P"
 by(drule is_process4, auto)
 
 lemma is_process4_S1: "\<lbrakk>is_process P; x \<in> FAILURES P; X \<subseteq> snd x\<rbrakk> \<Longrightarrow> (fst x, X) \<in> FAILURES P"
 by(drule is_process4_S, auto)
 
 lemma is_process5:
 "is_process P \<Longrightarrow>
     \<forall>sa X Y. (sa, X) \<in> FAILURES P \<and> (\<forall>c. c \<in> Y \<longrightarrow> (sa @ [c], {}) \<notin> FAILURES P) \<longrightarrow> (sa, X \<union> Y) \<in> FAILURES P"
 by(drule is_process_spec[THEN iffD1],metis)
 
 lemma is_process5_S:
 "\<lbrakk>is_process P; (sa, X) \<in> FAILURES P; \<forall>c. c \<in> Y \<longrightarrow> (sa @ [c], {}) \<notin> FAILURES P\<rbrakk> \<Longrightarrow> (sa, X \<union> Y) \<in> FAILURES P"
 by(drule is_process5, metis)
 
 lemma is_process5_S1:
 "\<lbrakk>is_process P; (sa, X) \<in> FAILURES P; (sa, X \<union> Y) \<notin> FAILURES P\<rbrakk> \<Longrightarrow> \<exists>c. c \<in> Y \<and> (sa @ [c], {}) \<in> FAILURES P"
 by(erule contrapos_np, drule is_process5_S, simp_all)
 
 lemma is_process6: "is_process P \<Longrightarrow>  \<forall> s X. (s@[tick],{}) \<in> FAILURES P \<longrightarrow> (s,X-{tick}) \<in> FAILURES P"
 by(drule is_process_spec[THEN iffD1], metis)
 
 lemma is_process6_S: "\<lbrakk>is_process P ;(s@[tick],{}) \<in> FAILURES P\<rbrakk> \<Longrightarrow>  (s,X-{tick}) \<in> FAILURES P"
 by(drule is_process6, metis)
 
 lemma is_process7:
 "is_process P \<Longrightarrow> \<forall> s t. s \<notin> DIVERGENCES P \<or> \<not> tickFree s \<or> \<not> front_tickFree t \<or> s @ t \<in> DIVERGENCES P"
 by(drule is_process_spec[THEN iffD1], metis)
 
 lemma is_process7_S:
 "\<lbrakk> is_process P;s : DIVERGENCES P;tickFree s;front_tickFree t\<rbrakk> 
  \<Longrightarrow>  s @ t \<in> DIVERGENCES P"
 by(drule is_process7, metis)
 
 lemma is_process8: "is_process P \<Longrightarrow> \<forall>  s X. s \<notin> DIVERGENCES P \<or>  (s,X) \<in> FAILURES P"
 by(drule is_process_spec[THEN iffD1], metis)
 
 lemma is_process8_S: "\<lbrakk> is_process P; s \<in> DIVERGENCES P \<rbrakk> \<Longrightarrow> (s,X)  \<in> FAILURES P"
 by(drule is_process8, metis)
 
 lemma is_process9: "is_process P \<Longrightarrow> \<forall>  s. s@[tick] \<notin> DIVERGENCES P \<or>  s \<in> DIVERGENCES P"
 by(drule is_process_spec[THEN iffD1], metis)
 
 lemma is_process9_S: "\<lbrakk> is_process P;s@[tick] \<in> DIVERGENCES P \<rbrakk> \<Longrightarrow> s \<in> DIVERGENCES P"
 by(drule is_process9, metis)
 
 lemma Failures_implies_Traces: " \<lbrakk>is_process P; (s, X) \<in> FAILURES P\<rbrakk> \<Longrightarrow> s \<in> TRACES P"
 by(simp add: TRACES_def, metis)
 
 lemma is_process5_sing: 
 "\<lbrakk> is_process P ; (s,{x}) \<notin> FAILURES P;(s,{}) \<in> FAILURES P\<rbrakk> \<Longrightarrow> (s @ [x],{}) \<in> FAILURES P"
 by(drule_tac X="{}" in is_process5_S1, auto)
 
 lemma is_process5_singT: 
 "\<lbrakk> is_process P ; (s,{x}) \<notin> FAILURES P;(s,{}) \<in> FAILURES P\<rbrakk>  \<Longrightarrow> s @ [x]  \<in> TRACES P"
 apply(drule is_process5_sing, auto)
 by(simp add: TRACES_def, auto)
 
 
 lemma front_trace_is_tickfree:
 assumes A: "is_process P" and B: "(t @ [tick],X) \<in> FAILURES P"
 shows     "tickFree t"
 proof -
   have C: "front_tickFree(t @ [tick])" by(insert A B, drule is_process2, metis) 
   show ?thesis  by(rule front_tickFree_implies_tickFree[OF C])   
 qed
 
 
 lemma trace_with_Tick_implies_tickFree_front : "\<lbrakk>is_process P; t @ [tick] \<in> TRACES P\<rbrakk> \<Longrightarrow> tickFree t"
 by(auto simp: TRACES_def intro: front_trace_is_tickfree)
 
 
 section \<open> The Abstraction to the process-Type \<close>
 
 typedef 
   '\<alpha> process = "{p :: '\<alpha> process\<^sub>0 . is_process p}"
 proof - 
-   have "({(s, X). s = []},{}) \<in> {p::'\<alpha> process\<^sub>0. is_process p}"
-        by(simp add: is_process_def  front_tickFree_def
-                     FAILURES_def TRACES_def DIVERGENCES_def )
-   thus ?thesis by auto
+  have "({(s, X). s = []},{}) \<in> {p::'\<alpha> process\<^sub>0. is_process p}"
+    by(simp add: is_process_def  front_tickFree_def
+                 FAILURES_def TRACES_def DIVERGENCES_def )
+  thus ?thesis by auto
 qed
 
-definition Failures :: "'\<alpha> process \<Rightarrow>  ('\<alpha> failure set)" ("\<F>")
-  where "\<F> P = FAILURES (Rep_process P)"
-
-definition Traces :: "'\<alpha> process \<Rightarrow>  ('\<alpha> trace set)"   ("\<T>")
-  where "\<T> P = TRACES (Rep_process P)"
+setup_lifting type_definition_process
 
-definition Divergences :: "'\<alpha> process \<Rightarrow> '\<alpha> divergence"     ("\<D>")
-  where "\<D> P = DIVERGENCES (Rep_process P)"
+text \<open>This is where we differ from previous versions: we lift definitions 
+      using Isabelle's machinery instead of doing it by hand.\<close>
 
-lemmas D_def = Divergences_def
+lift_definition Failures :: "'\<alpha> process \<Rightarrow> ('\<alpha> failure set)" ("\<F>")
+  is "\<lambda>P. FAILURES P" .
 
-definition R :: "'\<alpha> process \<Rightarrow> ('\<alpha> refusal set)"  ("\<R>")
-  where "\<R> P = REFUSALS (Rep_process P)"
+
+lift_definition Traces :: "'\<alpha> process \<Rightarrow>  ('\<alpha> trace set)"   ("\<T>")
+  is "\<lambda>P. TRACES P" .
+
+
+lift_definition Divergences :: "'\<alpha> process \<Rightarrow> '\<alpha> divergence"     ("\<D>")
+  is "\<lambda>P. DIVERGENCES P" .
+
+
+lift_definition Refusals :: "'\<alpha> process \<Rightarrow> ('\<alpha> refusal set)"  ("\<R>")
+  is "\<lambda>P. REFUSALS P" .
+
 
 
 lemma is_process_Rep : "is_process (Rep_process P)"
-by(rule_tac P=is_process in CollectD, rule Rep_process)
+  using Rep_process by blast
+
 
 lemma Process_spec: "Abs_process (\<F> P, \<D> P) = P"
-by(simp add: Failures_def FAILURES_def D_def 
-             DIVERGENCES_def Rep_process_inverse)
+  by (simp add: Divergences.rep_eq Failures.rep_eq Rep_process_inverse process_surj_pair)
+
 
 lemma Process_eq_spec: "(P = Q) = (\<F> P = \<F> Q \<and> \<D> P = \<D> Q)"
-  apply(rule iffI,simp)
-  apply(rule_tac t=P in Process_spec[THEN subst])
-  apply(rule_tac t=Q in Process_spec[THEN subst])
-  by simp
+  by (metis Process_spec)
   
 
 lemma Process_eq_spec_optimized: "(P = Q) = (\<D> P = \<D> Q \<and> (\<D> P = \<D> Q \<longrightarrow> \<F> P = \<F> Q))"
   using Process_eq_spec by auto
 
 lemma is_processT:
 "([],{}) \<in> \<F> P \<and>
  (\<forall> s X. (s,X) \<in> \<F> P \<longrightarrow> front_tickFree s) \<and>
  (\<forall> s t .(s@t,{}) \<in> \<F> P \<longrightarrow> (s,{}) \<in> \<F> P) \<and>
  (\<forall> s X Y.(s,Y) \<in> \<F> P \<and> (X\<subseteq>Y) \<longrightarrow> (s,X) \<in> \<F> P) \<and>
  (\<forall> s X Y.(s,X) \<in> \<F> P \<and> (\<forall>c. c \<in> Y \<longrightarrow>((s@[c],{})\<notin> \<F> P)) \<longrightarrow> (s,X \<union> Y) \<in> \<F> P) \<and>
  (\<forall> s X. (s@[tick],{}) \<in> \<F> P \<longrightarrow> (s, X-{tick}) \<in> \<F> P) \<and>
  (\<forall> s t. s \<in> \<D> P \<and> tickFree s \<and> front_tickFree t \<longrightarrow> s @ t \<in> \<D> P) \<and>
  (\<forall> s X. s \<in> \<D> P \<longrightarrow> (s,X) \<in> \<F> P) \<and>
- (\<forall> s. s@[tick] \<in> \<D> P \<longrightarrow> s \<in> \<D> P)"
-apply(simp only: Failures_def D_def Traces_def)
-apply(rule is_process_def[THEN iffD1])
-apply(rule is_process_Rep)
-done
+ (\<forall> s. s@[tick] \<in> \<D> P \<longrightarrow> s \<in> \<D> P)" 
+  apply (simp add: Divergences.rep_eq Failures.rep_eq)
+  by (meson is_process_spec[of \<open>Rep_process P\<close>, simplified Rep_process[simplified]])
+  
+ 
 
 lemma process_charn:
   "([], {}) \<in> \<F> P \<and>
     (\<forall>s X. (s, X) \<in> \<F> P \<longrightarrow> front_tickFree s) \<and>
     (\<forall>s t. (s @ t, {}) \<notin> \<F> P \<or> (s, {}) \<in> \<F> P) \<and>
     (\<forall>s X Y. (s, Y) \<notin> \<F> P \<or> \<not> X \<subseteq> Y \<or> (s, X) \<in> \<F> P) \<and>
     (\<forall>s X Y. (s, X) \<in> \<F> P \<and> (\<forall>c. c \<in> Y \<longrightarrow> (s @ [c], {}) \<notin> \<F> P) \<longrightarrow> (s, X \<union> Y) \<in> \<F> P) \<and>
     (\<forall>s X. (s @ [tick], {}) \<in> \<F> P \<longrightarrow> (s, X - {tick}) \<in> \<F> P) \<and>
     (\<forall>s t. s \<notin> \<D> P \<or> \<not> tickFree s \<or> \<not> front_tickFree t \<or> s @ t \<in> \<D> P) \<and>
     (\<forall>s X. s \<notin> \<D> P \<or> (s, X) \<in> \<F> P) \<and> (\<forall>s. s @ [tick] \<notin> \<D> P \<or> s \<in> \<D> P)"
+  (* by (meson is_processT) *)
 proof -
   {
     have A: "(\<forall>s t. (s @ t, {}) \<notin> \<F> P \<or>  (s, {}) \<in> \<F> P) = 
       (\<forall>s t. (s @ t, {}) \<in> \<F> P \<longrightarrow> (s, {}) \<in> \<F> P)"
       by metis
 
     have B : "(\<forall>s X Y. (s, Y) \<notin> \<F> P \<or> \<not> X \<subseteq> Y \<or> (s, X) \<in> \<F> P)  =
       (\<forall>s X Y. (s, Y) \<in> \<F> P \<and> X \<subseteq> Y \<longrightarrow> (s, X) \<in> \<F> P) "
       by metis
 
     have C : "(\<forall>s t. s \<notin> \<D> P \<or> \<not> tickFree s \<or> 
       \<not> front_tickFree t \<or> s @ t \<in> \<D> P)  =
       (\<forall>s t. s \<in> \<D> P \<and> tickFree s \<and> front_tickFree t \<longrightarrow> s @ t \<in> \<D> P) "
       by metis
 
     have D:"(\<forall>s X. s \<notin> \<D> P \<or> (s, X) \<in> \<F> P) = (\<forall>s X. s \<in> \<D> P \<longrightarrow> (s, X) \<in> \<F> P)"
       by metis
 
     have E:"(\<forall>s. s @ [tick] \<notin> \<D> P \<or> s \<in> \<D> P) = 
       (\<forall>s. s @ [tick] \<in> \<D> P \<longrightarrow> s \<in> \<D> P)"
       by metis
 
     note A B C D E 
   }
   note a = this
   then
   show ?thesis
     apply(simp only: a)
     apply(rule is_processT)
     done
 qed
 
 
 text\<open> split of \verb+is_processT+: \<close>
 
 lemma is_processT1: "([], {}) \<in> \<F> P"
 by(simp add:process_charn)
 
 lemma is_processT2: "\<forall>s X. (s, X) \<in> \<F> P \<longrightarrow> front_tickFree s"
 by(simp add:process_charn)
 
 lemma  is_processT2_TR : "\<forall>s. s \<in> \<T> P \<longrightarrow> front_tickFree s"
-apply(simp add: Failures_def [symmetric] Traces_def TRACES_def, safe)
-apply (drule is_processT2[rule_format], assumption)
-done
+  apply (simp add: Traces.rep_eq Traces_def TRACES_def Failures.rep_eq[symmetric])
+  using is_processT2 by blast
+  
 
 lemma is_proT2:
   assumes A : " (s, X) \<in> \<F> P" and B : " s \<noteq> []"
   shows   "tick \<notin> set (tl (rev s))"
 proof -
   have C: "front_tickFree s" by(insert A B, simp add: is_processT2)
   show ?thesis
   by(insert C,simp add: B  tickFree_def front_tickFree_def) 
 qed
 
 lemma is_processT3 : "\<forall>s t. (s @ t, {}) \<in> \<F> P \<longrightarrow> (s, {}) \<in> \<F> P"
 by(simp only: process_charn  HOL.nnf_simps(3), simp)
 
 lemma is_processT3_S_pref : 
 "\<lbrakk>(t, {}) \<in> \<F> P; s \<le> t\<rbrakk> \<Longrightarrow> (s, {}) \<in> \<F> P"
 apply(simp only: le_list_def, safe)
 apply(erule is_processT3[rule_format])
 done
 
 lemma  is_processT4 : "\<forall>s X Y. (s, Y) \<in> \<F> P \<and> X \<subseteq> Y \<longrightarrow> (s, X) \<in> \<F> P"
 by(insert  process_charn [of P], metis)
 
 lemma is_processT4_S1 : "\<lbrakk>x \<in> \<F> P; X \<subseteq> snd x\<rbrakk> \<Longrightarrow> (fst x, X) \<in> \<F> P"
 apply(rule_tac Y = "snd x" in is_processT4[rule_format])
 apply simp
 done
 
 lemma is_processT5: 
 "\<forall>s X Y. (s, X) \<in> \<F> P \<and> (\<forall>c. c \<in> Y \<longrightarrow> (s @ [c], {}) \<notin> \<F> P) \<longrightarrow> (s, X \<union> Y) \<in> \<F> P"
 by(simp add: process_charn)
 
 lemma is_processT5_S1: 
 "(s, X) \<in> \<F> P \<Longrightarrow> (s, X \<union> Y) \<notin> \<F> P \<Longrightarrow> \<exists>c. c \<in> Y \<and> (s @ [c], {}) \<in> \<F> P"
 by(erule contrapos_np, simp add: is_processT5[rule_format])
 
 lemma is_processT5_S2: "(s, X) \<in> \<F> P \<Longrightarrow> (s @ [c], {}) \<notin> \<F> P \<Longrightarrow> (s, X \<union> {c}) \<in> \<F> P"
 by(rule is_processT5[rule_format,OF conjI], metis, safe)
 
 
 lemma is_processT5_S2a: "(s, X) \<in> \<F> P \<Longrightarrow> (s, X \<union> {c}) \<notin> \<F> P \<Longrightarrow> (s @ [c], {}) \<in> \<F> P"
 apply(erule contrapos_np)
 apply(rule is_processT5_S2)
 apply(simp_all)
 done
 
 lemma  is_processT5_S3:
 assumes A: "(s, {}) \<in> \<F> P"
 and     B: "(s @ [c], {}) \<notin> \<F> P"
 shows      "(s, {c}) \<in> \<F> P"
 proof -
    have C : " {c} = ({} Un {c})" by simp
    show ?thesis
    by(subst C, rule is_processT5_S2, simp_all add: A B)
 qed
    
 lemma is_processT5_S4: "(s, {}) \<in> \<F> P \<Longrightarrow> (s, {c}) \<notin> \<F> P \<Longrightarrow> (s @ [c], {}) \<in> \<F> P"
 by(erule contrapos_np, simp add: is_processT5_S3)
 
 
 lemma is_processT5_S5:
 "(s, X) \<in> \<F> P \<Longrightarrow> \<forall>c. c \<in> Y \<longrightarrow> (s, X \<union> {c}) \<notin> \<F> P \<Longrightarrow> \<forall>c. c \<in> Y \<longrightarrow> (s @ [c], {}) \<in> \<F> P"
 by(erule_tac Q = "\<forall>c. c \<in> Y \<longrightarrow> (s, X \<union> {c}) \<notin> \<F> P" in contrapos_pp, metis is_processT5_S2) 
 
 lemma is_processT5_S6: "([], {c}) \<notin> \<F> P \<Longrightarrow> ([c], {}) \<in> \<F> P"
 apply(rule_tac t="[c]" and s="[]@[c]" in subst, simp)
 apply(rule is_processT5_S4, simp_all add: is_processT1)
 done
 
 lemma is_processT6: "\<forall>s X. (s @ [tick], {}) \<in> \<F> P \<longrightarrow> (s, X - {tick}) \<in> \<F> P"
 by(simp add: process_charn)
 
 
 lemma is_processT7:  "\<forall>s t. s \<in> \<D> P \<and> tickFree s \<and> front_tickFree t \<longrightarrow> s @ t \<in> \<D> P"
 by(insert process_charn[of P], metis)
 
 lemmas is_processT7_S = is_processT7[rule_format,OF conjI[THEN conjI, THEN  conj_commute[THEN iffD1]]]
 
 lemma is_processT8: "\<forall>s X. s \<in> \<D> P \<longrightarrow> (s, X) \<in> \<F> P"
 by(insert process_charn[of P], metis)
 
 lemmas is_processT8_S = is_processT8[rule_format]
 
 lemma is_processT8_Pair: "fst s \<in> \<D> P \<Longrightarrow> s \<in> \<F> P"
 apply(subst surjective_pairing)
 apply(rule is_processT8_S, simp)
 done
 
 lemma is_processT9: "\<forall>s. s @ [tick] \<in> \<D> P \<longrightarrow> s \<in> \<D> P"
 by(insert process_charn[of P], metis)
 
 lemma is_processT9_S_swap: "s \<notin> \<D> P \<Longrightarrow> s @ [tick] \<notin> \<D> P"
 by(erule contrapos_nn,simp add: is_processT9[rule_format])
 
 
 section\<open> Some Consequences of the Process Characterization\<close>
 
 lemma no_Trace_implies_no_Failure: "s \<notin> \<T> P \<Longrightarrow> (s, {}) \<notin> \<F> P"
 by(simp add: Traces_def TRACES_def Failures_def)
 
 lemmas  NT_NF = no_Trace_implies_no_Failure
 
 lemma T_def_spec: "\<T> P = {tr. \<exists>a. a \<in> \<F> P \<and> tr = fst a}"
 by(simp add: Traces_def TRACES_def Failures_def)
 
 lemma F_T: "(s, X) \<in> \<F> P \<Longrightarrow> s \<in> \<T> P"
 by(simp add: T_def_spec split_def, metis)
 
 lemma F_T1: "a \<in> \<F> P \<Longrightarrow> fst a \<in> \<T> P"
 by(rule_tac X="snd a" in F_T,simp)
 
 
 lemma T_F: "s \<in> \<T> P \<Longrightarrow> (s, {}) \<in> \<F> P"
 apply(auto simp: T_def_spec)
 apply(drule is_processT4_S1, simp_all)
 done
 
 lemmas is_processT4_empty [elim!]= F_T [THEN T_F]
 
 lemma NF_NT: "(s, {}) \<notin> \<F> P \<Longrightarrow> s \<notin> \<T> P"
   by(erule contrapos_nn, simp only: T_F)
 
 lemma  is_processT6_S1: "tick \<notin> X \<Longrightarrow> (s @ [tick], {}) \<in> \<F> P \<Longrightarrow> (s, X) \<in> \<F> P"
 by(subst Diff_triv[of X "{tick}", symmetric],
    simp, erule is_processT6[rule_format])
 
 lemmas is_processT3_ST = T_F [THEN is_processT3[rule_format,THEN F_T]]
 
 lemmas is_processT3_ST_pref = T_F [THEN is_processT3_S_pref [THEN F_T]]
 
 lemmas is_processT3_SR = F_T [THEN T_F [THEN is_processT3[rule_format]]]
 
 lemmas D_T = is_processT8_S [THEN F_T]
 
 lemma D_T_subset : "\<D> P \<subseteq> \<T> P" by(auto intro!:D_T)
 
 lemma NF_ND : "(s, X) \<notin> \<F> P \<Longrightarrow> s \<notin> \<D> P"
 by(erule contrapos_nn, simp add: is_processT8_S)
 
 lemmas NT_ND = D_T_subset[THEN Set.contra_subsetD]
 
 lemma T_F_spec : "((t, {}) \<in> \<F> P) = (t \<in> \<T> P)"
 by(auto simp:T_F F_T)
 
 lemma is_processT5_S7:  "t \<in> \<T> P \<Longrightarrow> (t, A) \<notin> \<F> P \<Longrightarrow> \<exists>x. x \<in> A \<and> t @ [x] \<in> \<T> P"
 apply(erule contrapos_np, simp)
 apply(rule is_processT5[rule_format, OF conjI,of _ "{}", simplified])
 apply(auto simp: T_F_spec)
   done
 
 lemma is_processT5_S7': 
 "(t, X) \<in> \<F> P \<Longrightarrow> (t, X \<union> A) \<notin> \<F> P \<Longrightarrow> \<exists>x. x \<in> A \<and> x \<notin> X \<and> t @ [x] \<in> \<T> P"
   apply(erule contrapos_np, simp, subst Un_Diff_cancel[of X A, symmetric])
   apply(rule is_processT5[rule_format])  
   apply(auto simp: T_F_spec)
   done
 
 lemma Nil_subset_T: "{[]} \<subseteq> \<T> P"
 by(auto simp: T_F_spec[symmetric] is_processT1)
 
 lemma Nil_elem_T: "[] \<in> \<T> P"
 by(simp add: Nil_subset_T[THEN subsetD])
 
 lemmas D_imp_front_tickFree = is_processT8_S[THEN is_processT2[rule_format]]
 
 lemma D_front_tickFree_subset : "\<D> P \<subseteq> Collect front_tickFree"
 by(auto simp: D_imp_front_tickFree)
 
 lemma F_D_part : "\<F> P = {(s, x). s \<in> \<D> P} \<union> {(s, x). s \<notin> \<D> P \<and> (s, x) \<in> \<F> P}"
 by(auto intro:is_processT8_Pair)
 
 lemma D_F : "{(s, x). s \<in> \<D> P} \<subseteq> \<F> P"
 by(auto intro:is_processT8_Pair)
 
 lemma append_T_imp_tickFree:  "t @ s \<in> \<T> P \<Longrightarrow> s \<noteq> [] \<Longrightarrow> tickFree t"
 by(frule is_processT2_TR[rule_format], 
    simp add: front_tickFree_def tickFree_rev)
 
 corollary append_single_T_imp_tickFree : "t @ [a] \<in> \<T> P \<Longrightarrow> tickFree t"
   by (simp add: append_T_imp_tickFree)
 
 lemma F_subset_imp_T_subset: "\<F> P \<subseteq> \<F> Q \<Longrightarrow> \<T> P \<subseteq> \<T> Q"
 by(auto simp: subsetD T_F_spec[symmetric])
 
 lemma is_processT6_S2: "tick \<notin> X \<Longrightarrow> [tick] \<in> \<T> P \<Longrightarrow> ([], X) \<in> \<F> P"
 by(erule is_processT6_S1, simp add: T_F_spec) 
 
 lemma is_processT9_tick: "[tick] \<in> \<D> P \<Longrightarrow> front_tickFree s \<Longrightarrow> s \<in> \<D> P"
 apply(rule append.simps(1) [THEN subst, of _ s])
 apply(rule is_processT7_S, simp_all)
 apply(rule is_processT9 [rule_format], simp)
 done
 
 
 lemma T_nonTickFree_imp_decomp: "t \<in> \<T> P \<Longrightarrow> \<not> tickFree t \<Longrightarrow> \<exists>s. t = s @ [tick]"
 by(auto elim: is_processT2_TR[rule_format] nonTickFree_n_frontTickFree)
 
 
 section\<open> Process Approximation is a Partial Ordering, a Cpo, and a Pcpo \<close>
 text\<open>The Failure/Divergence Model of CSP Semantics provides two orderings:
 The \emph{approximation ordering} (also called \emph{process ordering})
 will be used for giving semantics to recursion (fixpoints) over processes,
 the \emph{refinement ordering} captures our intuition that a more concrete
 process is more deterministic and more defined than an abstract one.
 
 We start with the key-concepts of the approximation ordering, namely
 the predicates $min\_elems$ and $Ra$ (abbreviating \emph{refusals after}).
 The former provides just a set of minimal elements from a given set
 of elements of type-class $ord$ \ldots \<close>
 
 definition min_elems :: "('s::ord) set \<Rightarrow> 's set"
   where   "min_elems X = {s \<in> X. \<forall>t. t \<in> X \<longrightarrow> \<not> (t < s)}"
 
 lemma Nil_min_elems : "[] \<in> A \<Longrightarrow> [] \<in> min_elems A"
 by(simp add: min_elems_def)
 
 lemma min_elems_le_self[simp] : "(min_elems A) \<subseteq> A"
 by(auto simp: min_elems_def)
 
 lemmas elem_min_elems = Set.set_mp[OF min_elems_le_self]
 
 lemma min_elems_Collect_ftF_is_Nil : "min_elems (Collect front_tickFree) = {[]}"
 apply(auto simp: min_elems_def le_list_def)
 apply(drule front_tickFree_charn[THEN iffD1])
 apply(auto dest!: tickFree_implies_front_tickFree)
 done
 
 lemma min_elems5 : 
   assumes A: "(x::'a list) \<in> A"
   shows      "\<exists>s\<le>x. s \<in> min_elems A"
 proof -
    have * : "!! (x::'a list) (A::'a list set) (n::nat).
                 x \<in> A \<and> length x \<le> n \<longrightarrow> (\<exists>s\<le>x. s \<in> min_elems A)"
             apply(rule_tac x=x in spec)
             apply(rule_tac n=n in nat_induct) (* quirk in induct *)
             apply(auto simp: Nil_min_elems)
             apply(case_tac "\<exists> y.  y \<in> A \<and> y < x",auto)
             apply(rename_tac A na x y, erule_tac x=y in allE, simp)
             apply(erule impE,drule less_length_mono, arith)
             apply(safe, rename_tac s, rule_tac x=s in exI,simp)
             apply(rule_tac x=x in exI, simp add:min_elems_def)
             done
    show ?thesis by(rule_tac n="length x" in *[rule_format],simp add:A)
 qed
 
 lemma min_elems4: "A \<noteq> {} \<Longrightarrow> \<exists>s. (s :: 'a trace) \<in> min_elems A"
 by(auto dest: min_elems5)
 
 lemma min_elems_charn: "t \<in> A \<Longrightarrow> \<exists> t' r. t = (t' @ r) \<and> t' \<in> min_elems A"
 by(drule min_elems5[simplified le_list_def], auto)
 
 lemmas min_elems_ex = min_elems_charn  (* Legacy *)
 
 lemma min_elems_no: "(x::'a list) \<in> min_elems A \<Longrightarrow> t \<in> A \<Longrightarrow> t \<le> x \<Longrightarrow> x = t" 
   by (metis (no_types, lifting) less_list_def mem_Collect_eq min_elems_def)
 
 text\<open> \ldots while the second returns the set of possible
 refusal sets after a given trace $s$ and a given process
 $P$: \<close>
 
 definition Ra :: "['\<alpha> process, '\<alpha> trace] \<Rightarrow> ('\<alpha> refusal set)" ("\<R>\<^sub>a")
   where   "\<R>\<^sub>a P s = {X. (s, X) \<in> \<F> P}"
 
 text\<open> In the following, we link the process theory to the underlying 
 fixpoint/domain theory of HOLCF by identifying the approximation ordering 
 with HOLCF's pcpo's. \<close>
 
 instantiation 
    process  ::  ("type") below     
 begin
 text\<open> declares approximation ordering $\_ \sqsubseteq \_$ also written 
         \verb+_ << _+. \<close>
 
 definition le_approx_def : "P \<sqsubseteq> Q \<equiv> \<D> Q \<subseteq> \<D> P \<and>
                                     (\<forall>s. s \<notin> \<D> P \<longrightarrow> \<R>\<^sub>a P s = \<R>\<^sub>a Q s) \<and> 
                                      min_elems (\<D> P) \<subseteq> \<T> Q"
 
 text\<open> The approximation ordering captures the fact that more concrete
 processes should be more defined by ordering the divergence sets
 appropriately. For defined positions in a process, the failure
 sets must coincide pointwise; moreover, the minimal elements
 (wrt.~prefix ordering on traces, i.e.~lists) must be contained in
 the trace set of the more concrete process.\<close>
 
 instance ..
 
 end
 
 
 lemma le_approx1: "P\<sqsubseteq>Q \<Longrightarrow> \<D> Q \<subseteq> \<D> P"
 by(simp add: le_approx_def)
 
 
 lemma le_approx2: "\<lbrakk> P\<sqsubseteq>Q; s \<notin> \<D> P\<rbrakk> \<Longrightarrow> (s,X) \<in> \<F> Q = ((s,X) \<in> \<F> P)" 
 by(auto simp: Ra_def le_approx_def)
 
 
 lemma le_approx3: "P \<sqsubseteq> Q \<Longrightarrow> min_elems(\<D> P) \<subseteq> \<T> Q"
 by(simp add: le_approx_def)
 
 lemma le_approx2T: "\<lbrakk> P\<sqsubseteq>Q; s \<notin> \<D> P\<rbrakk> \<Longrightarrow>  s \<in> \<T> Q = (s \<in> \<T> P)" 
 by(auto simp: le_approx2 T_F_spec[symmetric])
 
 lemma le_approx_lemma_F : "P\<sqsubseteq>Q \<Longrightarrow> \<F> Q \<subseteq> \<F> P"
 apply(subst F_D_part[of Q], subst F_D_part[of P])
 apply(auto simp:le_approx_def Ra_def min_elems_def)
 done
 
 lemmas order_lemma = le_approx_lemma_F
 
 lemma le_approx_lemma_T: "P\<sqsubseteq>Q \<Longrightarrow> \<T> Q \<subseteq> \<T> P"
 by(auto dest!:le_approx_lemma_F simp: T_F_spec[symmetric])
 
 lemma proc_ord2a :  " P \<sqsubseteq> Q \<Longrightarrow> s \<notin> \<D> P \<Longrightarrow> ((s, X) \<in> \<F> P) = ((s, X) \<in> \<F> Q)"
 by(auto simp: le_approx_def Ra_def)
 
 
 instance
    process :: ("type") po
 proof
    fix P::"'\<alpha> process"
    show "P \<sqsubseteq> P" by(auto simp: le_approx_def min_elems_def elim: Process.D_T)
  next
    fix P Q ::"'\<alpha> process" 
    assume A:"P \<sqsubseteq> Q" and B:"Q \<sqsubseteq> P" thus "P = Q"
    apply(insert A[THEN le_approx1] B[THEN le_approx1])
    apply(insert A[THEN le_approx_lemma_F] B[THEN le_approx_lemma_F])
    by(auto simp: Process_eq_spec)
  next
    fix P Q R ::"'\<alpha> process" 
    assume A: "P \<sqsubseteq> Q" and B: "Q \<sqsubseteq> R" thus "P \<sqsubseteq> R" 
    proof -
       have C : "\<D> R \<subseteq> \<D> P" 
                by(insert A[THEN le_approx1] B[THEN le_approx1], auto)
       have D : "\<forall>s. s \<notin> \<D> P \<longrightarrow> {X. (s, X) \<in> \<F> P} = {X. (s, X) \<in> \<F> R}" 
                apply(rule allI, rule impI, rule set_eqI, simp)
                apply(frule A[THEN le_approx1, THEN Set.contra_subsetD])
                apply(frule B[THEN le_approx1, THEN Set.contra_subsetD])
                apply(drule A[THEN le_approx2], drule B[THEN le_approx2]) 
                apply auto
                done
       have E : "min_elems (\<D> P) \<subseteq> \<T> R"
                apply(insert B[THEN le_approx3] A[THEN le_approx3] )
                apply(insert B[THEN le_approx_lemma_T] A[THEN le_approx1] ) 
                apply(rule subsetI, simp add: min_elems_def, auto)
                apply(rename_tac x, case_tac "x \<in> \<D> Q")
                apply(drule_tac B = "\<T> R" and t=x 
                      in subset_iff[THEN iffD1,rule_format], auto)
                apply(subst B [THEN le_approx2T],simp)
                apply(rename_tac x, drule_tac B = "\<T> Q" and t=x 
                      in subset_iff[THEN iffD1,rule_format],auto)
                done
       show ?thesis
       by(insert C D E, simp add: le_approx_def Ra_def)
    qed
 qed
 
 text\<open> At this point, we inherit quite a number of facts from the underlying
 HOLCF theory, which comprises a library of facts such as \verb+chain+,
 \verb+directed+(sets), upper bounds and least upper bounds, etc. \<close>
 
 
 text\<open>
 Some facts from the theory of complete partial orders:
 \begin{itemize}
 \item \verb+Porder.chainE+ : @{thm "Porder.chainE"}
 \item \verb+Porder.chain_mono+ : @{thm "Porder.chain_mono"}
 \item \verb+Porder.is_ubD+ : @{thm "Porder.is_ubD"}
 \item \verb+Porder.ub_rangeI+ : \\ @{thm "Porder.ub_rangeI"}
 \item \verb+Porder.ub_imageD+ : @{thm "Porder.ub_imageD"}
 \item \verb+Porder.is_ub_upward+ : @{thm "Porder.is_ub_upward"}
 \item \verb+Porder.is_lubD1+ : @{thm "Porder.is_lubD1"}
 \item \verb+Porder.is_lubI+ : @{thm "Porder.is_lubI"}
 \item \verb+Porder.is_lub_maximal+ : @{thm "Porder.is_lub_maximal"}
 \item \verb+Porder.is_lub_lub+ : @{thm "Porder.is_lub_lub"}
 \item \verb+Porder.is_lub_range_shift+: \\ @{thm "Porder.is_lub_range_shift"}
 \item \verb+Porder.is_lub_rangeD1+: @{thm "Porder.is_lub_rangeD1"}
 \item \verb+Porder.lub_eqI+: @{thm "Porder.lub_eqI"}
 \item \verb+Porder.is_lub_unique+:@{thm "Porder.is_lub_unique"}
 \end{itemize}
 \<close>
 
 
 definition lim_proc :: "('\<alpha> process) set \<Rightarrow> '\<alpha> process"
   where   "lim_proc (X) = Abs_process (\<Inter> (\<F> ` X), \<Inter> (\<D> ` X))"
 
 lemma min_elems3: " s @ [c] \<in> \<D> P \<Longrightarrow> s @ [c] \<notin> min_elems (\<D> P) \<Longrightarrow> s \<in> \<D> P"
 apply(auto simp: min_elems_def le_list_def less_list_def)
 apply(rename_tac t r) 
 apply(subgoal_tac "t \<le> s")
 apply(subgoal_tac "r \<noteq> []")
 apply(simp add: le_list_def)
 apply(auto intro!: is_processT7_S append_eq_first_pref_spec)
 apply(auto dest!: D_T)
 apply(simp_all only: append_assoc[symmetric],
       drule append_T_imp_tickFree,
       simp_all add: tickFree_implies_front_tickFree)+
 done
 
 lemma min_elems1: "s \<notin> \<D> P \<Longrightarrow> s @ [c] \<in> \<D> P \<Longrightarrow> s @ [c] \<in> min_elems (\<D> P)"
   by(erule contrapos_np, auto elim!: min_elems3)
 
 lemma min_elems2: "s \<notin> \<D> P \<Longrightarrow> s @ [c] \<in> \<D> P \<Longrightarrow> P \<sqsubseteq> S \<Longrightarrow> Q \<sqsubseteq> S \<Longrightarrow> (s @ [c], {}) \<in> \<F> Q"
   apply(frule_tac P=Q and Q=S in le_approx_lemma_T)
   apply(simp add: T_F_spec)
   apply(rule_tac A="\<T> S" in subsetD, assumption)
   apply(rule_tac A="min_elems(\<D> P)" in subsetD) 
   apply(simp_all add: le_approx_def min_elems1)
 done
 
 lemma min_elems6: "s \<notin> \<D> P \<Longrightarrow> s @ [c] \<in> \<D> P \<Longrightarrow> P \<sqsubseteq> S \<Longrightarrow> (s @ [c], {}) \<in> \<F> S"
 by(auto intro!: min_elems2)
 
 lemma ND_F_dir2: "s \<notin> \<D> P \<Longrightarrow> (s, {}) \<in> \<F> P \<Longrightarrow> P \<sqsubseteq> S \<Longrightarrow> Q \<sqsubseteq> S \<Longrightarrow> (s, {}) \<in> \<F> Q"
   apply(frule_tac P=Q and Q=S in le_approx_lemma_T)
   apply(simp add: le_approx_def Ra_def T_F_spec, safe)
   apply((erule_tac x=s in allE)+,simp)
   apply(drule_tac x="{}" in eqset_imp_iff, auto simp: T_F_spec)
 done \<comment>\<open>orig version\<close>
 
 lemma ND_F_dir2': "s \<notin> \<D> P \<Longrightarrow> s \<in> \<T> P \<Longrightarrow> P \<sqsubseteq> S \<Longrightarrow> Q \<sqsubseteq> S \<Longrightarrow> s \<in> \<T> Q"
   apply(frule_tac P=Q and Q=S in le_approx_lemma_T)
   apply(simp add: le_approx_def Ra_def T_F_spec, safe)
   apply((erule_tac x=s in allE)+,simp)
   apply(drule_tac x="{}" in eqset_imp_iff, auto simp: T_F_spec)
 done
 
 
 lemma chain_lemma: "\<lbrakk>chain S\<rbrakk> \<Longrightarrow> S i \<sqsubseteq> S k \<or> S k \<sqsubseteq> S i"
 by(case_tac "i \<le> k", auto intro:chain_mono chain_mono_less)
  
 
 lemma is_process_REP_LUB: 
   assumes chain: "chain S"
   shows "is_process (\<Inter> (\<F> ` range S), \<Inter> (\<D> ` range S))"
 
 proof (auto simp: is_process_def)
    show   "([], {}) \<in> FAILURES (\<Inter> a::nat. \<F> (S a), \<Inter> a::nat. \<D> (S a))"
           by(auto simp: FAILURES_def is_processT)
 next
    fix s::"'a trace" fix X::"'a event set"
    assume A : "(s, X) \<in> (FAILURES (\<Inter> a :: nat. \<F> (S a), \<Inter> a :: nat. \<D> (S a)))" 
    thus   "front_tickFree s"
           by(auto simp:   DIVERGENCES_def FAILURES_def
                   intro!: is_processT2[rule_format])
 next
    fix s  t::"'a trace"
    assume " (s @ t, {}) \<in> FAILURES (\<Inter> a::nat. \<F> (S a), \<Inter> a::nat. \<D> (S a)) "
    thus "(s, {}) \<in> FAILURES (\<Inter> a::nat. \<F> (S a), \<Inter> a::nat. \<D> (S a))"
           by(auto simp:  DIVERGENCES_def FAILURES_def
                   intro: is_processT3[rule_format])
 next
    fix s::"'a trace"   fix X Y ::"'a event set"
    assume "(s, Y) \<in> FAILURES (\<Inter> a::nat. \<F> (S a), \<Inter> a::nat. \<D>(S a))" and "X \<subseteq> Y"
    thus   "(s, X) \<in> FAILURES (\<Inter> a::nat. \<F> (S a), \<Inter> a::nat. \<D>(S a))"
           by(auto simp:  DIVERGENCES_def FAILURES_def
                   intro: is_processT4[rule_format])
 next
    fix s::"'a trace"   fix X Y ::" 'a event set"
    assume A:"(s, X) \<in> FAILURES (\<Inter> a::nat. \<F> (S a), \<Inter> a::nat. \<D> (S a))"
    assume B:"\<forall> c. c\<in>Y \<longrightarrow> (s@[c],{})\<notin>FAILURES(\<Inter> a::nat. \<F>(S a),\<Inter> a::nat. \<D>(S a))"
    thus   "(s, X \<union> Y) \<in> FAILURES (\<Inter> a::nat. \<F> (S a), \<Inter> a::nat. \<D> (S a))"
    txt\<open> What does this mean: All trace prolongations $c$ in all $Y$, 
          which are blocking in the limit, will also occur in the refusal set 
          of the limit. \<close>
    using A B chain
    proof (auto simp: DIVERGENCES_def FAILURES_def,
           case_tac "\<forall> x. x \<in> (range S) \<longrightarrow> (s, X \<union> Y) \<in> \<F> x",
           simp_all add:DIVERGENCES_def FAILURES_def,rename_tac a,
           case_tac "s \<notin> \<D> (S a)",simp_all add: is_processT8)
       fix a::nat 
       assume X: "\<forall>a. (s, X) \<in> \<F> (S a)"
                  have X_ref_at_a: "(s, X) \<in> \<F> (S a)"
                  using X by auto
       assume Y: "\<forall>c. c \<in> Y \<longrightarrow> (\<exists>a. (s @ [c], {}) \<notin> \<F> (S a))"
       assume defined: "s \<notin> \<D> (S a)"
       show   "(s::'a trace, X \<union> Y) \<in> \<F> (S a)"
       proof(auto simp:X_ref_at_a
                  intro!: is_processT5[rule_format],
             frule Y[THEN spec, THEN mp], erule exE,
             erule_tac Q="(s @ [c], {}) \<in> \<F> (S a)" in contrapos_pp)
          fix c::"'a event" fix a' :: nat
          assume s_c_trace_not_trace_somewhere: "(s @ [c], {}) \<notin> \<F> (S a')"
          show "(s @ [c], {}) \<notin> \<F> (S a)"
          proof(insert chain_lemma[OF chain, of "a" "a'"],erule disjE)
            assume before: "S a \<sqsubseteq> S a'"
            show "(s @ [c], {}) \<notin> \<F> (S a)"
              using s_c_trace_not_trace_somewhere  before
              apply(case_tac "s @ [c] \<notin> \<D> (S a)",
                    simp_all add: T_F_spec before[THEN le_approx2T,symmetric])
              apply(erule contrapos_nn)
              apply(simp only: T_F_spec[symmetric])
              apply(auto dest!:min_elems6[OF defined])
              done
          next
            assume after:"S a' \<sqsubseteq> S a"
            show "(s @ [c], {}) \<notin> \<F> (S a)"
              using s_c_trace_not_trace_somewhere
              by(simp add:T_F_spec after[THEN le_approx2T]
                          s_c_trace_not_trace_somewhere[THEN NF_ND])
          qed
       qed
    qed
 next
    fix s::"'a trace"   fix X::"'a event set"
    assume "(s @ [tick], {}) \<in> FAILURES (\<Inter> a::nat. \<F> (S a), \<Inter> a::nat. \<D> (S a))"
    thus   "(s, X - {tick}) \<in> FAILURES (\<Inter> a::nat. \<F> (S a), \<Inter> a::nat. \<D> (S a))"
           by(auto simp: DIVERGENCES_def FAILURES_def
                   intro! : is_processT6[rule_format])
 next
    fix s t ::"'a trace"
    assume "s : DIVERGENCES (\<Inter> a::nat. \<F> (S a), \<Inter> a::nat. \<D> (S a))"
    and    "tickFree s" and " front_tickFree t"
    thus   "s @ t \<in> DIVERGENCES (\<Inter> a::nat. \<F> (S a), \<Inter> a::nat. \<D> (S a))"
           by(auto simp: DIVERGENCES_def FAILURES_def
                   intro: is_processT7[rule_format])
 next
    fix s::"'a trace"  fix X::"'a event set"
    assume "s \<in> DIVERGENCES (\<Inter> a::nat. \<F> (S a), \<Inter> a::nat. \<D> (S a)) "
    thus   "(s, X) \<in> FAILURES (\<Inter> a::nat. \<F> (S a), \<Inter> a::nat. \<D> (S a))"
           by(auto simp: DIVERGENCES_def FAILURES_def
                        intro: is_processT8[rule_format])
 next
    fix s::"'a trace"
    assume "s @ [tick] \<in> DIVERGENCES (\<Inter> a::nat. \<F> (S a), \<Inter> a::nat. \<D> (S a)) "
    thus   "s \<in> DIVERGENCES (\<Inter> a::nat. \<F> (S a), \<Inter> a::nat. \<D> (S a))"
           by(auto simp: DIVERGENCES_def FAILURES_def
                   intro: is_processT9[rule_format])
 qed
 
 
 
 lemmas Rep_Abs_LUB = Abs_process_inverse[simplified Rep_process, 
                                          simplified, OF is_process_REP_LUB,
                                          simplified]
 
 lemma F_LUB: "chain S \<Longrightarrow> \<F>(lim_proc(range S)) = \<Inter> (\<F> ` range S)"
 by(simp add: lim_proc_def , subst Failures_def, auto simp: FAILURES_def Rep_Abs_LUB)
 
 lemma D_LUB: "chain S \<Longrightarrow> \<D>(lim_proc(range S)) = \<Inter> (\<D> ` range S)"
-by(simp add: lim_proc_def , subst D_def, auto simp: DIVERGENCES_def Rep_Abs_LUB)
+by(simp add: lim_proc_def , subst Divergences_def, auto simp: DIVERGENCES_def Rep_Abs_LUB)
 
 lemma T_LUB: "chain S \<Longrightarrow> \<T> (lim_proc(range S)) = \<Inter> (\<T>  ` range S)"
 apply(simp add: lim_proc_def , subst Traces_def) 
 apply(simp add: TRACES_def FAILURES_def Rep_Abs_LUB)
 apply(auto intro: F_T, rule_tac x="{}" in exI, auto intro: T_F)
 done
 
 schematic_goal D_LUB_2: "chain S \<Longrightarrow> t \<in> \<D>(lim_proc(range S)) =  ?X"
 apply(subst D_LUB, simp)
 apply(rule trans, simp)
 apply(simp)
 done
 
 schematic_goal T_LUB_2: "chain S \<Longrightarrow> (t \<in> \<T> (lim_proc (range S))) = ?X"
 apply(subst T_LUB, simp)
 apply(rule trans, simp)
 apply(simp)
 done
 
 
 section\<open> Process Refinement is a Partial Ordering\<close>
 
 text\<open> The following type instantiation declares the refinement order
 $\_ \le \_ $ written \verb+_  <= _+. It captures the intuition that more
 concrete processes should be more deterministic and more defined.\<close>
 
 instantiation
    process :: (type) ord          
 begin
 
 definition  le_ref_def   : "P \<le> Q \<equiv> \<D> Q \<subseteq> \<D> P \<and> \<F> Q \<subseteq> \<F> P"
 
 definition  less_ref_def : "(P::'a process) < Q \<equiv> P \<le> Q \<and> P \<noteq> Q"
 
 instance ..
 
 end
 
 
 
 text\<open>Note that this just another syntax to our standard process refinement order 
      defined in the theory Process. \<close> 
 
 
 lemma le_approx_implies_le_ref:    "(P::'\<alpha> process) \<sqsubseteq> Q \<Longrightarrow> P \<le> Q"
 by(simp add: le_ref_def le_approx1 le_approx_lemma_F)
 
 lemma le_ref1:                     "P \<le> Q \<Longrightarrow> \<D> Q \<subseteq> \<D> P"
 by(simp add: le_ref_def) 
 
 lemma le_ref2:                     "P\<le>Q \<Longrightarrow> \<F> Q \<subseteq> \<F> P"
 by(simp add: le_ref_def) 
 
 lemma le_ref2T :                    "P\<le>Q \<Longrightarrow> \<T> Q \<subseteq> \<T> P"
   by (rule subsetI) (simp add: T_F_spec[symmetric] le_ref2[THEN subsetD])
 
 
 instance  process :: (type) order
 proof
    fix P Q R :: "'\<alpha> process"
    {
      show "(P < Q) = (P \<le> Q \<and> \<not> Q \<le>  P)"
        by(auto simp: le_ref_def less_ref_def Process_eq_spec)
    next
      show "P \<le> P"  by(simp add: le_ref_def)
    next
      assume "P \<le> Q" and "Q \<le> R" then show "P \<le> R"
        by (simp add: le_ref_def, auto)
    next
      assume "P \<le> Q" and "Q \<le> P" then show "P = Q"
        by(auto simp: le_ref_def Process_eq_spec)  
    }
 qed
 
 lemma lim_proc_is_ub:"chain S \<Longrightarrow> range S <| lim_proc (range S)" 
   apply(auto simp: is_ub_def le_approx_def F_LUB D_LUB T_LUB Ra_def) 
   using chain_lemma is_processT8 le_approx2 apply blast 
   using D_T chain_lemma le_approx2T le_approx_def by blast
 
 lemma lim_proc_is_lub1: "chain S \<Longrightarrow> \<forall> u . (range S <| u \<longrightarrow>  \<D> u \<subseteq> \<D> (lim_proc (range S)))"
   by(auto simp: D_LUB, frule_tac i=a in Porder.ub_rangeD, auto dest: le_approx1)
 
 lemma lim_proc_is_lub2: 
   "chain S \<Longrightarrow> \<forall> u . range S <| u \<longrightarrow> (\<forall> s.  s \<notin> \<D> (lim_proc (range S))
    \<longrightarrow> Ra (lim_proc (range S)) s = Ra u s)" 
     apply(auto simp: is_ub_def D_LUB F_LUB Ra_def)
     using proc_ord2a apply blast
     using is_processT8_S proc_ord2a by blast
 
 
 lemma lim_proc_is_lub3a: "front_tickFree s \<Longrightarrow> s \<notin> \<D> P \<longrightarrow> (\<forall>t. t \<in> \<D> P \<longrightarrow> \<not> t < s @ [c])" 
 apply(rule impI, erule contrapos_np, auto)
-apply(auto simp: le_list_def  less_list_def)
-by (metis D_def butlast_append butlast_snoc 
-          front_tickFree_mono is_process7 is_process_Rep self_append_conv)
+  apply(auto simp: le_list_def  less_list_def)
+  by (metis butlast_append butlast_snoc front_tickFree_mono is_processT self_append_conv)
+
 
 
 lemma lim_proc_is_lub3b:
 assumes 1 : "\<forall>x. x \<in> X \<longrightarrow> (\<forall>xa. xa \<in> \<D> x \<and> (\<forall>t. t \<in> \<D> x \<longrightarrow> \<not> t < xa) \<longrightarrow> xa \<in> \<T>  u)"
 and     2 : "xa \<in> X"
 and     3 : "\<forall>xa. xa \<in> X \<longrightarrow> x \<in> \<D> xa"
 and     4 : "\<forall>t. (\<forall>x. x \<in> X \<longrightarrow> t \<in> \<D> x) \<longrightarrow> \<not> t < x"
 shows       "x \<in> \<T>  u"
 proof (cases "\<forall>t. t \<in> \<D> xa \<longrightarrow> \<not> t < x") 
       case True  from \<open>\<forall>t. t \<in> \<D> xa \<longrightarrow> \<not> t < x\<close>  show ?thesis using 1 2 3  by simp
 next
       case False from \<open>\<not>(\<forall>t. t \<in> \<D> xa \<longrightarrow> \<not> t < x)\<close> and 3 4
                  have A: "\<exists>y r c. y \<in> X \<and> r \<notin> \<D> y \<and> r \<in> \<D> xa \<and> r @ [c] = x" 
                          by (metis D_imp_front_tickFree front_tickFree_charn 
                                    less_self lim_proc_is_lub3a nil_less 
                                    tickFree_implies_front_tickFree)
            show ?thesis
               apply(insert A) apply(erule exE)+
               using "1" "3" D_imp_front_tickFree lim_proc_is_lub3a by blast
 qed
 
 lemma lim_proc_is_lub3c: 
 assumes *:"chain S"
 and     **:"X = range S"  \<comment>\<open>protection for range - otherwise auto unfolds and gets lost\<close>
 shows   "\<forall> u. X <| u \<longrightarrow>  min_elems(\<D> (lim_proc X)) \<subseteq> \<T>  u"
 proof -
   have B : "\<D> (lim_proc X) = \<Inter> (\<D> ` X)" by(simp add: * ** D_LUB)
   show ?thesis
      apply(auto simp: is_ub_def * **)
      apply(auto simp: B min_elems_def le_approx_def HOL.imp_conjR HOL.all_conj_distrib Ball_def)
       apply(simp add: subset_iff imp_conjL[symmetric])
     apply(rule lim_proc_is_lub3b[of "range S", simplified])
     using "**" B by auto
 qed
 
 lemma limproc_is_lub: "chain S \<Longrightarrow> range S <<| lim_proc (range S)"
 apply (auto simp: is_lub_def lim_proc_is_ub)
 apply (simp add: le_approx_def is_lub_def lim_proc_is_ub)
 by (simp add: lim_proc_is_lub1 lim_proc_is_lub2 lim_proc_is_lub3c)
 
 lemma limproc_is_thelub: "chain S \<Longrightarrow> Lub S = lim_proc (range S)"
 by (frule limproc_is_lub,frule Porder.po_class.lub_eqI, simp)
 
 
 instance
    process :: (type) cpo
 proof
    fix S ::"nat \<Rightarrow> '\<alpha> process"
    assume C:"chain S" 
    thus "\<exists> x. range S <<| x" using limproc_is_lub by blast
 qed
 
 instance
    process :: (type) pcpo
 proof
-   show "\<exists> x::'a process. \<forall> y::'a process. x \<sqsubseteq> y" 
+  show "\<exists> x::'a process. \<forall> y::'a process. x \<sqsubseteq> y" 
    proof -
       have is_process_witness : 
            "is_process({(s,X). front_tickFree s},{d. front_tickFree d})"
            apply(auto simp:is_process_def FAILURES_def DIVERGENCES_def)
            apply(auto elim!: tickFree_implies_front_tickFree front_tickFree_dw_closed
                              front_tickFree_append)
            done
       have bot_inverse : 
            "Rep_process(Abs_process({(s, X). front_tickFree s},Collect front_tickFree))=
                           ({(s, X). front_tickFree s}, Collect front_tickFree)"
            by(subst Abs_process_inverse, simp_all add: Rep_process is_process_witness)
       have divergences_frontTickFree:
            "\<And>y x. x \<in> snd (Rep_process y) \<Longrightarrow> front_tickFree x" 
-           by(rule D_imp_front_tickFree, simp add: D_def DIVERGENCES_def)
+           by(rule D_imp_front_tickFree, simp add: Divergences_def DIVERGENCES_def)
       have failures_frontTickFree:
            "\<And>y s x. (s, x) \<in> fst (Rep_process y) \<Longrightarrow> front_tickFree s"
            by(rule is_processT2[rule_format], 
               simp add: Failures_def FAILURES_def)
       have minelems_contains_mt:
            "\<And>y x. x \<in> min_elems (Collect front_tickFree) \<Longrightarrow> x = []"
            by(simp add: min_elems_def front_tickFree_charn,safe, 
               auto simp: Nil_elem_T)
       show ?thesis 
       apply(rule_tac x="Abs_process ({(s,X). front_tickFree s},{d. front_tickFree d})" 
             in exI)
       apply(auto simp: le_approx_def bot_inverse Ra_def 
-                       Failures_def D_def FAILURES_def DIVERGENCES_def
+                       Failures_def Divergences_def FAILURES_def DIVERGENCES_def
                        divergences_frontTickFree failures_frontTickFree)
       apply (metis minelems_contains_mt Nil_elem_T )
       done
    qed
 qed
 
 
 section\<open> Process Refinement is Admissible \<close>
 
 lemma le_adm[simp]: "cont (u::('a::cpo) \<Rightarrow> 'b process) \<Longrightarrow> monofun v \<Longrightarrow> adm(\<lambda>x. u x \<le> v x)"
 proof(auto simp add:le_ref_def cont2contlubE adm_def, goal_cases)
   case (1 Y x)
   hence "v (Y i)  \<sqsubseteq> v (\<Squnion>i. Y i)" for i by (simp add: is_ub_thelub monofunE)
   hence "\<D> (v (\<Squnion>i. Y i)) \<subseteq> \<D> (u (Y i))" for i using "1"(4) le_approx1 by blast    
   then show ?case 
     using D_LUB[OF ch2ch_cont[OF 1(1) 1(3)]] limproc_is_thelub[OF ch2ch_cont[OF 1(1) 1(3)]] "1"(5) by force
 next
   case (2 Y a b)
   hence "v (Y i)  \<sqsubseteq> v (\<Squnion>i. Y i)" for i by (simp add: is_ub_thelub monofunE)
   hence "\<F> (v (\<Squnion>i. Y i)) \<subseteq> \<F> (u (Y i))" for i using "2"(4) le_approx_lemma_F by blast   
   then show ?case
     using F_LUB[OF ch2ch_cont[OF 2(1) 2(3)]] limproc_is_thelub[OF ch2ch_cont[OF 2(1) 2(3)]] "2"(5) by force
 qed
 
 lemmas le_adm_cont[simp] = le_adm[OF _ cont2mono]
 
 section\<open> The Conditional Statement is Continuous \<close>
 text\<open>The conditional operator of CSP is obtained by a direct shallow embedding. Here we prove it continuous\<close>
 
 lemma if_then_else_cont[simp]: 
   assumes *:"(\<And>x. P x \<Longrightarrow> cont ((f::'c \<Rightarrow> ('a::cpo) \<Rightarrow> 'b process) x))"
   and     **:"(\<And>x. \<not> P x \<Longrightarrow> cont (g x))"
   shows "\<And>x. cont(\<lambda>y. if P x then f x y else g x y)"
   using * ** by (auto simp:cont_def)
 
 
 end
diff --git a/thys/HOL-CSP/Process_Order.thy b/thys/HOL-CSP/Process_Order.thy
--- a/thys/HOL-CSP/Process_Order.thy
+++ b/thys/HOL-CSP/Process_Order.thy
@@ -1,200 +1,200 @@
 (*<*)
 \<comment>\<open> ********************************************************************
  * Project         : CSP-RefTK - A Refinement Toolkit for HOL-CSP
  * Version         : 1.0
  *
- * Author          : Burkhart Wolff, Safouan Taha, Lina Ye, Benoît Ballenghien, Catherine Dubois
+ * Author          : Burkhart Wolff, Safouan Taha, Lina Ye, Benoît Ballenghien
  *
  * This file       : A Normalization Theory
  *
  * Copyright (c) 2022 Université Paris-Saclay, France
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials provided
  *       with the distribution.
  *
  *     * Neither the name of the copyright holders nor the names of its
  *       contributors may be used to endorse or promote products derived
  *       from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  ******************************************************************************\<close>
 (*>*)
 
 
 chapter \<open> Refinements \<close> (* find a better name *)
 
 theory Process_Order
   imports Process Stop
 begin
 
 
 definition trace_refine :: \<open>'a process \<Rightarrow> 'a process \<Rightarrow> bool\<close>              (infix \<open>\<sqsubseteq>\<^sub>T\<close> 60)
   where \<open>P \<sqsubseteq>\<^sub>T Q \<equiv> \<T> Q \<subseteq> \<T> P\<close>
 
 definition failure_refine :: \<open>'a process \<Rightarrow> 'a process \<Rightarrow> bool\<close>            (infix \<open>\<sqsubseteq>\<^sub>F\<close> 60)
   where \<open>P \<sqsubseteq>\<^sub>F Q \<equiv> \<F> Q \<subseteq> \<F> P\<close>
 
 definition divergence_refine :: \<open>'a process \<Rightarrow> 'a process \<Rightarrow> bool\<close>         (infix \<open>\<sqsubseteq>\<^sub>D\<close> 53)
   where \<open>P \<sqsubseteq>\<^sub>D Q \<equiv> \<D> Q \<subseteq> \<D> P\<close>
 
 definition failure_divergence_refine :: \<open>'a process \<Rightarrow> 'a process \<Rightarrow> bool\<close> (infix \<open>\<sqsubseteq>\<^sub>F\<^sub>D\<close> 60)
   where \<open>P \<sqsubseteq>\<^sub>F\<^sub>D Q \<equiv> P \<le> Q\<close>
 
 
 definition trace_divergence_refine :: \<open>'a process \<Rightarrow> 'a process \<Rightarrow> bool\<close>   (infix \<open>\<sqsubseteq>\<^sub>D\<^sub>T\<close> 53)
   (* an experimental order considered also in our theories*)
   where \<open>P \<sqsubseteq>\<^sub>D\<^sub>T Q \<equiv> P \<sqsubseteq>\<^sub>T Q \<and> P \<sqsubseteq>\<^sub>D Q\<close>
 
 
 section \<open>Idempotency\<close>
 
 lemma  idem_F[simp]: \<open>P \<sqsubseteq>\<^sub>F P\<close>
   and  idem_D[simp]: \<open>P \<sqsubseteq>\<^sub>D P\<close>
   and  idem_T[simp]: \<open>P \<sqsubseteq>\<^sub>T P\<close>
   and idem_FD[simp]: \<open>P \<sqsubseteq>\<^sub>F\<^sub>D P\<close>
   and idem_DT[simp]: \<open>P \<sqsubseteq>\<^sub>D\<^sub>T P\<close>
   by (simp_all add: failure_refine_def divergence_refine_def trace_refine_def
                     failure_divergence_refine_def trace_divergence_refine_def) 
 
 
 section \<open>Some obvious refinements\<close>
 
 lemma BOT_leF[simp]: \<open>\<bottom> \<sqsubseteq>\<^sub>F Q\<close>
   and BOT_leD[simp]: \<open>\<bottom> \<sqsubseteq>\<^sub>D Q\<close>
   and BOT_leT[simp]: \<open>\<bottom> \<sqsubseteq>\<^sub>T Q\<close>
   by (simp_all add: failure_refine_def le_approx_lemma_F trace_refine_def
                     le_approx1 divergence_refine_def le_approx_lemma_T)
 
 
 
 section \<open>Antisymmetry\<close>
 
 lemma FD_antisym: \<open>P \<sqsubseteq>\<^sub>F\<^sub>D Q \<Longrightarrow> Q \<sqsubseteq>\<^sub>F\<^sub>D P \<Longrightarrow> P = Q\<close>
   by (simp add: failure_divergence_refine_def)
 
 lemma DT_antisym: \<open>P \<sqsubseteq>\<^sub>D\<^sub>T Q \<Longrightarrow> Q \<sqsubseteq>\<^sub>D\<^sub>T P \<Longrightarrow> P = Q\<close>
   apply (simp add: trace_divergence_refine_def)
   oops 
 
 
 
 section \<open>Transitivity\<close>
 
 lemma  trans_F: \<open>P \<sqsubseteq>\<^sub>F Q \<Longrightarrow> Q \<sqsubseteq>\<^sub>F S \<Longrightarrow> P \<sqsubseteq>\<^sub>F S\<close>
   and  trans_D: \<open>P \<sqsubseteq>\<^sub>D Q \<Longrightarrow> Q \<sqsubseteq>\<^sub>D S \<Longrightarrow> P \<sqsubseteq>\<^sub>D S\<close>
   and  trans_T: \<open>P \<sqsubseteq>\<^sub>T Q \<Longrightarrow> Q \<sqsubseteq>\<^sub>T S \<Longrightarrow> P \<sqsubseteq>\<^sub>T S\<close>
   and trans_FD: \<open>P \<sqsubseteq>\<^sub>F\<^sub>D Q \<Longrightarrow> Q \<sqsubseteq>\<^sub>F\<^sub>D S \<Longrightarrow> P \<sqsubseteq>\<^sub>F\<^sub>D S\<close>
   and trans_DT: \<open>P \<sqsubseteq>\<^sub>D\<^sub>T Q \<Longrightarrow> Q \<sqsubseteq>\<^sub>D\<^sub>T S \<Longrightarrow> P \<sqsubseteq>\<^sub>D\<^sub>T S\<close>
   by (meson failure_refine_def order_trans, meson divergence_refine_def order_trans,
       meson trace_refine_def order_trans, meson failure_divergence_refine_def order_trans,
       meson divergence_refine_def order_trans trace_divergence_refine_def trace_refine_def)
 
 
 
 section \<open>Relations between refinements\<close>
 
 lemma      leF_imp_leT: \<open>P \<sqsubseteq>\<^sub>F Q \<Longrightarrow> P \<sqsubseteq>\<^sub>T Q\<close>
   and     leFD_imp_leF: \<open>P \<sqsubseteq>\<^sub>F\<^sub>D Q \<Longrightarrow> P \<sqsubseteq>\<^sub>F Q\<close>
   and     leFD_imp_leD: \<open>P \<sqsubseteq>\<^sub>F\<^sub>D Q \<Longrightarrow> P \<sqsubseteq>\<^sub>D Q\<close>
   and     leDT_imp_leD: \<open>P \<sqsubseteq>\<^sub>D\<^sub>T Q \<Longrightarrow> P \<sqsubseteq>\<^sub>D Q\<close>
   and     leDT_imp_leT: \<open>P \<sqsubseteq>\<^sub>D\<^sub>T Q \<Longrightarrow> P \<sqsubseteq>\<^sub>T Q\<close>
   and leF_leD_imp_leFD: \<open>P \<sqsubseteq>\<^sub>F Q \<Longrightarrow> P \<sqsubseteq>\<^sub>D Q \<Longrightarrow> P \<sqsubseteq>\<^sub>F\<^sub>D Q\<close>
   and leD_leT_imp_leDT: \<open>P \<sqsubseteq>\<^sub>D Q \<Longrightarrow> P \<sqsubseteq>\<^sub>T Q \<Longrightarrow> P \<sqsubseteq>\<^sub>D\<^sub>T Q\<close>
   by (simp_all add: F_subset_imp_T_subset failure_refine_def trace_refine_def divergence_refine_def
                     trace_divergence_refine_def  failure_divergence_refine_def le_ref_def)
  
 
 
 section \<open>More obvious refinements\<close>
 
 lemma BOT_leFD[simp]: \<open>\<bottom> \<sqsubseteq>\<^sub>F\<^sub>D Q\<close>
   and BOT_leDT[simp]: \<open>\<bottom> \<sqsubseteq>\<^sub>D\<^sub>T Q\<close>
   by (simp_all add: leF_leD_imp_leFD leD_leT_imp_leDT)
 
 lemma leDT_STOP[simp]: \<open>P \<sqsubseteq>\<^sub>D\<^sub>T STOP\<close>
   by (simp add: D_STOP leD_leT_imp_leDT Nil_elem_T T_STOP divergence_refine_def trace_refine_def)
 
 lemma leD_STOP[simp]: \<open>P \<sqsubseteq>\<^sub>D STOP\<close>
   and leT_STOP[simp]: \<open>P \<sqsubseteq>\<^sub>T STOP\<close>
   by (simp_all add: leDT_imp_leD leDT_imp_leT)
 
 
 
 section \<open>Admissibility\<close>
 
 lemma le_F_adm[simp]:  \<open>cont (u::('a::cpo) \<Rightarrow> 'b process) \<Longrightarrow> monofun v \<Longrightarrow> adm(\<lambda>x. u x \<sqsubseteq>\<^sub>F v x)\<close>
 proof(auto simp add:cont2contlubE adm_def failure_refine_def)
   fix Y a b
   assume 1: \<open>cont u\<close> 
      and 2: \<open>monofun v\<close> 
      and 3: \<open>chain Y\<close> 
      and 4: \<open>\<forall>i. \<F> (v (Y i)) \<subseteq> \<F> (u (Y i))\<close> 
      and 5: \<open>(a, b) \<in> \<F> (v (\<Squnion>x. Y x))\<close>
   hence \<open>v (Y i)  \<sqsubseteq> v (\<Squnion>i. Y i)\<close> for i by (simp add: is_ub_thelub monofunE)
   hence \<open>\<F> (v (\<Squnion>i. Y i)) \<subseteq> \<F> (u (Y i))\<close> for i using 4 le_approx_lemma_F by blast   
   then show \<open>(a, b) \<in> \<F> (\<Squnion>i. u (Y i))\<close>
     using F_LUB[OF ch2ch_cont[OF 1 3]] limproc_is_thelub[OF ch2ch_cont[OF 1 3]] 5 by force
 qed
 
 lemma le_T_adm[simp]: \<open>cont (u::('a::cpo) \<Rightarrow> 'b process) \<Longrightarrow> monofun v \<Longrightarrow> adm(\<lambda>x. u x \<sqsubseteq>\<^sub>T v x)\<close>
 proof(auto simp add:cont2contlubE adm_def trace_refine_def)
   fix Y x
   assume 1: \<open>cont u\<close> 
      and 2: \<open>monofun v\<close> 
      and 3: \<open>chain Y\<close> 
      and 4: \<open>\<forall>i. \<T> (v (Y i)) \<subseteq> \<T> (u (Y i))\<close> 
      and 5: \<open>x \<in> \<T> (v (\<Squnion>i. Y i))\<close>
   hence \<open>v (Y i)  \<sqsubseteq> v (\<Squnion>i. Y i)\<close> for i by (simp add: is_ub_thelub monofunE)
   hence \<open>\<T> (v (\<Squnion>i. Y i)) \<subseteq> \<T> (u (Y i))\<close> for i using 4 le_approx_lemma_T by blast  
   then show \<open>x \<in> \<T> (\<Squnion>i. u (Y i))\<close>
     using T_LUB[OF ch2ch_cont[OF 1 3]] limproc_is_thelub[OF ch2ch_cont[OF 1 3]] 5 by force
 qed
 
 lemma le_D_adm[simp]: \<open>cont (u::('a::cpo) \<Rightarrow> 'b process) \<Longrightarrow> monofun v \<Longrightarrow> adm(\<lambda>x. u x \<sqsubseteq>\<^sub>D v x)\<close>
 proof(auto simp add:cont2contlubE adm_def divergence_refine_def)
   fix Y x
   assume 1: \<open>cont u\<close> 
      and 2: \<open>monofun v\<close> 
      and 3: \<open>chain Y\<close> 
      and 4: \<open>\<forall>i. \<D> (v (Y i)) \<subseteq> \<D> (u (Y i))\<close> 
      and 5: \<open>x \<in> \<D> (v (\<Squnion>i. Y i))\<close>
   hence \<open>v (Y i)  \<sqsubseteq> v (\<Squnion>i. Y i)\<close> for i by (simp add: is_ub_thelub monofunE)
   hence \<open>\<D> (v (\<Squnion>i. Y i)) \<subseteq> \<D> (u (Y i))\<close> for i using 4 le_approx1 by blast  
   then show \<open>x \<in> \<D> (\<Squnion>i. u (Y i))\<close>
     using D_LUB[OF ch2ch_cont[OF 1 3]] limproc_is_thelub[OF ch2ch_cont[OF 1 3]] 5 by force
 qed
 
 
 lemmas le_FD_adm[simp] = le_adm[folded failure_divergence_refine_def]
 
 
 lemma le_DT_adm[simp]: \<open>cont (u::('a::cpo) \<Rightarrow> 'b process) \<Longrightarrow> monofun v \<Longrightarrow> adm(\<lambda>x. u x \<sqsubseteq>\<^sub>D\<^sub>T v x)\<close>
   using adm_conj[OF le_T_adm[of u v] le_D_adm[of u v]] by (simp add: trace_divergence_refine_def)
 
 
 
 
 
 
 end
\ No newline at end of file
diff --git a/thys/HOL-CSP/ROOT b/thys/HOL-CSP/ROOT
--- a/thys/HOL-CSP/ROOT
+++ b/thys/HOL-CSP/ROOT
@@ -1,68 +1,67 @@
 chapter AFP
 
 (*****************************************************************************
  *
  * Project         : HOL-CSP - A Shallow Embedding of CSP in  Isabelle/HOL
  * Version         : 2.0
  *
  * Author          : Benoit Ballenghien, Safouan Taha, Burkhart Wolff & Lina Ye
  *                   (Based on HOL-CSP 1.0 by Haykal Tej and Burkhart Wolff)
  *
  * This file       : A Combined CSP Theory
  *
  * Copyright (c) 2009 Université Paris-Sud, France
  * Copyright (c) 2023 Université Paris-Saclay, France
  *
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials provided
  *       with the distribution.
  *
  *     * Neither the name of the copyright holders nor the names of its
  *       contributors may be used to endorse or promote products derived
  *       from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  ******************************************************************************)
 (* $Id:$ *)
 
 
 
 
-session "HOL-CSP" = HOLCF +
+session "HOL-CSP" (AFP) = HOLCF +
   description \<open>HOL-CSP based on the original Roscoe-Book.\<close>
-  options [timeout = 1200] 
+  options [document = pdf, document_output = "output", timeout = 1200] 
   sessions
     "HOL-Eisbach"
   theories
     "Introduction"
     "Process"
-     Bot Skip Stop Det Ndet Seq Hiding Sync Mndetprefix Mprefix 
-    "CSP" "Assertions"
+     Bot Skip Stop Det Ndet Seq Renaming Hiding Sync Mndetprefix Mprefix
+    "CSP_Induct" "CSP" "Assertions"
     "Conclusion"
     "CopyBuffer"
-    Induction_ext
   document_files
     "root.tex"
     "adb-long.bib"
     "root.bib"
diff --git a/thys/HOL-CSP/Renaming.thy b/thys/HOL-CSP/Renaming.thy
new file mode 100644
--- /dev/null
+++ b/thys/HOL-CSP/Renaming.thy
@@ -0,0 +1,580 @@
+(*<*)
+\<comment>\<open> ******************************************************************** 
+ * Project         : HOL-CSP - A Shallow Embedding of CSP in  Isabelle/HOL
+ * Version         : 2.0
+ *
+ * Author          : Benoît Ballenghien.
+ *                   (Based on HOL-CSP 1.0 by Haykal Tej and Burkhart Wolff)
+ *
+ * This file       : A Combined CSP Theory
+ *
+ * Copyright (c) 2009 Université Paris-Sud, France
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *
+ *     * Neither the name of the copyright holders nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ ******************************************************************************\<close>
+(*>*)
+
+section\<open> The Renaming Operator \<close>
+
+theory  Renaming
+  imports Process
+begin
+
+subsection\<open>Some preliminaries\<close>
+
+definition EvExt where \<open>EvExt f x \<equiv> case_event (ev o f) tick x\<close>
+
+
+term \<open>f -` B\<close> (* instead of defining our own antecedent function *)
+
+definition finitary :: \<open>('a \<Rightarrow> 'b) \<Rightarrow> bool\<close> 
+  where \<open>finitary f \<equiv> \<forall>x. finite(f -` {x})\<close>
+
+
+
+text \<open>We start with some simple results.\<close>
+
+lemma \<open>f -` {} = {}\<close> by simp
+
+lemma \<open>X \<subseteq> Y \<Longrightarrow> f -` X \<subseteq> f -` Y\<close> by (rule vimage_mono)
+
+lemma \<open>f -`(X \<union> Y) = f -` X \<union> f -` Y\<close> by (rule vimage_Un)
+
+
+lemma EvExt_id: \<open>EvExt id = id\<close>
+  unfolding id_def EvExt_def by (metis comp_apply event.exhaust event.simps(4, 5))
+
+lemma EvExt_eq_tick: \<open>EvExt f a = tick \<longleftrightarrow> a = tick\<close>
+  by (metis EvExt_def comp_apply event.exhaust event.simps(3, 4, 5))
+
+lemma tick_eq_EvExt: \<open>tick = EvExt f a \<longleftrightarrow> a = tick\<close>
+  by (metis EvExt_eq_tick)
+
+lemma EvExt_ev1: \<open>EvExt f b = ev a \<longleftrightarrow> (\<exists>c. b = ev c \<and> EvExt f (ev c) = ev a)\<close>
+  by (metis event.exhaust event.simps(3) tick_eq_EvExt)
+
+lemma EvExt_tF: \<open>tickFree (map (EvExt f) s) \<longleftrightarrow> tickFree s\<close> 
+  unfolding tickFree_def by (auto simp add: tick_eq_EvExt image_iff)
+
+lemma inj_EvExt: \<open>inj EvExt\<close>
+  unfolding inj_on_def EvExt_def
+  by auto (metis comp_eq_dest_lhs event.simps(4, 5) ext)
+
+
+
+
+lemma EvExt_ftF: \<open>front_tickFree (map (EvExt f) s) \<longleftrightarrow> front_tickFree s\<close> 
+  unfolding front_tickFree_def by safe (metis (no_types, opaque_lifting) EvExt_tF map_tl rev_map)+
+ 
+
+lemma map_EvExt_tick: \<open>[tick] = map (EvExt f) t \<longleftrightarrow> t = [tick]\<close>
+  using tick_eq_EvExt by fastforce
+
+
+lemma anteced_EvExt_diff_tick: \<open>EvExt f -` (X - {tick}) = EvExt f -` X - {tick}\<close>
+  by (rule subset_antisym) (simp_all add: EvExt_eq_tick subset_Diff_insert subset_vimage_iff)
+  
+
+
+lemma   ev_elem_anteced1: \<open>ev a \<in> EvExt f -` A \<longleftrightarrow> ev (f a) \<in> A\<close>
+  and tick_elem_anteced1: \<open>tick \<in> EvExt f -` A \<longleftrightarrow> tick \<in> A\<close>
+  unfolding EvExt_def by simp_all
+  
+
+lemma hd_map_EvExt: \<open>t \<noteq> [] \<Longrightarrow> hd t = ev a \<Longrightarrow> hd (map (EvExt f) t) = ev (f a)\<close>
+  and tl_map_EvExt: \<open>t \<noteq> [] \<Longrightarrow> tl (map (EvExt f) t) = map (EvExt f) (tl t)\<close>
+  unfolding EvExt_def by (simp_all add:  list.map_sel(1) map_tl)
+
+
+
+subsection\<open>The Renaming Operator Definition\<close>
+
+lift_definition Renaming :: \<open>['a process, 'a \<Rightarrow> 'b] \<Rightarrow> 'b process\<close>
+  is \<open>\<lambda>P f. ({(s, R). \<exists> s1. (s1, (EvExt f) -` R) \<in> \<F> P \<and> s = map (EvExt f) s1} \<union>
+             {(s ,R). \<exists> s1 s2. tickFree s1 \<and> front_tickFree s2 \<and> s = (map (EvExt f) s1) @ s2 \<and> s1 \<in> \<D> P},
+             {t. \<exists> s1 s2. tickFree s1 \<and> front_tickFree s2 \<and> t = (map (EvExt f) s1) @ s2 \<and> s1 \<in> \<D> P})\<close>
+proof -
+  show "is_process ({(s, R). \<exists> s1. (s1, (EvExt f) -` R) \<in> \<F> P \<and> s = map (EvExt f) s1} \<union>
+              {(s ,R). \<exists> s1 s2.   tickFree s1 \<and> front_tickFree s2 
+                                \<and> s = (map (EvExt (f :: 'a \<Rightarrow> 'b)) s1) @ s2 \<and> s1 \<in> \<D> P},
+              {t.      \<exists> s1 s2. tickFree s1 \<and> front_tickFree s2 
+                                \<and> t = (map (EvExt f) s1) @ s2 \<and> s1 \<in> \<D> P})"
+              (is "is_process(?f, ?d)") for P f
+unfolding is_process_def FAILURES_def DIVERGENCES_def
+  proof (simp only: fst_conv snd_conv, intro conjI allI impI)
+    show \<open>([], {}) \<in> ?f\<close>
+      by (simp add: process_charn)
+  next
+    show \<open>(s, X) \<in> ?f \<Longrightarrow> front_tickFree s\<close> for s X
+      by (auto simp add: EvExt_ftF is_processT2 EvExt_tF front_tickFree_append)
+  next
+    show \<open>(s @ t, {}) \<in> ?f \<Longrightarrow> (s, {}) \<in> ?f\<close> for s t
+    proof (induct t rule: rev_induct, simp, auto,
+           metis (no_types, lifting) is_processT3_SR map_eq_append_conv, goal_cases)
+      case (1 x t s1 s2)
+      show ?case
+      proof (rule "1"(1), auto)
+        assume a1: \<open>\<forall>s1. tickFree s1 \<longrightarrow> 
+                           (\<forall>s2. s @ t = map (EvExt f) s1 @ s2 \<longrightarrow> front_tickFree s2 \<longrightarrow> s1 \<notin> \<D> P)\<close>
+        have \<open>(if s2 = [] then butlast s1 else s1) \<notin> \<D> P\<close>
+          apply (rule a1[rule_format, of _ \<open>butlast s2\<close>])
+          using "1"(3, 4, 5) apply (auto simp add: tickFree_def front_tickFree_def 
+                                              intro: in_set_butlastD)
+             apply ((metis append_assoc butlast_snoc map_butlast)+)[2]
+           apply (metis append_assoc butlast_append butlast_snoc)
+          by (metis butlast_rev list.set_sel(2) rev_is_Nil_conv rev_rev_ident)
+        with \<open>s1 \<in> \<D> P\<close> have \<open>s2 = []\<close> by presburger
+        with "1"(5, 6) show \<open>\<exists>s1. (s1, {}) \<in> \<F> P \<and> s @ t = map (EvExt f) s1\<close>
+          apply (rule_tac x = \<open>butlast s1\<close> in exI, intro conjI)
+          by (metis append_butlast_last_id butlast.simps(1) process_charn)
+             (metis butlast_append map_butlast snoc_eq_iff_butlast)
+      qed
+    qed
+  next
+    show \<open>(s, Y) \<in> ?f \<and> X \<subseteq> Y \<Longrightarrow> (s, X) \<in> ?f\<close> for s X Y
+      apply (induct s rule: rev_induct, simp_all)
+      by (meson is_processT4 vimage_mono)
+         (metis process_charn vimage_mono)
+  next
+    show \<open>(s, X) \<in> ?f \<and> (\<forall>c. c \<in> Y \<longrightarrow> (s @ [c], {}) \<notin> ?f) \<Longrightarrow> (s, X \<union> Y) \<in> ?f\<close> for s X Y
+      by auto (metis (no_types, lifting) is_processT5 list.simps(8, 9) map_append vimageE)
+  next
+    show \<open>(s @ [tick], {}) \<in> ?f \<Longrightarrow> (s, X - {tick}) \<in> ?f\<close> for s X
+      apply auto
+      by (metis (no_types, lifting) anteced_EvExt_diff_tick is_processT6 map_EvExt_tick 
+                                    map_eq_append_conv)
+         (metis EvExt_tF append.assoc butlast_snoc front_tickFree_charn non_tickFree_tick
+                tickFree_Nil tickFree_append tickFree_implies_front_tickFree)
+  next
+    show \<open>s \<in> ?d \<and> tickFree s \<and> front_tickFree t \<Longrightarrow> s @ t \<in> ?d\<close> for s t
+      using front_tickFree_append by safe auto
+  next
+    show \<open>s \<in> ?d \<Longrightarrow> (s, X) \<in> ?f\<close> for s X by blast
+      
+  next
+    show \<open>s @ [tick] \<in> ?d \<Longrightarrow> s \<in> ?d\<close> for s
+      apply (induct s, auto)
+      by (metis EvExt_tF Nil_is_map_conv hd_append2 list.exhaust_sel list.sel(1) tickFree_Cons)
+         (metis Cons_eq_appendI EvExt_tF append.assoc butlast_snoc front_tickFree_charn 
+                non_tickFree_tick tickFree_Nil tickFree_append tickFree_implies_front_tickFree)
+  qed
+qed
+
+
+text \<open>Some syntaxic sugar\<close>
+
+syntax
+  "_Renaming"  :: \<open>'a process \<Rightarrow> updbinds \<Rightarrow> 'a process\<close> (\<open>_\<lbrakk>_\<rbrakk>\<close> [100, 100]) (*see the values we need, at least 51*)
+translations
+  "_Renaming P updates" \<rightleftharpoons> "CONST Renaming P (_Update (CONST id) updates)"
+
+
+text \<open>Now we can write \<^term>\<open>P\<lbrakk>a := b\<rbrakk>\<close>. But like in \<^theory>\<open>HOL.Fun\<close>, we can write this kind of
+      expression with as many updates we want: \<^term>\<open>P\<lbrakk>a := b, c := d, e := f, g := h\<rbrakk>\<close>.
+      By construction we also inherit all the results about \<^const>\<open>fun_upd\<close>, for example
+      @{thm fun_upd_other fun_upd_upd fun_upd_twist}.\<close>
+
+lemma \<open>P\<lbrakk>x := y, x := z\<rbrakk> = P\<lbrakk>x := z\<rbrakk>\<close> by simp
+
+lemma \<open>a \<noteq> c \<Longrightarrow> P\<lbrakk>a := b, c := d\<rbrakk> = P\<lbrakk>c := d, a := b\<rbrakk>\<close> by (simp add: fun_upd_twist)
+
+
+
+
+subsection\<open>The Projections\<close>
+
+lemma F_Renaming: \<open>\<F> (Renaming P f) = 
+  {(s, R). \<exists>s1. (s1, EvExt f -` R) \<in> \<F> P \<and> s = map (EvExt f) s1} \<union>
+  {(s, R). \<exists>s1 s2. tickFree s1 \<and> front_tickFree s2 \<and> s = map (EvExt f) s1 @ s2 \<and> s1 \<in> \<D> P}\<close>
+  by (simp add: Failures.rep_eq FAILURES_def Renaming.rep_eq)
+
+lemma D_Renaming: \<open>\<D> (Renaming P f) = {t. \<exists>s1 s2. tickFree s1 \<and> front_tickFree s2 \<and> 
+                                                   t = map (EvExt f) s1 @ s2 \<and> s1 \<in> \<D> P}\<close>
+  by (simp add: Divergences.rep_eq DIVERGENCES_def Renaming.rep_eq)
+
+lemma T_Renaming: \<open>\<T> (Renaming P f) = 
+  {t. \<exists> t1. t1 \<in> \<T> P \<and> t = map (EvExt f) t1} \<union> 
+  {t.\<exists> t1 t2. tickFree t1 \<and> front_tickFree t2 \<and> t = map (EvExt f) t1 @ t2 \<and> t1 \<in> \<D> P}\<close>
+  apply (subst Traces.rep_eq, auto simp add: TRACES_def Failures.rep_eq[symmetric] F_Renaming)
+  by (use F_T in blast) (metis T_F vimage_empty)
+
+
+
+subsection\<open>Continuity Rule\<close>
+
+subsubsection \<open>Monotonicity of \<^const>\<open>Renaming\<close>.\<close>
+
+lemma mono_Renaming[simp] : \<open>P \<sqsubseteq> Q \<Longrightarrow> (Renaming P f) \<sqsubseteq> (Renaming Q f)\<close>
+proof (subst le_approx_def, intro conjI)
+  show \<open>P \<sqsubseteq> Q \<Longrightarrow> \<D> (Renaming Q f) \<subseteq> \<D> (Renaming P f)\<close>
+    unfolding D_Renaming using le_approx1 by blast
+next 
+  show \<open>P \<sqsubseteq> Q \<Longrightarrow> \<forall>s. s \<notin> \<D> (Renaming P f) \<longrightarrow> \<R>\<^sub>a (Renaming P f) s = \<R>\<^sub>a (Renaming Q f) s\<close>
+    apply (auto simp add: Ra_def D_Renaming F_Renaming)
+      apply (metis EvExt_ftF append.right_neutral front_tickFree_charn front_tickFree_single
+                   le_approx2 map_append process_charn tickFree_Cons tickFree_Nil tickFree_append)
+    using le_approx_lemma_F by blast (metis le_approx_def subset_eq)
+next
+  show \<open>P \<sqsubseteq> Q \<Longrightarrow> min_elems (\<D> (Renaming P f)) \<subseteq> \<T> (Renaming Q f)\<close>
+  proof (unfold min_elems_def, auto simp add: D_Renaming T_Renaming, goal_cases)
+    case (1 s1 s2)
+    obtain t2 where f1: \<open>map (EvExt f) t2 = s2\<close>
+      by (metis "1"(3, 4, 5, 6) front_tickFree_charn less_append map_is_Nil_conv nil_less2)
+    with "1" show ?case 
+      apply (rule_tac x = \<open>s1 @ t2\<close> in exI, simp)
+      apply (rule le_approx3[simplified subset_iff, OF "1"(1), rule_format])
+      apply (induct s2 rule: rev_induct, induct s1 rule: rev_induct, auto)
+        apply (simp add: Nil_min_elems)
+       apply (metis "1"(5) append.right_neutral f1 less_self list.simps(8) min_elems3)
+      by (metis append.assoc front_tickFree_dw_closed less_self)
+  qed
+qed
+
+  
+
+
+lemma \<open>{ev c |c. f c = a} = ev`{c . f c = a}\<close> by (rule setcompr_eq_image)
+
+
+lemma vimage_EvExt_subset_vimage: \<open>EvExt f -` (ev ` A) \<subseteq> insert tick (ev ` (f -` A))\<close>
+  and vimage_subset_vimage_EvExt: \<open>(ev ` (f -` A)) \<subseteq> (EvExt f -` (ev ` A)) - {tick}\<close>
+  unfolding EvExt_def by auto (metis comp_apply event.exhaust event.simps(4) image_iff vimage_eq)
+
+
+
+subsubsection \<open>Some useful results about \<^const>\<open>finitary\<close>, and preliminaries lemmas for continuity.\<close>
+
+lemma inj_imp_finitary[simp] : \<open>inj f \<Longrightarrow> finitary f\<close> by (simp add: finitary_def finite_vimageI)
+
+lemma finitary_comp_iff : \<open>finitary g \<Longrightarrow> finitary (g o f) \<longleftrightarrow> finitary f\<close>
+proof (unfold finitary_def, intro iffI allI;
+       (subst vimage_comp[symmetric] | subst (asm) vimage_comp[symmetric]))
+  have f1: \<open>f -` g -` {x} = (\<Union>y \<in> g -` {x}. f -` {y})\<close> for x by blast
+  show \<open>finite (f -` g -` {x})\<close> if  \<open>\<forall>x. finite (f -` {x})\<close> and \<open>\<forall>x. finite (g -` {x})\<close> for x
+    apply (subst f1, subst finite_UN)
+    by (rule that(2)[unfolded finitary_def, rule_format])
+       (intro ballI that(1)[rule_format])
+qed (metis finite_Un insert_absorb vimage_insert vimage_singleton_eq)
+
+
+
+lemma finitary_updated_iff[simp] : \<open>finitary (f (a := b)) \<longleftrightarrow> finitary f\<close>
+proof (unfold fun_upd_def finitary_def vimage_def, intro iffI allI)
+  show \<open>finite {x. (if x = a then b else f x) \<in> {y}}\<close> if \<open>\<forall>y. finite {x. f x \<in> {y}}\<close> for y
+    apply (rule finite_subset[of _ \<open>{x. x = a} \<union> {x. f x \<in> {y}}\<close>], (auto)[1])
+    apply (rule finite_UnI)
+    by simp (fact that[rule_format]) 
+next
+  show \<open>finite {x. f x \<in> {y}}\<close> if \<open>\<forall>y. finite {x. (if x = a then b else f x) \<in> {y}}\<close> for y
+    apply (rule finite_subset[of _ \<open>{x. x = a \<and> f x \<in> {y}} \<union> {x. x \<noteq> a \<and> f x \<in> {y}}\<close>], (auto)[1])
+    apply (rule finite_UnI)
+    using that[rule_format, of y] by (simp_all add: Collect_mono rev_finite_subset)
+qed
+
+text \<open>By declaring this simp, we automatically obtain this kind of result.\<close>
+
+lemma \<open>finitary f \<longleftrightarrow> finitary (f (a := b, c := d, e:= g, h := i))\<close> by simp
+    
+
+
+lemma Cont_RenH2: \<open>finitary (EvExt f) \<longleftrightarrow> finitary f\<close>
+proof -
+  have inj_ev: \<open>inj ev\<close> by (simp add: inj_def)
+  show \<open>finitary (EvExt f) \<longleftrightarrow> finitary f\<close>
+    apply (subst finitary_comp_iff[of ev f, symmetric], simp add: inj_ev)
+  proof (intro iffI; subst finitary_def, intro allI)
+    have inj_ev: \<open>inj ev\<close> by (simp add: inj_def)
+    show \<open>finite ((ev \<circ> f) -` {x})\<close> if \<open>finitary (EvExt f)\<close> for x
+      apply (fold vimage_comp)
+    proof (cases \<open>x = tick\<close>, (insert finite.simps)[1], blast) 
+      assume \<open>x \<noteq> tick\<close>
+      with subset_singletonD[OF inj_vimage_singleton[OF inj_ev, of x]] obtain y 
+        where f1: \<open>ev -` {x} = {y}\<close> by auto (metis empty_iff event.exhaust vimage_singleton_eq)
+      have f2: \<open>(f -` {y}) = ev -` ev ` f -` {y}\<close> by (simp add: inj_ev inj_vimage_image_eq)
+      show \<open>finite (f -` ev -` {x})\<close> 
+        apply (subst f1, subst f2)
+        apply (rule finite_vimageI[OF _ inj_ev]) 
+        apply (rule finite_subset[OF vimage_subset_vimage_EvExt])
+        apply (rule finite_Diff)
+        using finitary_def that by fastforce
+    qed
+  next
+    show \<open>finite (EvExt f -` {x})\<close> if \<open>finitary (ev \<circ> f)\<close> for x
+    proof (cases \<open>x = tick\<close>,
+           metis Diff_cancel anteced_EvExt_diff_tick finite.emptyI infinite_remove vimage_empty)
+      assume \<open>x \<noteq> tick\<close>
+      with subset_singletonD[OF inj_vimage_singleton[OF inj_ev, of x]] obtain y 
+        where f1: \<open>{x} = ev ` {y}\<close> using event.exhaust by auto
+      show \<open>finite (EvExt f -` {x})\<close>
+        apply (subst f1)
+        apply (rule finite_subset[OF vimage_EvExt_subset_vimage])
+        apply (subst finite_insert)
+        apply (rule finite_imageI)
+        by (fact finitary_comp_iff[OF inj_imp_finitary[OF inj_ev], of f, 
+                                   simplified that, simplified, unfolded finitary_def, rule_format])
+    qed
+  qed 
+qed
+
+
+
+lemma Cont_RenH3:
+  \<open>{s1 @ t1 |s1 t1. (\<exists> b. s1 = [b] & f b = a) \<and> list = map f t1} = 
+   (\<Union> b \<in> f -`{a}. (\<lambda>t. b # t) ` {t. list = map f t})\<close>
+  by auto (metis append_Cons append_Nil)
+
+
+lemma Cont_RenH4: \<open>finitary f \<longleftrightarrow> (\<forall>s. finite {t. s = map f t})\<close>
+proof (unfold finitary_def, intro iffI allI)
+  show \<open>finite {t. s = map f t}\<close> if \<open>\<forall>x. finite (f -` {x})\<close>for s
+  proof (induct s, simp)
+    case (Cons a s)
+    have \<open>{t. a # s = map f t} = (\<Union>b \<in> f -` {a}. {b # t |t. s = map f t})\<close>
+      by (subst Cons_eq_map_conv) blast
+    thus ?case by (simp add: finite_UN[OF that[rule_format]] local.Cons)
+  qed
+next
+  have map1: \<open>[a] = map f s = (\<exists>b. s = [b] \<and> f b = a)\<close> for a s by fastforce
+  show \<open>finite (f -` {x}) \<close> if \<open>\<forall>s. finite {t. s = map f t}\<close> for x
+    by (simp add: vimage_def)
+       (fact finite_vimageI[OF that[rule_format, of \<open>[x]\<close>, simplified map1], 
+                            of \<open>\<lambda>x. [x]\<close>, unfolded inj_on_def, simplified])
+qed
+
+
+
+lemma Cont_RenH5: \<open>finitary f \<Longrightarrow> finite (\<Union>t \<in> {t. t \<le> s}. {s. t=map (EvExt f) s})\<close>
+  apply (rule finite_UN_I)
+  unfolding le_list_def
+    apply (induct s rule: rev_induct, simp)
+   apply (subgoal_tac \<open>{t. \<exists>r. t @ r = xs @ [x]} = insert (xs @ [x]) {t. \<exists>r. t @ r = xs}\<close>, auto)
+   apply (metis butlast_append butlast_snoc self_append_conv)
+  using Cont_RenH2 Cont_RenH4 by blast
+
+
+
+lemma Cont_RenH6: \<open>{t. \<exists> t2. tickFree t \<and> front_tickFree t2 \<and> x = map (EvExt f) t @ t2} 
+                   \<subseteq> {y. \<exists>xa. xa \<in> {t. t <= x} \<and> y \<in> {s. xa = map (EvExt f) s}}\<close>
+  by (auto simp add: le_list_def)
+
+
+
+lemma Cont_RenH7: \<open>finite {t. \<exists>t2. tickFree t \<and> front_tickFree t2 \<and> s = map (EvExt f) t @ t2}\<close>
+  if \<open>finitary f\<close>
+proof -
+  have f1: \<open>{y. map (EvExt f) y \<le> s} = (\<Union>z \<in> {z. z \<le> s}. {y. z = map (EvExt f) y})\<close> by fast
+  show ?thesis
+    apply (rule finite_subset[OF Cont_RenH6])
+    apply (simp add: f1)
+    apply (rule finite_UN_I)
+     apply (induct s rule: rev_induct, simp)
+     apply (subgoal_tac \<open>{z. z \<le> xs @ [x]} = insert (xs @ [x]) {z. z \<le> xs}\<close>, auto)
+      apply (metis append_eq_first_pref_spec append_self_conv le_list_def)
+     apply (meson le_list_def order_trans)
+    using Cont_RenH2 Cont_RenH4 that by blast
+qed
+
+
+lemma chain_Renaming: \<open>chain Y \<Longrightarrow> chain (\<lambda>i. Renaming (Y i) f)\<close>
+  by (simp add: chain_def) 
+
+
+
+text \<open>A key lemma for the continuity.\<close>
+
+lemma Inter_nonempty_finite_chained_sets:
+  \<open>\<forall>i. S i \<noteq> {} \<Longrightarrow> finite (S 0) \<Longrightarrow> \<forall>i. S (Suc i) \<subseteq> S i \<Longrightarrow> (\<Inter>i. S i) \<noteq> {}\<close>
+proof (induct \<open>card (S 0)\<close> arbitrary: S rule: nat_less_induct)
+  case 1
+  show ?case
+  proof (cases \<open>\<forall>i. S i = S 0\<close>)
+    case True
+    thus ?thesis by (metis "1.prems"(1) INT_iff ex_in_conv)
+  next 
+    case False
+    have f1: \<open>i \<le> j \<Longrightarrow> S j \<subseteq> S i\<close> for i j by (simp add: "1.prems"(3) lift_Suc_antimono_le)
+    with False obtain j m where f2: \<open>m < card (S 0)\<close> and f3: \<open>m = card (S j)\<close>
+      by (metis "1.prems"(2) psubsetI psubset_card_mono zero_le)
+    define T where \<open>T i \<equiv> S (i + j)\<close> for i
+    have f4: \<open>m = card (T 0)\<close> unfolding T_def by (simp add: f3)
+    from f1 have f5: \<open>(\<Inter>i. S i) = (\<Inter>i. T i)\<close> unfolding T_def by (auto intro: le_add1)
+    show ?thesis
+      apply (subst f5)
+      apply (rule "1.hyps"[rule_format, OF f2, of T, OF f4], unfold T_def)
+      by (simp_all add: "1.prems"(1, 3) lift_Suc_antimono_le)
+         (metis "1.prems"(2) add_0 f1 finite_subset le_add1)
+  qed
+qed
+
+
+
+subsubsection \<open>Finally, continuity !\<close>
+
+lemma Cont_Renaming_prem:
+  \<open>(\<Squnion> i. Renaming (Y i) f) = (Renaming (\<Squnion> i. Y i) f)\<close> if finitary: \<open>finitary f\<close> 
+   and chain: \<open>chain Y\<close>
+proof (subst Process_eq_spec, safe, goal_cases)
+  show \<open>s \<in> \<D> (\<Squnion>i. Renaming (Y i) f) \<Longrightarrow> s \<in> \<D> (Renaming (Lub Y) f)\<close> for s
+  proof (simp add: limproc_is_thelub chain chain_Renaming D_Renaming D_LUB)
+    assume a1: \<open>\<forall>i. \<exists>s1.    tickFree s1 
+                         \<and> (\<exists>s2. front_tickFree s2 
+                                  \<and> s = map (EvExt f) s1 @ s2 \<and> s1 \<in> \<D> (Y i))\<close>
+    define S where \<open>S i \<equiv> {s1. \<exists>t2.   tickFree s1 \<and> front_tickFree t2 
+                                    \<and> s = map (EvExt f) s1 @ t2 \<and> s1 \<in> \<D> (Y i)}\<close> for i
+
+    have \<open>(\<Inter>i. S i) \<noteq> {}\<close> 
+      apply (rule Inter_nonempty_finite_chained_sets, unfold S_def)
+        apply (insert a1, blast)[1]
+       apply (rule finite_subset[OF _ Cont_RenH7[OF finitary, of s]], blast)
+      using chain unfolding chain_def le_approx_def by blast
+    then obtain s1 where f5: \<open>s1 \<in> (\<Inter>i. S i)\<close> by blast
+    
+    thus \<open>\<exists>s1. tickFree s1 \<and> (\<exists>s2.   front_tickFree s2 
+                                   \<and> s = map (EvExt f) s1 @ s2 
+                                   \<and> (\<forall>i. s1 \<in> \<D> (Y i)))\<close>
+      by (rule_tac x = s1 in exI, unfold S_def) auto
+  qed
+next
+  show \<open>s \<in> \<D> (Renaming (Lub Y) f) \<Longrightarrow> s \<in> \<D> (\<Squnion>i. Renaming (Y i) f)\<close> for s
+    by (auto simp add: limproc_is_thelub chain chain_Renaming D_Renaming D_LUB)
+next
+  show \<open>(s, X) \<in> \<F> (\<Squnion>i. Renaming (Y i) f) \<Longrightarrow> (s, X) \<in> \<F> (Renaming (Lub Y) f)\<close> for s X
+  proof (auto simp add: limproc_is_thelub chain chain_Renaming F_Renaming D_LUB F_LUB)
+    assume a1: \<open>\<forall>i. (\<exists>s1. (s1, EvExt f -` X) \<in> \<F> (Y i) \<and> s = map (EvExt f) s1) \<or>
+                    (\<exists>s1. tickFree s1 \<and> 
+                          (\<exists>s2.   front_tickFree s2 
+                                \<and> s = map (EvExt f) s1 @ s2 
+                                \<and> s1 \<in> \<D> (Y i)))\<close>
+       and a2: \<open>\<forall>s1. tickFree s1 \<longrightarrow> 
+                     (\<forall>s2. s = map (EvExt f) s1 @ s2
+                             \<longrightarrow> front_tickFree s2
+                             \<longrightarrow> (\<exists>i. s1 \<notin> \<D> (Y i)))\<close>
+    define S where \<open>S i \<equiv> {s1. (s1, EvExt f -` X) \<in> \<F> (Y i) \<and> s = map (EvExt f) s1} \<union>
+                           {s1. \<exists>t2. tickFree s1 
+                                     \<and> front_tickFree t2 
+                                     \<and> s = map (EvExt f) s1 @ t2 
+                                     \<and> s1 \<in> \<D> (Y i)}\<close> for i
+
+    have \<open>s1 \<in> (\<Inter>i. S i) \<Longrightarrow> (\<forall>i. (s1, EvExt f -` X) \<in> \<F> (Y i) \<and> s = map (EvExt f) s1) 
+                              \<or> tickFree s1 \<and> (\<exists>s2.    front_tickFree s2 
+                                                     \<and> s = map (EvExt f) s1 @ s2 
+                                                     \<and> (\<forall>i. s1 \<in> \<D> (Y i)))\<close> for s1
+      unfolding S_def by auto (meson NF_ND)
+    hence f1: \<open>s1 \<in> (\<Inter>i. S i) \<Longrightarrow> (\<forall>i. (s1, EvExt f -` X) \<in> \<F>(Y i) \<and> s = map(EvExt f) s1)\<close> for s1
+      by (meson a2)
+    have \<open>(\<Inter>i. S i) \<noteq> {}\<close>
+      apply (rule Inter_nonempty_finite_chained_sets, unfold S_def)
+        apply (insert a1, blast)[1]
+       apply (subst finite_Un, intro conjI)
+        apply (rule finite_subset[of _ \<open>{s1. s = map (EvExt f) s1}\<close>], blast)
+        apply (insert Cont_RenH2 Cont_RenH4 finitary, blast)[1]
+       apply (rule finite_subset[OF _ Cont_RenH7[OF finitary, of s]], blast)
+      using NF_ND chain po_class.chainE proc_ord2a chain le_approx_def by safe blast+
+
+    then obtain s1 where \<open>s1 \<in> (\<Inter>i. S i)\<close> by blast
+    thus \<open>\<exists>s1. (\<forall>x. (s1, EvExt f -` X) \<in> \<F> (Y x)) \<and> s = map (EvExt f) s1\<close> 
+      using f1 by (rule_tac x = s1 in exI) blast
+  qed
+next
+  show \<open>(s, X) \<in> \<F> (Renaming (Lub Y) f) \<Longrightarrow> (s, X) \<in> \<F> (\<Squnion>i. Renaming (Y i) f)\<close> for s X
+    by (auto simp add: limproc_is_thelub chain chain_Renaming F_Renaming D_LUB F_LUB)  
+qed
+ 
+
+lemma Renaming_cont[simp] : \<open>cont P \<Longrightarrow> finitary f \<Longrightarrow> cont (\<lambda>x. (Renaming (P x) f))\<close>
+  by (rule contI2)
+     (simp add: cont2monofunE monofunI, simp add: Cont_Renaming_prem ch2ch_cont cont2contlubE)
+
+
+lemma RenamingF_cont : \<open>cont P \<Longrightarrow> cont (\<lambda>x. (P x)\<lbrakk>a := b\<rbrakk>)\<close>
+  (* by simp *)
+  by (simp only: Renaming_cont finitary_updated_iff inj_imp_finitary inj_on_id)
+
+
+lemma \<open>cont P \<Longrightarrow> cont (\<lambda>x. (P x)\<lbrakk>a := b, c := d, e := f, g := a\<rbrakk>)\<close>
+  (* by simp *)
+  apply (erule Renaming_cont)
+  apply (simp only: finitary_updated_iff)
+  apply (rule inj_imp_finitary)
+  by (rule inj_on_id)
+  
+ 
+
+
+
+subsection \<open>Some nice properties\<close>
+
+
+lemma EvExt_comp: \<open>EvExt (g \<circ> f) = EvExt g \<circ> EvExt f\<close>
+  unfolding EvExt_def by (rule ext, auto) (metis comp_apply event.exhaust event.simps(4, 5))
+
+
+
+lemma Renaming_comp : \<open>Renaming P (g o f) = Renaming (Renaming P f) g\<close>
+proof (subst Process_eq_spec, intro conjI subset_antisym)
+  show \<open>\<F> (Renaming P (g \<circ> f)) \<subseteq> \<F> (Renaming (Renaming P f) g)\<close>
+    apply (simp add: F_Renaming D_Renaming subset_iff, safe)
+    by (metis (no_types, opaque_lifting) EvExt_comp list.map_comp set.compositionality)
+       (metis (no_types, opaque_lifting) EvExt_comp EvExt_tF append.right_neutral 
+                                         front_tickFree_Nil list.map_comp)
+next
+  show \<open>\<F> (Renaming (Renaming P f) g) \<subseteq> \<F> (Renaming P (g \<circ> f))\<close>
+    apply (auto simp add: F_Renaming D_Renaming EvExt_comp EvExt_ftF EvExt_tF front_tickFree_append)
+    by (metis (no_types, opaque_lifting) EvExt_comp list.map_comp set.compositionality)
+next
+  show \<open>\<D> (Renaming P (g \<circ> f)) \<subseteq> \<D> (Renaming (Renaming P f) g)\<close>
+    apply (simp add: D_Renaming subset_iff, safe)
+    by (metis (no_types, opaque_lifting) EvExt_comp EvExt_tF append.right_neutral 
+                                         front_tickFree_Nil list.map_comp)
+next
+  show \<open>\<D> (Renaming (Renaming P f) g) \<subseteq> \<D> (Renaming P (g \<circ> f))\<close>
+    apply (auto simp add: D_Renaming subset_iff)
+    by (metis EvExt_comp EvExt_tF front_tickFree_append)
+qed
+
+
+
+
+lemma Renaming_id: \<open>Renaming P id = P\<close>
+  by (subst Process_eq_spec, auto simp add: F_Renaming D_Renaming EvExt_id 
+                                            is_processT7_S is_processT8_S)
+     (metis append.right_neutral front_tickFree_mono list.distinct(1) 
+            nonTickFree_n_frontTickFree process_charn)
+  
+
+lemma Renaming_inv: \<open>Renaming (Renaming P f) (inv f) = P\<close> if \<open>inj f\<close>
+  apply (subst Renaming_comp[symmetric])
+  apply (subst inv_o_cancel[OF that])
+  by (fact Renaming_id)
+
+
+end
+
diff --git a/thys/HOL-CSP/Seq.thy b/thys/HOL-CSP/Seq.thy
--- a/thys/HOL-CSP/Seq.thy
+++ b/thys/HOL-CSP/Seq.thy
@@ -1,442 +1,402 @@
 (*<*)
 \<comment>\<open> ******************************************************************** 
  * Project         : HOL-CSP - A Shallow Embedding of CSP in  Isabelle/HOL
  * Version         : 2.0
  *
- * Author          : Burkhart Wolff, Safouan Taha, Lina Ye.
+ * Author          : Burkhart Wolff, Safouan Taha.
  *                   (Based on HOL-CSP 1.0 by Haykal Tej and Burkhart Wolff)
  *
  * This file       : A Combined CSP Theory
  *
  * Copyright (c) 2009 Université Paris-Sud, France
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials provided
  *       with the distribution.
  *
  *     * Neither the name of the copyright holders nor the names of its
  *       contributors may be used to endorse or promote products derived
  *       from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  ******************************************************************************\<close>
 (*>*)
 
 section\<open>The Sequence Operator\<close>
 
 theory  Seq
   imports Process 
 begin 
 
 subsection\<open>Definition\<close>
 abbreviation "div_seq P Q   \<equiv> {t1 @ t2 |t1 t2. t1 \<in> \<D> P \<and> tickFree t1 \<and> front_tickFree t2}
                             \<union> {t1 @ t2 |t1 t2. t1 @ [tick] \<in> \<T> P \<and> t2 \<in> \<D> Q}"
 
-definition  Seq :: "['a process,'a process] \<Rightarrow> 'a process"  (infixl  "\<^bold>;" 74)  
-where       "P \<^bold>; Q \<equiv> Abs_process
-                            ({(t, X). (t, X \<union> {tick}) \<in> \<F> P \<and> tickFree t} \<union>
-                             {(t, X). \<exists>t1 t2. t = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> P \<and> (t2, X) \<in> \<F> Q} \<union>
-                             {(t, X). t \<in> div_seq P Q},
-                             div_seq P Q)"
-
-lemma  Seq_maintains_is_process:
-      "is_process     ({(t, X). (t, X \<union> {tick}) \<in> \<F> P \<and> tickFree t} \<union>
-                       {(t, X). \<exists>t1 t2. t = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> P \<and> (t2, X) \<in> \<F> Q} \<union>
-                       {(t, X). t \<in> div_seq P Q},
-                       div_seq P Q)"
-       (is "is_process(?f, ?d)")
-proof(simp only: fst_conv snd_conv Failures_def is_process_def FAILURES_def DIVERGENCES_def,
-      fold FAILURES_def DIVERGENCES_def,fold Failures_def,intro conjI)
-  show "([], {}) \<in> ?f" 
-    apply(cases "[tick] \<in> \<T> P", simp_all add: is_processT1)
-    using F_T is_processT5_S6 by blast        
-next
-  show " \<forall>s X. (s, X) \<in> ?f \<longrightarrow> front_tickFree s"
-    by (auto simp:is_processT2 append_T_imp_tickFree front_tickFree_append D_imp_front_tickFree)   
-next
-  show "\<forall>s t. (s @ t, {}) \<in> ?f \<longrightarrow> (s, {}) \<in> ?f"       
-    apply auto
-          apply (metis F_T append_Nil2 is_processT is_processT3_SR is_processT5_S3)
-         apply(simp add:append_eq_append_conv2) 
-         apply (metis T_F_spec append_Nil2 is_processT is_processT5_S4)
-        apply (metis append_self_conv front_tickFree_append front_tickFree_mono is_processT2_TR 
-              no_Trace_implies_no_Failure non_tickFree_implies_nonMt non_tickFree_tick)
-       apply (metis (mono_tags, lifting) F_T append_Nil2 is_processT5_S3 process_charn)
-      apply (metis front_tickFree_append front_tickFree_mono self_append_conv)
-     apply(simp add:append_eq_append_conv2)
-     apply (metis T_F_spec append_Nil2 is_processT is_processT5_S4)
-    by (metis D_imp_front_tickFree append_T_imp_tickFree front_tickFree_append 
-               front_tickFree_mono not_Cons_self2 self_append_conv)
-next
-  show "\<forall>s X Y. (s, Y) \<in> ?f \<and> X \<subseteq> Y \<longrightarrow> (s, X) \<in> ?f" 
-    apply auto
-       apply (metis insert_mono is_processT4_S1 prod.sel(1) prod.sel(2))
-      apply (metis is_processT4)
-     apply (simp add: append_T_imp_tickFree)
-    by (metis process_charn)
-next
-  { fix sa X Y
-    have "(sa, X \<union> {tick}) \<in> \<F> P \<Longrightarrow>
-            tickFree sa \<Longrightarrow>
-            \<forall>c. c \<in> Y \<and> c \<noteq> tick \<longrightarrow> (sa @ [c], {}) \<notin> \<F> P \<Longrightarrow> 
-            (sa, X \<union> Y \<union> {tick}) \<in> \<F> P \<and> tickFree sa"
-    apply(rule_tac t="X \<union> Y \<union> {tick}" and s="X \<union> {tick} \<union> (Y-{tick})" in subst,auto)
-    by   (metis DiffE Un_insert_left is_processT5 singletonI)
-  } note is_processT5_SEQH3 = this
-  have is_processT5_SEQH4 : 
-       "\<And> sa X Y. (sa, X \<union> {tick}) \<in> \<F> P 
-                   \<Longrightarrow> tickFree sa 
-                   \<Longrightarrow> \<forall>c. c \<in> Y \<longrightarrow> (sa@[c],{tick}) \<notin> \<F> P \<or> \<not> tickFree(sa@[c]) 
-                   \<Longrightarrow> \<forall>c. c \<in> Y \<longrightarrow> (\<forall>t1 t2. sa@[c]\<noteq>t1@t2 \<or> t1@[tick]\<notin>\<T> P \<or> (t2,{})\<notin>\<F> Q) 
-                   \<Longrightarrow> (sa, X \<union> Y \<union> {tick}) \<in> \<F> P \<and> tickFree sa"
-    by (metis append_Nil2 is_processT1 is_processT5_S3 is_processT5_SEQH3 
-                         no_Trace_implies_no_Failure tickFree_Cons tickFree_append)
-  let ?f1 = "{(t, X). (t, X \<union> {tick}) \<in> \<F> P \<and> tickFree t} \<union> 
-             {(t, X). \<exists>t1 t2. t = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> P \<and> (t2, X) \<in> \<F> Q}"
-  have is_processT5_SEQ2: "\<And> sa X Y. (sa, X) \<in> ?f1 
-                                      \<Longrightarrow> (\<forall>c. c \<in> Y \<longrightarrow> (sa@[c], {})\<notin>?f) 
-                                      \<Longrightarrow> (sa, X\<union>Y) \<in> ?f1"
-    apply (clarsimp,rule is_processT5_SEQH4[simplified])
-    by (auto simp: is_processT5)
-  show "\<forall>s X Y. (s, X) \<in> ?f \<and> (\<forall>c. c \<in> Y \<longrightarrow> (s @ [c], {}) \<notin> ?f) \<longrightarrow> (s, X \<union> Y) \<in> ?f"
-    apply(intro allI impI, elim conjE UnE)
-      apply(rule rev_subsetD)
-       apply(rule is_processT5_SEQ2)
-        apply auto
-      using is_processT5_S1 apply force
-     apply (simp add: append_T_imp_tickFree)
-    using is_processT5[rule_format, OF conjI] by force
-next  
-  show "\<forall>s X. (s @ [tick], {}) \<in> ?f \<longrightarrow> (s, X - {tick}) \<in> ?f" 
-    apply auto
-        apply (metis (no_types, lifting) append_T_imp_tickFree butlast_append 
-                     butlast_snoc is_processT2 is_processT6 nonTickFree_n_frontTickFree 
-                     non_tickFree_tick tickFree_append)
-       apply (metis append_T_imp_tickFree front_tickFree_append front_tickFree_mono 
-                    is_processT2 non_tickFree_implies_nonMt non_tickFree_tick)
-      apply (metis process_charn)
-     apply (metis front_tickFree_append front_tickFree_implies_tickFree)
-    apply (metis D_T T_nonTickFree_imp_decomp append_T_imp_tickFree append_assoc 
-                 append_same_eq non_tickFree_implies_nonMt non_tickFree_tick process_charn 
-                 tickFree_append)
-    by    (metis D_imp_front_tickFree append_T_imp_tickFree front_tickFree_append 
-                    front_tickFree_mono non_tickFree_implies_nonMt non_tickFree_tick)
-next
-  show "\<forall>s t. s \<in> ?d \<and> tickFree s \<and> front_tickFree t \<longrightarrow> s @ t \<in> ?d"
-    apply auto 
-     using front_tickFree_append apply blast     
-    by (metis process_charn)
-next  
-  show "\<forall>s X. s \<in> ?d \<longrightarrow>  (s, X) \<in> ?f"
-    by blast
-next  
-  show "\<forall>s. s @ [tick] \<in> ?d \<longrightarrow> s \<in> ?d"
-    apply auto      
-     apply (metis append_Nil2 front_tickFree_implies_tickFree process_charn)
-    by (metis append1_eq_conv append_assoc front_tickFree_implies_tickFree is_processT2_TR 
-                nonTickFree_n_frontTickFree non_tickFree_tick process_charn tickFree_append)
+lift_definition  Seq :: "['a process,'a process] \<Rightarrow> 'a process"  (infixl  "\<^bold>;" 74)  
+is       "\<lambda>P Q. ({(t, X). (t, X \<union> {tick}) \<in> \<F> P \<and> tickFree t} \<union>
+                 {(t, X). \<exists>t1 t2. t = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> P \<and> (t2, X) \<in> \<F> Q} \<union>
+                 {(t, X). t \<in> div_seq P Q},
+                 div_seq P Q)"
+proof -
+  show "is_process ({(t, X). (t, X \<union> {tick}) \<in> \<F> (P :: 'a process) \<and> tickFree t} \<union>
+                    {(t, X). \<exists>t1 t2. t = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> P \<and> (t2, X) \<in> \<F> Q} \<union>
+                    {(t, X). t \<in> div_seq P Q},
+                    div_seq P Q)"
+   (is "is_process(?f, ?d)") for P Q
+    unfolding is_process_def FAILURES_def DIVERGENCES_def
+  proof (simp only: fst_conv snd_conv, intro conjI)
+    show "([], {}) \<in> ?f" 
+      apply(cases "[tick] \<in> \<T> P", simp_all add: is_processT1)
+      using F_T is_processT5_S6 by blast        
+  next
+    show " \<forall>s X. (s, X) \<in> ?f \<longrightarrow> front_tickFree s"
+      by (auto simp:is_processT2 append_T_imp_tickFree front_tickFree_append D_imp_front_tickFree)   
+  next
+    show "\<forall>s t. (s @ t, {}) \<in> ?f \<longrightarrow> (s, {}) \<in> ?f"       
+      apply auto
+            apply (metis F_T append_Nil2 is_processT is_processT3_SR is_processT5_S3)
+           apply(simp add:append_eq_append_conv2) 
+           apply (metis T_F_spec append_Nil2 is_processT is_processT5_S4)
+          apply (metis append_self_conv front_tickFree_append front_tickFree_mono is_processT2_TR 
+                no_Trace_implies_no_Failure non_tickFree_implies_nonMt non_tickFree_tick)
+         apply (metis (mono_tags, lifting) F_T append_Nil2 is_processT5_S3 process_charn)
+        apply (metis front_tickFree_append front_tickFree_mono self_append_conv)
+       apply(simp add:append_eq_append_conv2)
+       apply (metis T_F_spec append_Nil2 is_processT is_processT5_S4)
+      by (metis D_imp_front_tickFree append_T_imp_tickFree front_tickFree_append 
+                 front_tickFree_mono not_Cons_self2 self_append_conv)
+  next
+    show "\<forall>s X Y. (s, Y) \<in> ?f \<and> X \<subseteq> Y \<longrightarrow> (s, X) \<in> ?f" 
+      apply auto
+         apply (metis insert_mono is_processT4_S1 prod.sel(1) prod.sel(2))
+        apply (metis is_processT4)
+       apply (simp add: append_T_imp_tickFree)
+      by (metis process_charn)
+  next
+    { fix sa X Y
+      have "(sa, X \<union> {tick}) \<in> \<F> P \<Longrightarrow>
+              tickFree sa \<Longrightarrow>
+              \<forall>c. c \<in> Y \<and> c \<noteq> tick \<longrightarrow> (sa @ [c], {}) \<notin> \<F> P \<Longrightarrow> 
+              (sa, X \<union> Y \<union> {tick}) \<in> \<F> P \<and> tickFree sa"
+      apply(rule_tac t="X \<union> Y \<union> {tick}" and s="X \<union> {tick} \<union> (Y-{tick})" in subst,auto)
+      by   (metis DiffE Un_insert_left is_processT5 singletonI)
+    } note is_processT5_SEQH3 = this
+    have is_processT5_SEQH4 : 
+         "\<And> sa X Y. (sa, X \<union> {tick}) \<in> \<F> P 
+                     \<Longrightarrow> tickFree sa 
+                     \<Longrightarrow> \<forall>c. c \<in> Y \<longrightarrow> (sa@[c],{tick}) \<notin> \<F> P \<or> \<not> tickFree(sa@[c]) 
+                     \<Longrightarrow> \<forall>c. c \<in> Y \<longrightarrow> (\<forall>t1 t2. sa@[c]\<noteq>t1@t2 \<or> t1@[tick]\<notin>\<T> P \<or> (t2,{})\<notin>\<F> Q) 
+                     \<Longrightarrow> (sa, X \<union> Y \<union> {tick}) \<in> \<F> P \<and> tickFree sa"
+      by (metis append_Nil2 is_processT1 is_processT5_S3 is_processT5_SEQH3 
+                           no_Trace_implies_no_Failure tickFree_Cons tickFree_append)
+    let ?f1 = "{(t, X). (t, X \<union> {tick}) \<in> \<F> P \<and> tickFree t} \<union> 
+               {(t, X). \<exists>t1 t2. t = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> P \<and> (t2, X) \<in> \<F> Q}"
+    have is_processT5_SEQ2: "\<And> sa X Y. (sa, X) \<in> ?f1 
+                                        \<Longrightarrow> (\<forall>c. c \<in> Y \<longrightarrow> (sa@[c], {})\<notin>?f) 
+                                        \<Longrightarrow> (sa, X\<union>Y) \<in> ?f1"
+      apply (clarsimp,rule is_processT5_SEQH4[simplified])
+      by (auto simp: is_processT5)
+    show "\<forall>s X Y. (s, X) \<in> ?f \<and> (\<forall>c. c \<in> Y \<longrightarrow> (s @ [c], {}) \<notin> ?f) \<longrightarrow> (s, X \<union> Y) \<in> ?f"
+      apply(intro allI impI, elim conjE UnE)
+        apply(rule rev_subsetD)
+         apply(rule is_processT5_SEQ2)
+          apply auto
+        using is_processT5_S1 apply force
+       apply (simp add: append_T_imp_tickFree)
+      using is_processT5[rule_format, OF conjI] by force
+  next  
+    show "\<forall>s X. (s @ [tick], {}) \<in> ?f \<longrightarrow> (s, X - {tick}) \<in> ?f" 
+      apply auto
+          apply (metis (no_types, lifting) append_T_imp_tickFree butlast_append 
+                       butlast_snoc is_processT2 is_processT6 nonTickFree_n_frontTickFree 
+                       non_tickFree_tick tickFree_append)
+         apply (metis append_T_imp_tickFree front_tickFree_append front_tickFree_mono 
+                      is_processT2 non_tickFree_implies_nonMt non_tickFree_tick)
+        apply (metis process_charn)
+       apply (metis front_tickFree_append front_tickFree_implies_tickFree)
+      apply (metis D_T T_nonTickFree_imp_decomp append_T_imp_tickFree append_assoc 
+                   append_same_eq non_tickFree_implies_nonMt non_tickFree_tick process_charn 
+                   tickFree_append)
+      by    (metis D_imp_front_tickFree append_T_imp_tickFree front_tickFree_append 
+                      front_tickFree_mono non_tickFree_implies_nonMt non_tickFree_tick)
+  next
+    show "\<forall>s t. s \<in> ?d \<and> tickFree s \<and> front_tickFree t \<longrightarrow> s @ t \<in> ?d"
+      apply auto 
+       using front_tickFree_append apply blast     
+      by (metis process_charn)
+  next  
+    show "\<forall>s X. s \<in> ?d \<longrightarrow>  (s, X) \<in> ?f"
+      by blast
+  next  
+    show "\<forall>s. s @ [tick] \<in> ?d \<longrightarrow> s \<in> ?d"
+      apply auto      
+       apply (metis append_Nil2 front_tickFree_implies_tickFree process_charn)
+      by (metis append1_eq_conv append_assoc front_tickFree_implies_tickFree is_processT2_TR 
+                  nonTickFree_n_frontTickFree non_tickFree_tick process_charn tickFree_append)
+  qed
 qed
 
 
 subsection\<open>The Projections\<close>
 
-
-lemmas  Rep_Abs_Seq[simp] = Abs_process_inverse[simplified, OF Seq_maintains_is_process]
-
-lemma  
-    F_Seq   : "\<F> (P \<^bold>; Q) =  {(t, X). (t, X \<union> {tick}) \<in> \<F> P \<and> tickFree t} \<union>
-                             {(t, X). \<exists>t1 t2. t = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> P \<and> (t2, X) \<in> \<F> Q} \<union>
-                             {(t, X). \<exists>t1 t2. t = t1 @ t2 \<and> t1 \<in> \<D> P \<and> tickFree t1 \<and> front_tickFree t2} \<union>
-                             {(t, X). \<exists>t1 t2. t = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> P \<and> t2 \<in> \<D> Q}"
-unfolding Seq_def by(subst Failures_def, simp only:Rep_Abs_Seq, auto simp: FAILURES_def)
+lemma F_Seq: \<open>\<F> (P \<^bold>; Q) = {(t, X). (t, X \<union> {tick}) \<in> \<F> P \<and> tickFree t} \<union> 
+                          {(t1 @ t2, X) |t1 t2 X. t1 @ [tick] \<in> \<T> P \<and> (t2, X) \<in> \<F> Q} \<union>
+                          {(t1, X) |t1 X. t1 \<in> \<D> P}\<close>
+  apply (subst Failures.rep_eq, auto simp add: Seq.rep_eq FAILURES_def)
+  using is_processT7 is_processT apply (blast+)[5]
+  by (meson is_processT)
+     (metis front_tickFree_implies_tickFree front_tickFree_single
+            is_processT nonTickFree_n_frontTickFree)
 
-lemma
-    D_Seq  : "\<D> (P \<^bold>; Q) =  {t1 @ t2 |t1 t2. t1 \<in> \<D> P \<and> tickFree t1 \<and> front_tickFree t2} \<union>
-                           {t1 @ t2 |t1 t2. t1 @ [tick] \<in> \<T> P \<and> t2 \<in> \<D> Q}"
-unfolding Seq_def by(subst D_def,simp only:Rep_Abs_Seq, simp add:DIVERGENCES_def)
+ 
+lemma D_Seq: \<open>\<D> (P \<^bold>; Q) = \<D> P \<union> {t1 @ t2 |t1 t2. t1 @ [tick] \<in> \<T> P \<and> t2 \<in> \<D> Q}\<close>
+  apply (subst Divergences.rep_eq, auto simp add: Seq.rep_eq DIVERGENCES_def)
+  by (simp add: is_processT7_S)
+     (metis elem_min_elems front_tickFree_mono is_processT min_elems_charn 
+            nonTickFree_n_frontTickFree non_tickFree_tick tickFree_Nil tickFree_append)
 
-lemma
-    T_Seq   : "\<T> (P \<^bold>; Q) =  {t. \<exists> X. (t, X \<union> {tick}) \<in> \<F> P \<and> tickFree t} \<union>  
-                             {t. \<exists> t1 t2. t = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> P \<and> t2 \<in> \<T> Q} \<union>
-                             {t1 @ t2 |t1 t2. t1 \<in> \<D> P \<and> tickFree t1 \<and> front_tickFree t2} \<union>
-                             {t1 @ t2 |t1 t2. t1 @ [tick] \<in> \<T> P \<and> t2 \<in> \<D> Q} \<union>
-                             {t1 @ t2 |t1 t2. t1 \<in> \<D> P \<and> tickFree t1 \<and> front_tickFree t2} \<union>
-                             {t1 @ t2 |t1 t2. t1 @ [tick] \<in> \<T> P \<and> t2 \<in> \<D> Q}"
-  unfolding Seq_def  
-  apply(subst Traces_def, simp only: Rep_Abs_Seq, auto simp: TRACES_def FAILURES_def)
-     using F_T apply fastforce
-    apply (simp add: append_T_imp_tickFree)
-   using F_T apply fastforce
-  using T_F by blast
+
+lemma T_Seq: \<open>\<T> (P \<^bold>; Q) = {t. \<exists>X. (t, X \<union> {tick}) \<in> \<F> P \<and> tickFree t} \<union> 
+                          {t1 @ t2 |t1 t2. t1 @ [tick] \<in> \<T> P \<and> t2 \<in> \<T> Q} \<union>
+                          \<D> P\<close>
+  by (auto simp add: Traces.rep_eq TRACES_def Failures.rep_eq[symmetric] F_Seq)
+   
 
 subsection\<open> Continuity Rule \<close>
 
 lemma mono_Seq_D11:  
 "P \<sqsubseteq> Q \<Longrightarrow> \<D> (Q \<^bold>; S) \<subseteq> \<D> (P \<^bold>; S)"
   apply(auto simp: D_Seq)
    using le_approx1 apply blast
   using le_approx_lemma_T by blast
 
 lemma mono_Seq_D12: 
 assumes ordered: "P \<sqsubseteq> Q"
 shows   "(\<forall> s. s \<notin> \<D> (P \<^bold>; S) \<longrightarrow> Ra (P \<^bold>; S) s = Ra (Q \<^bold>; S) s)"
 proof -
   have mono_SEQI2a:"P \<sqsubseteq> Q \<Longrightarrow> \<forall>s. s \<notin> \<D> (P \<^bold>; S) \<longrightarrow> Ra (Q \<^bold>; S) s \<subseteq> Ra (P \<^bold>; S) s"
     apply(simp add: Ra_def D_Seq F_Seq)
     apply(insert le_approx_lemma_F[of P Q] le_approx_lemma_T[of P Q], auto) 
     using le_approx1 by blast+
   have mono_SEQI2b:"P \<sqsubseteq> Q \<Longrightarrow> \<forall>s. s \<notin> \<D> (P \<^bold>; S) \<longrightarrow> Ra (P \<^bold>; S) s \<subseteq> Ra (Q \<^bold>; S) s"
     apply(simp add: Ra_def D_Seq F_Seq)
     apply(insert le_approx_lemma_F[of P Q] le_approx_lemma_T[of P Q] 
           le_approx1[of P Q] le_approx2T[of P Q], auto) 
       using le_approx2 apply fastforce
      apply (metis front_tickFree_implies_tickFree is_processT2_TR process_charn)
     apply (simp add: append_T_imp_tickFree) 
     by (metis front_tickFree_implies_tickFree is_processT2_TR process_charn)
   show ?thesis 
     using ordered mono_SEQI2a mono_SEQI2b by(blast)
 qed
 
 lemma minSeqInclu: 
   "min_elems(\<D> (P \<^bold>; S)) 
    \<subseteq> min_elems(\<D> P) \<union> {t1@t2|t1 t2. t1@[tick]\<in>\<T> P\<and>t1\<notin>\<D> P\<and>t2\<in>min_elems(\<D> S)}"
   apply(auto simp: D_Seq min_elems_def)
-     apply (meson process_charn)
-    apply (metis append_Nil2 front_tickFree_Nil front_tickFree_append front_tickFree_mono 
-           le_list_def less_list_def)
-   apply (metis (no_types, lifting) D_imp_front_tickFree Nil_is_append_conv append_T_imp_tickFree 
-          append_butlast_last_id butlast_append process_charn less_self lim_proc_is_lub3a 
-          list.distinct(1) nil_less)
-  by (metis D_imp_front_tickFree append_Nil2 front_tickFree_Nil front_tickFree_mono process_charn 
-      list.distinct(1) nonTickFree_n_frontTickFree)
+  by (metis append_single_T_imp_tickFree less_append process_charn)
+    
 
 lemma mono_Seq_D13 : 
 assumes ordered: "P \<sqsubseteq> Q"
 shows        "min_elems (\<D> (P \<^bold>; S)) \<subseteq> \<T> (Q \<^bold>; S)"
   apply (insert ordered, frule le_approx3, rule subset_trans [OF minSeqInclu])
   apply (auto simp: F_Seq T_Seq min_elems_def append_T_imp_tickFree)
      apply(rule_tac x="{}" in exI, rule is_processT5_S3)
       apply (metis (no_types, lifting) T_F elem_min_elems le_approx3 less_list_def min_elems5 subset_eq)
      using Nil_elem_T no_Trace_implies_no_Failure apply fastforce
-    apply (metis (no_types, lifting) less_self nonTickFree_n_frontTickFree process_charn)  
-   apply(rule_tac x="{}" in exI, metis (no_types, lifting) le_approx2T process_charn)
+       apply (metis (no_types, lifting) less_self nonTickFree_n_frontTickFree process_charn)  
+     apply (metis (no_types, opaque_lifting) D_T le_approx2T process_charn)
   by (metis (no_types, lifting) less_self nonTickFree_n_frontTickFree process_charn)  
 
 lemma mono_Seq[simp] : "P \<sqsubseteq> Q \<Longrightarrow> (P \<^bold>; S) \<sqsubseteq> (Q \<^bold>; S)"
 by (auto simp: le_approx_def mono_Seq_D11 mono_Seq_D12 mono_Seq_D13)
 
 lemma mono_Seq_D21:  
 "P \<sqsubseteq> Q \<Longrightarrow> \<D> (S \<^bold>; Q) \<subseteq> \<D> (S \<^bold>; P)"
   apply(auto simp: D_Seq)
   using le_approx1 by blast
 
 lemma mono_Seq_D22: 
 assumes ordered: "P \<sqsubseteq> Q"
 shows   "(\<forall> s. s \<notin> \<D> (S \<^bold>; P) \<longrightarrow> Ra (S \<^bold>; P) s = Ra (S \<^bold>; Q) s)"
 proof -
   have mono_SEQI2a:"P \<sqsubseteq> Q \<Longrightarrow> \<forall>s. s \<notin> \<D> (S \<^bold>; P) \<longrightarrow> Ra (S \<^bold>; Q) s \<subseteq> Ra (S \<^bold>; P) s"
     apply(simp add: Ra_def D_Seq F_Seq)
-    apply(insert le_approx_lemma_F[of P Q] le_approx_lemma_T[of P Q], auto) 
-    using le_approx1 by fastforce+
+    by(use le_approx_lemma_F[of P Q] le_approx_lemma_T[of P Q] in auto) 
   have mono_SEQI2b:"P \<sqsubseteq> Q \<Longrightarrow> \<forall>s. s \<notin> \<D> (S \<^bold>; P) \<longrightarrow> Ra (S \<^bold>; P) s \<subseteq> Ra (S \<^bold>; Q) s"
     apply(simp add: Ra_def D_Seq F_Seq)
     apply(insert le_approx_lemma_F[of P Q] le_approx_lemma_T[of P Q] 
             le_approx1[of P Q] le_approx2T[of P Q], auto) 
     using le_approx2 by fastforce+
   show ?thesis 
     using ordered mono_SEQI2a mono_SEQI2b by(blast)
 qed
 
 lemma mono_Seq_D23 : 
 assumes ordered: "P \<sqsubseteq> Q"
 shows       "min_elems (\<D> (S \<^bold>; P)) \<subseteq> \<T> (S \<^bold>; Q)"
   apply (insert ordered, frule le_approx3, auto simp: D_Seq T_Seq min_elems_def)
      apply (metis (no_types, lifting) D_imp_front_tickFree Nil_elem_T append.assoc below_refl 
             front_tickFree_charn less_self min_elems2 no_Trace_implies_no_Failure)
-    apply (simp add: append_T_imp_tickFree)
-  by (metis (no_types, lifting) D_def D_imp_front_tickFree append_butlast_last_id append_is_Nil_conv 
-        butlast_append butlast_snoc is_process9 is_process_Rep less_self nonTickFree_n_frontTickFree)
+   apply (simp add: append_T_imp_tickFree)
+  by (metis (no_types, lifting) append.assoc is_processT less_self nonTickFree_n_frontTickFree)
 
 lemma mono_Seq_sym[simp] : "P \<sqsubseteq> Q \<Longrightarrow> (S \<^bold>; P) \<sqsubseteq> (S \<^bold>; Q)"
 by (auto simp: le_approx_def mono_Seq_D21 mono_Seq_D22 mono_Seq_D23)
 
 lemma chain_Seq1: "chain Y \<Longrightarrow> chain (\<lambda>i. Y i \<^bold>; S)"
   by(simp add: chain_def) 
 
 lemma chain_Seq2: "chain Y \<Longrightarrow> chain (\<lambda>i. S \<^bold>; Y i)"
   by(simp add: chain_def)  
 
 lemma limproc_Seq_D1: "chain Y \<Longrightarrow> \<D> (lim_proc (range Y) \<^bold>; S) = \<D> (lim_proc (range (\<lambda>i. Y i \<^bold>; S)))"
   apply(auto simp:Process_eq_spec D_Seq F_Seq F_LUB D_LUB T_LUB chain_Seq1)
-   apply(blast)
-  proof -
-    fix x
-    assume A:"\<forall>xa. (\<exists>t1 t2. x = t1 @ t2 \<and> t1 \<in> \<D> (Y xa) \<and> tickFree t1 \<and> front_tickFree t2) \<or>
-                (\<exists>t1 t2. x = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> (Y xa) \<and> t2 \<in> \<D> S)"
-    and B: "\<forall>t1 t2. x = t1 @ t2 \<longrightarrow> (\<exists>x. t1 @ [tick] \<notin> \<T> (Y x)) \<or> t2 \<notin> \<D> S"
-    and C: "chain Y"
-    thus "\<exists>t1 t2. x = t1 @ t2 \<and> (\<forall>x. t1 \<in> \<D> (Y x)) \<and> tickFree t1 \<and> front_tickFree t2"        
-      proof (cases "\<exists>n. \<forall>t1 \<le> x. t1 \<notin> \<D> (Y n)")
-        case True
-        then obtain n where "\<forall>t1 \<le> x. t1 \<notin> \<D> (Y n)" by blast
-        with A B C show ?thesis 
-          apply(erule_tac x=n in allE, elim exE disjE, auto simp add:le_list_def)
-          by (metis D_T chain_lemma is_processT le_approx2T)
-      next
-        case False
-        from False obtain t1 where D:"t1 \<le> x \<and> (\<forall>n. \<forall>t \<le> x. t \<in> \<D> (Y n) \<longrightarrow> t \<le> t1)" by blast
-        with False have E:"\<forall>n. t1 \<in> \<D> (Y n)" 
-          by (metis append_Nil2 append_T_imp_tickFree front_tickFree_append front_tickFree_mono 
-                    is_processT le_list_def local.A not_Cons_self2)
-        from A B C D E show ?thesis
-          by (metis D_imp_front_tickFree Traces_def append_Nil2 front_tickFree_append 
-                    front_tickFree_implies_tickFree front_tickFree_mono is_processT 
-                    is_process_Rep le_list_def nonTickFree_n_frontTickFree 
-                    trace_with_Tick_implies_tickFree_front)          
-      qed
-  qed
+  by (metis ND_F_dir2' append_single_T_imp_tickFree is_processT is_ub_thelub)
+  
 
 lemma limproc_Seq_F1: "chain Y \<Longrightarrow> \<F> (lim_proc (range Y) \<^bold>; S) = \<F> (lim_proc (range (\<lambda>i. Y i \<^bold>; S)))"
   apply(auto simp add:Process_eq_spec D_Seq F_Seq F_LUB D_LUB T_LUB chain_Seq1)
   proof (auto, goal_cases)
-    case (1 a b x)
+    case (1 a b x y)
     then show ?case
-      apply(erule_tac x=x in allE, elim disjE exE, auto simp add: is_processT7 is_processT8_S) 
-       apply(rename_tac t1 t2, erule_tac x=t1 in allE, erule_tac x=t1 in allE, erule_tac x=t1 in allE)
-       apply (metis D_T append_T_imp_tickFree chain_lemma is_processT le_approx2T not_Cons_self2)
-      by (metis D_T append_T_imp_tickFree chain_lemma is_processT le_approx2T not_Cons_self2)
+      apply (erule_tac x=x in allE, elim disjE exE, auto simp add: is_processT7 is_processT8_S) 
+      apply (erule_tac x=t1 in allE, erule_tac x=t2 in allE) 
+      by (metis ND_F_dir2' append_single_T_imp_tickFree is_processT is_ub_thelub)
   next
-    case (2 a b)
-    assume A1:"\<forall>t1 t2. a = t1 @ t2 \<longrightarrow> (\<exists>x. t1 @ [tick] \<notin> \<T> (Y x)) \<or> t2 \<notin> \<D> S"
-      and  A2:"\<forall>t1. tickFree t1 \<longrightarrow> (\<forall>t2. a = t1 @ t2 \<longrightarrow> (\<exists>x. t1 \<notin> \<D> (Y x)) \<or> \<not> front_tickFree t2)"
+    case (2 a b x)
+    assume A1:"a \<notin> \<D> (Y x)"
       and  A3:"\<forall>t1 t2. a = t1 @ t2 \<longrightarrow> (\<exists>x. t1 @ [tick] \<notin> \<T> (Y x)) \<or> (t2, b) \<notin> \<F> S"
-      and  B: "\<forall>x. (a, insert tick b) \<in> \<F> (Y x) \<and> tickFree a \<or>
-               (\<exists>t1 t2. a = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> (Y x) \<and> (t2, b) \<in> \<F> S) \<or>
-               (\<exists>t1 t2. a = t1 @ t2 \<and> t1 \<in> \<D> (Y x) \<and> tickFree t1 \<and> front_tickFree t2) \<or>
-               (\<exists>t1 t2. a = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> (Y x) \<and> t2 \<in> \<D> S)"
+      and  B: "\<forall>x. (a, insert tick b) \<in> \<F> (Y x) \<and> tickFree a \<or> 
+                   (\<exists>t1 t2. a = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> (Y x) \<and> (t2, b) \<in> \<F> S) \<or>
+                   a \<in> \<D> (Y x)"
       and  C:"chain Y" 
     have E:"\<not> tickFree a \<Longrightarrow> False"
       proof -
         assume F:"\<not> tickFree a"
         from A obtain f 
           where D:"f = (\<lambda>t2. {n. \<exists>t1. a = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> (Y n) \<and> (t2, b) \<in> \<F> S}
                            \<union> {n. \<exists>t1. a = t1 @ t2 \<and> t1 \<in> \<D> (Y n) \<and> tickFree t1 \<and> front_tickFree t2})"
           by simp
         with B F have "\<forall>n. n \<in> (\<Union>x\<in>{t. \<exists>t1. a = t1 @ t}. f x)"  
-                      (is "\<forall>n. n \<in> ?S f") using NF_ND by fastforce
+                      (is "\<forall>n. n \<in> ?S f") using NF_ND
+          by (smt (verit, best) A1 A3 C ND_F_dir2' append_single_T_imp_tickFree is_processT is_ub_thelub) 
         hence "infinite (?S f)" by (simp add: Sup_set_def)
         then obtain t2 where E:"t2\<in>{t. \<exists>t1. a = t1 @ t} \<and> infinite (f t2)" using suffixes_fin by blast
         { assume E1:"infinite{n. \<exists>t1. a = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> (Y n) \<and> (t2, b) \<in> \<F> S}" 
                      (is "infinite ?E1")
           with E obtain t1 where F:"a = t1 @ t2 \<and> (t2, b) \<in> \<F> S" using D not_finite_existsD by blast
           with A3 obtain m where G:"t1@ [tick] \<notin> \<T> (Y m)" by blast
           with E1 obtain n where "n \<ge> m \<and> n \<in> ?E1" by (meson finite_nat_set_iff_bounded_le nat_le_linear)
           with D have "n \<ge> m \<and> t1@ [tick] \<in> \<T> (Y n)" by (simp add: F)
           with G C have False using le_approx_lemma_T chain_mono by blast
         } note E1 = this
         { assume E2:"infinite{n. \<exists>t1. a = t1 @ t2 \<and> t1 \<in> \<D> (Y n) \<and> tickFree t1 \<and> front_tickFree t2}" 
                     (is "infinite ?E2")
           with E obtain t1 where F:"a = t1 @ t2 \<and> tickFree t1 \<and> front_tickFree t2" 
             using D not_finite_existsD by blast
-          with A2 obtain m where G:"t1 \<notin> \<D> (Y m)" by blast
+          with A1 obtain m where G:"t1 \<notin> \<D> (Y m)" using is_processT7_S by blast
           with E2 obtain n where "n \<ge> m \<and> n \<in> ?E2" by (meson finite_nat_set_iff_bounded_le nat_le_linear)
           with D have "n \<ge> m \<and> t1 \<in> \<D> (Y n)" by (simp add: F)
           with G C have False using le_approx1 chain_mono by blast
         } note E2 = this      
         from D E E1 E2 show False by blast
       qed
     from E show "tickFree a" by blast
   qed
 
 lemma cont_left_D_Seq : "chain Y \<Longrightarrow> ((\<Squnion> i. Y i) \<^bold>; S) = (\<Squnion> i. (Y i \<^bold>; S))"
   by (simp add: Process_eq_spec chain_Seq1 limproc_Seq_D1 limproc_Seq_F1 limproc_is_thelub)
 
 lemma limproc_Seq_D2: "chain Y \<Longrightarrow> \<D> (S \<^bold>; lim_proc (range Y)) = \<D> (lim_proc (range (\<lambda>i. S \<^bold>; Y i )))"
   apply(auto simp add:Process_eq_spec D_Seq F_Seq F_LUB D_LUB T_LUB chain_Seq2)
-  apply(blast)
-  proof -
-    fix x
-    assume A:"\<forall>t1. t1 @ [tick] \<in> \<T> S \<longrightarrow> (\<forall>t2. x = t1 @ t2 \<longrightarrow> (\<exists>x. t2 \<notin> \<D> (Y x)))"
-    and B: "\<forall>n. \<exists>t1 t2. x = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> S \<and> t2 \<in> \<D> (Y n)"
-    and C: "chain Y"
-    from A obtain f where D:"f = (\<lambda>t2. {n. \<exists>t1. x = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> S \<and> t2 \<in> \<D> (Y n)})"
-      by simp
-    with B have "\<forall>n. n \<in> (\<Union>x\<in>{t. \<exists>t1. x = t1 @ t}. f x)" (is "\<forall>n. n \<in> ?S f") by fastforce
-    hence "infinite (?S f)" by (simp add: Sup_set_def)
-    then obtain t2 where E:"t2\<in>{t. \<exists>t1. x = t1 @ t} \<and> infinite (f t2)" using suffixes_fin by blast
-    then obtain t1 where F:"x = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> S" using D not_finite_existsD by blast
-    from A F obtain m where G:"t2 \<notin> \<D> (Y m)" by blast
+proof -
+  fix x
+  assume B: "\<forall>n. \<exists>t1 t2. x = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> S \<and> t2 \<in> \<D> (Y n)"
+  and C: "chain Y"
+  from A obtain f where D:"f = (\<lambda>t2. {n. \<exists>t1. x = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> S \<and> t2 \<in> \<D> (Y n)})"
+    by simp
+  with B have "\<forall>n. n \<in> (\<Union>x\<in>{t. \<exists>t1. x = t1 @ t}. f x)" (is "\<forall>n. n \<in> ?S f") by fastforce
+  hence "infinite (?S f)" by (simp add: Sup_set_def)
+  then obtain t2 where E:"t2\<in>{t. \<exists>t1. x = t1 @ t} \<and> infinite (f t2)" using suffixes_fin by blast
+  then obtain t1 where F:"x = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> S" using D not_finite_existsD by blast
+  thus "\<exists>t1 t2. x = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> S \<and> (\<forall>x. t2 \<in> \<D> (Y x))" 
+    apply (rule_tac x = t1 in exI, rule_tac x = t2 in exI)
+  proof (rule ccontr, simp)
+    assume \<open>\<exists>m. t2 \<notin> \<D> (Y m)\<close>
+    then obtain m where G: \<open>t2 \<notin> \<D> (Y m)\<close> ..
     with E obtain n where "n \<ge> m \<and> n \<in> (f t2)" by (meson finite_nat_set_iff_bounded_le nat_le_linear)
-    with D have "n \<ge> m \<and> t2 \<in> \<D> (Y n)" by blast
-    with G C have False using le_approx1 po_class.chain_mono by blast
-    thus "\<exists>t1 t2. x = t1 @ t2 \<and> t1 \<in> \<D> S \<and> tickFree t1 \<and> front_tickFree t2" ..       
+    with D have "n \<ge> m \<and> t2 \<in> \<D> (Y n)" by blast 
+    with G C show False using le_approx1 po_class.chain_mono by blast
   qed
+qed
+
+      
 
 lemma limproc_Seq_F2: 
   "chain Y \<Longrightarrow> \<F> (S \<^bold>; lim_proc (range Y)) = \<F> (lim_proc (range (\<lambda>i. S \<^bold>; Y i )))"
   apply(auto simp:Process_eq_spec D_Seq F_Seq T_Seq F_LUB D_LUB D_LUB_2 T_LUB T_LUB_2 chain_Seq2 del:conjI)
-    apply(auto)[1]
-   apply(auto)[1]
-  proof-
-    fix x X
-    assume A:"\<forall>t1. t1 @ [tick] \<in> \<T> S \<longrightarrow> (\<forall>t2. x = t1 @ t2 \<longrightarrow> (\<exists>m. (t2, X) \<notin> \<F> (Y m)))"
-    and B: "\<forall>n. (\<exists>t1 t2. x = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> S \<and> (t2, X) \<in> \<F> (Y n)) \<or>
-                (\<exists>t1 t2. x = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> S \<and> t2 \<in> \<D> (Y n))"
-    and C: "chain Y"
-    hence D:"\<forall>n. (\<exists>t1 t2. x = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> S \<and> (t2, X) \<in> \<F> (Y n))" by (meson NF_ND)
-    from A obtain f where D:"f = (\<lambda>t2. {n. \<exists>t1. x = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> S \<and> (t2, X) \<in> \<F> (Y n)})"
-      by simp
-    with D have "\<forall>n. n \<in> (\<Union>x\<in>{t. \<exists>t1. x = t1 @ t}. f x)" using B NF_ND by fastforce
-    hence "infinite (\<Union>x\<in>{t. \<exists>t1. x = t1 @ t}. f x)" by (simp add: Sup_set_def)
-    then obtain t2 where E:"t2\<in>{t. \<exists>t1. x = t1 @ t} \<and> infinite (f t2)" using suffixes_fin by blast
-    then obtain t1 where F:"x = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> S" using D not_finite_existsD by blast
-    from A F obtain m where G:"(t2, X) \<notin> \<F> (Y m)" by blast
-    with E obtain n where "n \<ge> m \<and> n \<in> (f t2)" by (meson finite_nat_set_iff_bounded_le nat_le_linear)
-    with D have "n \<ge> m \<and> (t2, X) \<in> \<F> (Y n)" by blast
-    with G C have False using is_processT8 po_class.chain_mono proc_ord2a by blast
-    thus "(x, insert tick X) \<in> \<F> S \<and> tickFree x" ..
-  qed
+     apply(auto)[3]
+proof (goal_cases)
+  fix s X
+  assume A:"\<forall>t1. t1 @ [tick] \<in> \<T> S \<longrightarrow> (\<forall>t2. s = t1 @ t2 \<longrightarrow> (\<exists>m. (t2, X) \<notin> \<F> (Y m)))"
+  and B: "\<forall>n. \<exists>t1 t2. s = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> S \<and> (t2, X) \<in> \<F> (Y n)"
+  and C: "chain Y"
+  from B have D:"\<forall>n. (\<exists>t1 t2. s = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> S \<and> (t2, X) \<in> \<F> (Y n))" by (meson NF_ND)
+  from A obtain f where D:"f = (\<lambda>t2. {n. \<exists>t1. s = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> S \<and> (t2, X) \<in> \<F> (Y n)})"
+    by simp
+  with D have "\<forall>n. n \<in> (\<Union>x\<in>{t. \<exists>t1. s = t1 @ t}. f x)" using B NF_ND by fastforce
+  hence "infinite (\<Union>x\<in>{t. \<exists>t1. s = t1 @ t}. f x)" by (simp add: Sup_set_def)
+  then obtain t2 where E:"t2\<in>{t. \<exists>t1. s = t1 @ t} \<and> infinite (f t2)" using suffixes_fin by blast
+  then obtain t1 where F:"s = t1 @ t2 \<and> t1 @ [tick] \<in> \<T> S" using D not_finite_existsD by blast
+  from A F obtain m where G:"(t2, X) \<notin> \<F> (Y m)" by blast
+  with E obtain n where "n \<ge> m \<and> n \<in> (f t2)" by (meson finite_nat_set_iff_bounded_le nat_le_linear)
+  with D have "n \<ge> m \<and> (t2, X) \<in> \<F> (Y n)" by blast
+  with G C have False using is_processT8 po_class.chain_mono proc_ord2a by blast
+  thus \<open>(s, insert tick X) \<in> \<F> S \<and> tickFree s\<close> by simp
+qed
 
 lemma cont_right_D_Seq : "chain Y \<Longrightarrow> (S \<^bold>; (\<Squnion> i. Y i)) = (\<Squnion> i. (S \<^bold>; Y i))"
   by (simp add: Process_eq_spec chain_Seq2 limproc_Seq_D2 limproc_Seq_F2 limproc_is_thelub)
 
 lemma Seq_cont[simp]:
 assumes f:"cont f"
 and     g:"cont g"
 shows     "cont (\<lambda>x. f x \<^bold>; g x)"
 proof -
   have A : "\<And>x. cont g \<Longrightarrow> cont (\<lambda>y. y \<^bold>; g x)"
     apply (rule contI2, rule monofunI)
      apply (auto)
     by (simp add: cont_left_D_Seq)
   have B : "\<And>y. cont g \<Longrightarrow> cont (\<lambda>x. y \<^bold>; g x)"
     apply (rule_tac c="(\<lambda> x. y \<^bold>; x)" in cont_compose)
      apply (rule contI2,rule monofunI)
     by (auto simp add: chain_Seq2 cont_right_D_Seq)
   show ?thesis using f g 
     apply(rule_tac f="(\<lambda>x. (\<lambda> f. f \<^bold>; g x))" in cont_apply)
       by(auto intro:contI2 monofunI simp:A B)
 qed
 
 end
 
diff --git a/thys/HOL-CSP/Skip.thy b/thys/HOL-CSP/Skip.thy
--- a/thys/HOL-CSP/Skip.thy
+++ b/thys/HOL-CSP/Skip.thy
@@ -1,80 +1,68 @@
 (*<*)
 \<comment>\<open> ******************************************************************** 
  * Project         : HOL-CSP - A Shallow Embedding of CSP in  Isabelle/HOL
  * Version         : 2.0
  *
- * Author          : Burkhart Wolff, Safouan Taha, Lina Ye.
+ * Author          : Burkhart Wolff.
  *                   (Based on HOL-CSP 1.0 by Haykal Tej and Burkhart Wolff)
  *
  * This file       : A Combined CSP Theory
  *
  * Copyright (c) 2009 Université Paris-Sud, France
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials provided
  *       with the distribution.
  *
  *     * Neither the name of the copyright holders nor the names of its
  *       contributors may be used to endorse or promote products derived
  *       from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  ******************************************************************************\<close>
 (*>*)
 
 section\<open>The SKIP Process\<close>
 
-theory Skip 
+theory Skip
 imports Process
 begin
 
-definition SKIP :: "'a process"
-where     "SKIP \<equiv> Abs_process ({(s, X). s = [] \<and> tick \<notin> X} \<union> {(s, X). s = [tick]}, {})"
-
-lemma is_process_REP_SKIP:
-" is_process ({(s, X). s = [] \<and> tick \<notin> X} \<union> {(s, X). s = [tick]}, {})"
-apply(auto simp: FAILURES_def DIVERGENCES_def front_tickFree_def is_process_def)
-apply(erule contrapos_np,drule neq_Nil_conv[THEN iffD1], auto)
-done
-
-lemma is_process_REP_SKIP2:
-"is_process ({[]} \<times> {X. tick \<notin> X} \<union> {(s, X). s = [tick]}, {})"
-using is_process_REP_SKIP by auto
+lift_definition SKIP :: \<open>'\<alpha> process\<close>
+  is \<open>({(s, X). s = [] \<and> tick \<notin> X} \<union> {(s, X). s = [tick]}, {})\<close>
+  unfolding is_process_def FAILURES_def DIVERGENCES_def
+  by (auto simp add: append_eq_Cons_conv)
 
 
-lemmas process_prover = Rep_process Abs_process_inverse 
-	                       FAILURES_def TRACES_def 
-	                       DIVERGENCES_def is_process_REP_SKIP
-
 lemma F_SKIP:
-"\<F> SKIP = {(s, X). s = [] \<and> tick \<notin> X} \<union> {(s, X). s = [tick]}"
-by(simp add:  process_prover SKIP_def Failures_def is_process_REP_SKIP2)
+  "\<F> SKIP = {(s, X). s = [] \<and> tick \<notin> X} \<union> {(s, X). s = [tick]}"
+  by (simp add: FAILURES_def Failures.rep_eq SKIP.rep_eq)
 
 lemma D_SKIP: "\<D> SKIP = {}"
-by(simp add:  process_prover SKIP_def D_def is_process_REP_SKIP2)
+  by (simp add: DIVERGENCES_def Divergences.rep_eq SKIP.rep_eq)
 
-lemma T_SKIP: "\<T> SKIP ={[],[tick]}"
-by(auto simp:  process_prover SKIP_def Traces_def is_process_REP_SKIP2)
+lemma T_SKIP: "\<T> SKIP ={[], [tick]}"
+  by (auto simp add: Traces.rep_eq TRACES_def Failures.rep_eq[symmetric] F_SKIP)
 
 
 end
diff --git a/thys/HOL-CSP/Stop.thy b/thys/HOL-CSP/Stop.thy
--- a/thys/HOL-CSP/Stop.thy
+++ b/thys/HOL-CSP/Stop.thy
@@ -1,71 +1,78 @@
 (*<*)
 \<comment>\<open> ******************************************************************** 
  * Project         : HOL-CSP - A Shallow Embedding of CSP in  Isabelle/HOL
  * Version         : 2.0
  *
- * Author          : Burkhart Wolff, Safouan Taha, Lina Ye.
+ * Author          : Burkhart Wolff.
  *                   (Based on HOL-CSP 1.0 by Haykal Tej and Burkhart Wolff)
  *
  * This file       : A Combined CSP Theory
  *
  * Copyright (c) 2009 Université Paris-Sud, France
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials provided
  *       with the distribution.
  *
  *     * Neither the name of the copyright holders nor the names of its
  *       contributors may be used to endorse or promote products derived
  *       from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  ******************************************************************************\<close>
 (*>*)
 
 section\<open> The STOP Process \<close>
 
 theory     Stop
 imports    Process 
 begin 
 
-definition STOP :: "'\<alpha> process"  
-where     "STOP \<equiv> Abs_process ({(s, X). s = []}, {})"
+lift_definition STOP :: \<open>'\<alpha> process\<close>
+  is \<open>({(s, X). s = []}, {})\<close>
+  unfolding is_process_def FAILURES_def DIVERGENCES_def by simp
 
-lemma is_process_REP_STOP: "is_process ({(s, X). s = []},{})"
-by(simp add: is_process_def FAILURES_def DIVERGENCES_def)
-
-lemma Rep_Abs_STOP : "Rep_process (Abs_process ({(s, X). s = []},{})) = ({(s, X). s = []},{})"
-by(subst Abs_process_inverse, simp add: Rep_process is_process_REP_STOP, auto)
 
 lemma F_STOP : "\<F> STOP = {(s,X). s = []}"
-by(simp add: STOP_def FAILURES_def Failures_def Rep_Abs_STOP)
+  by (simp add: FAILURES_def Failures.rep_eq STOP.rep_eq)
 
 lemma D_STOP: "\<D> STOP = {}"
-by(simp add: STOP_def DIVERGENCES_def D_def Rep_Abs_STOP)
+  by (simp add: DIVERGENCES_def Divergences.rep_eq STOP.rep_eq)
 
 lemma T_STOP: "\<T> STOP = {[]}"
-by(simp add: STOP_def TRACES_def FAILURES_def Traces_def Rep_Abs_STOP)
+  by (simp add: Traces.rep_eq TRACES_def Failures.rep_eq[symmetric] F_STOP)
+
+
+lemma STOP_iff_T: \<open>P = STOP \<longleftrightarrow> \<T> P = {[]}\<close>
+  apply (intro iffI, simp add: T_STOP)
+  apply (subst Process_eq_spec, safe, simp_all add: F_STOP D_STOP)
+  by (use F_T in force, use is_processT5_S7 in fastforce)
+     (metis D_T append_Nil front_tickFree_single is_processT7_S
+            list.distinct(1) singletonD tickFree_Nil)
+
+
+
 
 
 end
 
diff --git a/thys/HOL-CSP/Sync.thy b/thys/HOL-CSP/Sync.thy
--- a/thys/HOL-CSP/Sync.thy
+++ b/thys/HOL-CSP/Sync.thy
@@ -1,1893 +1,1868 @@
 (*<*)
 \<comment>\<open> ******************************************************************** 
  * Project         : HOL-CSP - A Shallow Embedding of CSP in  Isabelle/HOL
  * Version         : 2.0
  *
  * Author          : Burkhart Wolff, Safouan Taha, Lina Ye.
  *                   (Based on HOL-CSP 1.0 by Haykal Tej and Burkhart Wolff)
  *
  * This file       : A Combined CSP Theory
  *
  * Copyright (c) 2009 Université Paris-Sud, France
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials provided
  *       with the distribution.
  *
  *     * Neither the name of the copyright holders nor the names of its
  *       contributors may be used to endorse or promote products derived
  *       from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  ******************************************************************************\<close>
 (*>*)
 
 section\<open> The Synchronizing Operator \<close>
 
 theory  Sync
   imports Process "HOL-Library.Infinite_Set"
 begin
 
 subsection\<open>Basic Concepts\<close>
 
 fun setinterleaving:: "'a trace \<times> ('a event) set \<times> 'a trace \<Rightarrow> ('a trace)set"
   where
 
   si_empty1: "setinterleaving([], X, []) = {[]}"
 | si_empty2: "setinterleaving([], X, (y # t)) = 
                (if (y \<in> X) 
                 then {} 
                 else {z.\<exists> u. z = (y # u) \<and> u \<in> setinterleaving ([], X, t)})"
 | si_empty3: "setinterleaving((x # s), X, []) = 
                (if (x \<in> X) 
                 then {} 
                 else {z.\<exists> u. z = (x # u) \<and> u \<in> setinterleaving (s, X, [])})"
  
 | si_neq   : "setinterleaving((x # s), X, (y # t)) = 
                (if (x \<in> X) 
                 then if (y \<in> X) 
                      then if (x = y) 
                           then {z.\<exists> u. z = (x#u) \<and> u \<in> setinterleaving(s, X, t)} 
                           else {}
                      else {z.\<exists> u. z = (y#u) \<and> u \<in> setinterleaving ((x#s), X, t)}
                 else if (y \<notin> X) 
                      then {z.\<exists> u. z = (x # u) \<and> u \<in> setinterleaving (s, X, (y # t))} 
                           \<union> {z.\<exists> u. z = (y # u) \<and> u \<in> setinterleaving((x # s), X, t)} 
                      else {z.\<exists> u. z = (x # u) \<and> u \<in> setinterleaving (s, X, (y # t))})"
 
 fun setinterleavingList::"'a trace \<times> ('a event) set \<times> 'a trace \<Rightarrow> ('a trace)list" 
   where
 
   si_empty1l: "setinterleavingList([], X, []) = [[]]"
 | si_empty2l: "setinterleavingList([], X, (y # t)) = 
                (if (y \<in> X) 
                 then [] 
                 else map (\<lambda>z. y#z) (setinterleavingList ([], X, t)))"
 | si_empty3l: "setinterleavingList((x # s), X, []) = 
                (if (x \<in> X) 
                 then [] 
                 else map (\<lambda>z. x#z) (setinterleavingList (s, X, [])))"
 
  
  
 | si_neql   : "setinterleavingList((x # s), X, (y # t)) = 
                (if (x \<in> X) 
                 then if (y \<in> X) 
                      then if (x = y) 
                           then map (\<lambda>z. x#z)  (setinterleavingList(s, X, t))
                           else []
                      else map (\<lambda>z. y#z)  (setinterleavingList ((x#s), X, t))
                 else if (y \<notin> X) 
                      then map (\<lambda>z. x#z)  (setinterleavingList (s, X, (y # t)))
                           @ map (\<lambda>z. y#z)  (setinterleavingList ((x#s), X, t)) 
                      else map (\<lambda>z. x#z)  (setinterleavingList (s, X, (y # t))))"
 
 lemma finiteSetinterleavingList: "finite (set (setinterleavingList(s, X, t)))" 
   by auto
 
 lemma sym : "setinterleaving(s, X, t)= setinterleaving(t, X, s)"
   by (rule setinterleaving.induct[of "\<lambda>(s,X,t). setinterleaving (s, X, t) 
   = setinterleaving (t, X, s)" "(s, X, t)", simplified], auto)
 
  
 
 abbreviation "setinterleaves_syntax"  ("_ setinterleaves '(()'(_, _')(), _')" [60,0,0,0]70)
   where      "u setinterleaves ((s, t), X) == (u \<in> setinterleaving(s, X, t))"
 
  
-subsection\<open>Definition\<close>
-
-definition Sync :: "['a process,'a set,'a process] => 'a process"    ("(3(_ \<lbrakk>_\<rbrakk>/ _))" [64,0,65] 64)  
-  where "P \<lbrakk> A \<rbrakk> Q \<equiv>  Abs_process({(s,R).\<exists> t u X Y. (t,X) \<in> \<F> P \<and> (u,Y) \<in> \<F> Q \<and> 
-                                                    (s setinterleaves ((t,u),(ev`A) \<union> {tick})) \<and> 
-                                                    R = (X \<union> Y) \<inter> ((ev`A) \<union> {tick}) \<union> X \<inter> Y}    \<union> 
-                                  {(s,R).\<exists> t u r v. front_tickFree v \<and> (tickFree r \<or> v=[]) \<and> 
-                                                    s = r@v \<and> 
-                                                    (r setinterleaves ((t,u),(ev`A) \<union> {tick})) \<and> 
-                                                    (t \<in> \<D> P \<and> u \<in> \<T> Q \<or> t \<in> \<D> Q \<and> u \<in> \<T> P)},
-                   
-                                  {s.   \<exists> t u r v. front_tickFree v \<and> (tickFree r \<or> v=[]) \<and> 
-                                                   s = r@v \<and> 
-                                                   (r setinterleaves ((t,u),(ev`A) \<union> {tick})) \<and> 
-                                                   (t \<in> \<D> P \<and> u \<in> \<T> Q \<or> t \<in> \<D> Q \<and> u \<in> \<T> P)})"
-
 subsection\<open>Consequences\<close>
 
 lemma emptyLeftProperty:"\<forall>s. s setinterleaves (([], t), A)\<longrightarrow>s=t" 
-  apply(induct_tac t)  
-   apply simp 
-  by auto 
+  by (induct t) auto
+ 
 
 lemma emptyLeftSelf: " (\<forall>t1. t1\<in> set t\<longrightarrow>t1\<notin>A)\<longrightarrow>t setinterleaves (([], t), A) "
-  apply(induct_tac t)
-   apply simp 
-  by auto
+  by (induct t) auto
 
-lemma emptyLeftNonSync: "\<forall>s. s setinterleaves (([], t), A)\<longrightarrow>(\<forall>t1. t1\<in> set t\<longrightarrow>t1\<notin>A)"
-  apply(induct_tac t)
-   apply simp
-proof-
-  fix a list
-  assume a: "\<forall>s. s setinterleaves (([], list), A) \<longrightarrow> (\<forall>t1. t1 \<in> set list \<longrightarrow> t1 \<notin> A)"
-  thus "\<forall>s. s setinterleaves (([], a # list), A) \<longrightarrow> (\<forall>t1. t1 \<in> set (a # list) \<longrightarrow> t1 \<notin> A)"
-  proof-
-    have th: "s setinterleaves (([], a # list), A)\<longrightarrow>a\<notin>A" by auto
-    obtain s1 where th1: "s setinterleaves (([], a # list), A)\<longrightarrow>s1 setinterleaves (([], list), A)"  
-      using mem_Collect_eq th by fastforce
-    from a th1 have th2: "\<forall>s. s setinterleaves (([], a # list), A)\<longrightarrow>(\<forall>t. t\<in> set list\<longrightarrow>t \<notin> A)" 
-      by auto
-    with a show ?thesis   
-      by (metis (no_types, lifting) empty_iff set_ConsD setinterleaving.simps(2))   
-  qed
+
+lemma emptyLeftNonSync: "s setinterleaves (([], t), A) \<Longrightarrow> \<forall>a. a \<in> set t \<longrightarrow> a \<notin> A"
+proof (induct t arbitrary: s)
+  case Nil
+  show ?case by simp
+next
+  case (Cons a t)
+  thus ?case by (cases s; simp split: if_split_asm)
 qed
  
 
 lemma ftf_Sync1: "a \<notin> set(u) \<and> a \<notin> set(t) \<and> s setinterleaves ((t, u), A) \<longrightarrow> a \<notin> set(s)"
 proof (induction "length t + length u" arbitrary:s t u rule:nat_less_induct)
   case 1
   show ?case 
     apply(cases t) using sym emptyLeftProperty apply blast
     apply(cases u) using sym emptyLeftProperty apply blast
     apply(simp split:if_splits, intro conjI impI, elim conjE disjE exE)
          apply (metis "1.hyps" add_less_le_mono length_Cons lessI order_refl set_ConsD)
         apply (metis "1.hyps" add_Suc_right length_Cons lessI set_ConsD) 
        apply (metis "1.hyps" add_less_mono length_Cons lessI set_ConsD) 
       apply (metis "1.hyps" add_Suc_right length_Cons lessI set_ConsD) 
      apply (metis (no_types, opaque_lifting) "1.hyps" add.commute add_Suc_right insert_iff 
                                          length_Cons lessI list.simps(15)) 
     by (metis "1.hyps" add_less_le_mono length_Cons lessI order_refl set_ConsD)
 qed
 
 lemma addNonSyncEmpty: "sa setinterleaves (([], u), A) \<and> y1 \<notin> A \<longrightarrow>
     (sa @ [y1]) setinterleaves (([y1], u), A) \<and> (sa @ [y1]) setinterleaves (([], u @ [y1]), A)"
   proof (induction "length u" arbitrary:sa u rule:nat_less_induct)
     case 1
     then show ?case 
       apply(cases u) 
        apply simp 
     proof-
       fix a list
       assume a: "\<forall>m<length u. \<forall>x. m = length x \<longrightarrow>(\<forall>xa. xa setinterleaves (([], x), A) \<and> y1 \<notin> A \<longrightarrow>
        (xa @ [y1]) setinterleaves (([y1], x), A) \<and> (xa @ [y1]) setinterleaves (([], x @ [y1]), A))"
       and b: "u = a # list"
       from b have th: "sa setinterleaves (([], u), A)\<Longrightarrow>(tl sa) setinterleaves (([], list), A)"  
         by (metis emptyLeftNonSync emptyLeftProperty emptyLeftSelf list.distinct(1) list.sel(3) 
         list.set_sel(2))
       from a b th have th1: "sa setinterleaves (([], u), A) \<and> y1 \<notin> A\<longrightarrow> ((tl sa) @ [y1]) 
       setinterleaves (([y1], list), A)\<and>((tl sa)@[y1]) setinterleaves (([], list@[y1]), A)" by auto
       thus "sa setinterleaves (([], u), A) \<and> y1 \<notin> A \<longrightarrow>
         (sa @ [y1]) setinterleaves (([y1], u), A) \<and> (sa @ [y1]) setinterleaves (([], u @ [y1]), A)"
         using  b th by auto  
     qed
   qed
 
 lemma addNonSync: "sa setinterleaves ((t,u),A)\<and> y1 \<notin> A\<longrightarrow>
 (sa@[y1]) setinterleaves ((t@[y1],u),A)\<and>(sa@[y1]) setinterleaves ((t,u@[y1]),A)"
 proof (induction "length t + length u" arbitrary:sa t u rule:nat_less_induct)
   case 1
   then show ?case  
     apply(cases t)   
      apply (simp add: addNonSyncEmpty) 
     apply (cases u) 
      apply (metis Sync.sym addNonSyncEmpty append_self_conv2) 
   proof-
     fix a list aa lista
     assume a: "\<forall>m<length t + length u. \<forall>x xa. m = length x + length xa \<longrightarrow>
     (\<forall>xb. xb setinterleaves ((x, xa), A) \<and> y1 \<notin> A \<longrightarrow>(xb @ [y1]) setinterleaves ((x @ [y1], xa), A) 
     \<and> (xb @ [y1]) setinterleaves ((x, xa @ [y1]), A))"
     and b: " t = a # list" 
     and c: "u = aa # lista"
     thus " sa setinterleaves ((t, u), A) \<and> y1 \<notin> A \<longrightarrow>
      (sa @ [y1]) setinterleaves ((t @ [y1], u), A) \<and> (sa @ [y1]) setinterleaves ((t, u @ [y1]), A)"
      proof-
        from b c have th0pre: "a=aa\<and>aa\<in> A\<Longrightarrow>sa setinterleaves ((t, u), A) \<Longrightarrow>
                               (tl sa) setinterleaves ((list,lista), A)" by auto
        from th0pre a b c have th0pre1: "a=aa\<and>aa\<in> A\<Longrightarrow>sa setinterleaves ((t, u), A)\<and> y1 \<notin> A\<Longrightarrow>
        ((tl sa) @ [y1]) setinterleaves ((list@ [y1], lista), A)\<and>
        ((tl sa) @ [y1]) setinterleaves ((list, lista@ [y1]), A)"  
         by (metis add_less_mono length_Cons lessI)  
       from  th0pre th0pre1 b c have th0: "a=aa\<and>aa\<in> A\<Longrightarrow>sa setinterleaves ((t, u), A) \<and> y1 \<notin> A \<longrightarrow>
       (sa @ [y1]) setinterleaves ((t @ [y1], u), A)\<and>(sa @ [y1]) setinterleaves ((t, u @ [y1]), A)"  
         by auto 
       from b c have th1pre: "a\<notin>A\<and>aa\<in> A\<Longrightarrow>sa setinterleaves ((t, u), A) \<Longrightarrow>
                              (tl sa) setinterleaves ((list,aa#lista), A)" by auto
       from th1pre a b c have th1pre1: "a\<notin>A\<and>aa\<in> A\<Longrightarrow>sa setinterleaves ((t, u), A)\<and> y1 \<notin> A\<Longrightarrow>
       ((tl sa) @ [y1]) setinterleaves ((list@ [y1], aa#lista), A)\<and>
       ((tl sa) @ [y1]) setinterleaves ((list, aa#lista@ [y1]), A)"  
         by (metis add_Suc append_Cons length_Cons lessI) 
       from  th1pre th1pre1 b c  have th1: "a\<notin>A\<and>aa\<in> A\<Longrightarrow>sa setinterleaves ((t, u), A) \<and> y1 \<notin> A \<longrightarrow>  
       (sa @ [y1]) setinterleaves ((t @ [y1], u), A)\<and>(sa @ [y1]) setinterleaves ((t, u @ [y1]), A)" 
         by auto  
       from b c have th2pre: "aa\<notin>A\<and>a\<in> A\<Longrightarrow>sa setinterleaves ((t, u), A) \<Longrightarrow>
                              (tl sa) setinterleaves ((a#list,lista), A)" by auto
       from th2pre a b c have th2pre1: "aa\<notin>A\<and>a\<in> A\<Longrightarrow>sa setinterleaves ((t, u), A)\<and> y1 \<notin> A\<Longrightarrow>
       ((tl sa) @ [y1]) setinterleaves ((a#list@ [y1], lista), A)\<and>
       ((tl sa) @ [y1]) setinterleaves ((a#list, lista@ [y1]), A)"  
         by (metis add_Suc_right append_Cons length_Cons lessI)  
       from  th2pre th2pre1 b c have th2: "aa\<notin>A\<and>a\<in> A\<Longrightarrow>sa setinterleaves ((t, u), A) \<and> y1 \<notin> A \<longrightarrow> 
       (sa @ [y1]) setinterleaves ((t @ [y1], u), A)\<and>(sa @ [y1]) setinterleaves ((t, u @ [y1]), A)" 
         by auto
       from b c have th3pre: "aa\<notin>A\<and>a\<notin> A\<Longrightarrow>sa setinterleaves ((t, u), A)\<Longrightarrow>
      (tl sa) setinterleaves ((a#list,lista), A)\<or>(tl sa)setinterleaves ((list,aa#lista), A)" by auto
       from th3pre a b c have th3pre1: "aa\<notin>A\<and>a\<notin> A\<Longrightarrow>sa setinterleaves ((t, u), A)\<and>
       (tl sa) setinterleaves ((a#list,lista), A)\<and> y1 \<notin> A \<Longrightarrow>
       ((tl sa) @ [y1]) setinterleaves ((a#list@ [y1], lista ), A)\<and>((tl sa) @ [y1]) setinterleaves 
       ((a#list, lista@ [y1] ), A)" 
         by (metis add_Suc_right append_Cons length_Cons lessI)  
       from th3pre a b c have th3pre2: "aa\<notin>A\<and>a\<notin> A\<Longrightarrow>sa setinterleaves ((t, u), A)\<and>
       (tl sa) setinterleaves ((list,aa#lista), A)\<and> y1 \<notin> A \<Longrightarrow>((tl sa) @ [y1]) setinterleaves 
       ((list@ [y1], aa#lista ), A)\<and>((tl sa) @ [y1]) setinterleaves ((list, aa#lista @ [y1]), A)"  
         by (metis add_Suc append_Cons length_Cons lessI)         
       from th3pre th3pre1 th3pre2 a b c have th3: "aa\<notin>A\<and>a\<notin> A\<Longrightarrow>sa setinterleaves ((t, u), A) \<and> 
       y1 \<notin> A \<longrightarrow>(sa @ [y1]) setinterleaves ((t @ [y1], u), A) \<and> 
       (sa @ [y1]) setinterleaves ((t, u @ [y1]), A)" by auto 
       show ?thesis  
         using b c th0 th1 th2 th3 by auto
     qed
   qed
 qed
 
 lemma addSyncEmpty: "sa setinterleaves (([], u), A) \<and> y1 \<in> A \<longrightarrow> 
                     (sa @ [y1]) setinterleaves (([y1], u @ [y1]), A)"
   proof (induction "length u" arbitrary:sa u rule:nat_less_induct)
     case 1
     then show ?case 
       apply(cases u) 
        apply simp 
     proof-
       fix a list
       assume a: "\<forall>m<length u. \<forall>x. m = length x \<longrightarrow>(\<forall>xa. xa setinterleaves (([], x), A) \<and> y1 \<in> A 
                  \<longrightarrow> (xa @ [y1]) setinterleaves (([y1], x @ [y1]), A))"
       and b: "u = a # list"  
       from b have th: "sa setinterleaves (([], u), A)\<Longrightarrow>(tl sa) setinterleaves (([], list), A)"  
         by (metis emptyLeftNonSync emptyLeftProperty emptyLeftSelf list.distinct(1) list.sel(3) 
            list.set_sel(2))
       from a th have th1: "sa setinterleaves (([], u), A) \<and> y1 \<in> A\<Longrightarrow> 
       ((tl sa) @ [y1]) setinterleaves (([y1], list @ [y1]), A)" using b by auto
       thus "sa setinterleaves (([], u), A) \<and> y1 \<in> A \<longrightarrow> 
            (sa @ [y1]) setinterleaves (([y1], u @ [y1]), A)" using b th by auto  
     qed
   qed 
  
 lemma addSync: "sa setinterleaves ((t,u),A)\<and> y1 \<in> A\<longrightarrow>(sa@[y1]) setinterleaves ((t@[y1],u@[y1]),A)"
+  find_theorems \<open>(@)\<close> name: cases
 proof (induction "length t + length u" arbitrary:sa t u rule:nat_less_induct)
   case 1
   then show ?case 
     apply(cases t) 
      apply (simp add: addSyncEmpty)
     apply(cases u) 
      apply (metis Sync.sym addSyncEmpty append.left_neutral) 
   proof-
     fix a list aa lista
     assume a: "\<forall>m<length t + length u. \<forall>x xa. m = length x + length xa \<longrightarrow>
                  (\<forall>xb. xb setinterleaves ((x, xa), A) \<and> y1 \<in> A \<longrightarrow> (xb @ [y1]) setinterleaves 
                  ((x @ [y1], xa @ [y1]), A))"
     and b: "t = a # list "
     and c: " u = aa # lista"
     thus "sa setinterleaves((t, u),A)\<and>y1 \<in>A\<longrightarrow>(sa @ [y1]) setinterleaves ((t @ [y1], u @ [y1]), A)"
     proof-
       from b c have th0pre: "a=aa\<and>aa\<in> A\<Longrightarrow>sa setinterleaves ((t, u), A) \<Longrightarrow>
       (tl sa) setinterleaves ((list,lista), A)" by auto
       from th0pre a b c have th0pre1: "a=aa\<and>aa\<in> A\<Longrightarrow>sa setinterleaves ((t, u), A)\<and> y1 \<in> A\<Longrightarrow>
       ((tl sa) @ [y1]) setinterleaves ((list@ [y1], lista @ [y1]), A)"  
         by (metis add_less_mono length_Cons lessI)  
       from  th0pre th0pre1 b c have th0: "a=aa\<and>a\<in>A\<Longrightarrow>sa setinterleaves ((t, u), A) \<and> y1 \<in> A \<longrightarrow> 
       (sa @ [y1]) setinterleaves ((t @ [y1], u @ [y1]), A)" by auto 
       from b c have th1pre: "a\<notin>A\<and>aa\<in> A\<Longrightarrow>sa setinterleaves ((t, u), A) \<Longrightarrow>
       (tl sa) setinterleaves ((list,aa#lista), A)" by auto
       from th1pre a b c have th1pre1: "a\<notin>A\<and>aa\<in> A\<Longrightarrow>sa setinterleaves ((t, u), A)\<and> y1 \<in> A\<Longrightarrow>
       ((tl sa) @ [y1]) setinterleaves ((list@ [y1], aa#lista @ [y1]), A)"  
         by (metis add_Suc append_Cons length_Cons lessI) 
       from  th1pre th1pre1 b c  have th1: "a\<notin>A\<and>aa\<in> A\<Longrightarrow>sa setinterleaves ((t, u), A) \<and> y1 \<in> A \<longrightarrow> 
       (sa @ [y1]) setinterleaves ((t @ [y1], u @ [y1]), A)" by auto  
       from b c have th2pre: "aa\<notin>A\<and>a\<in> A\<Longrightarrow>sa setinterleaves ((t, u), A) \<Longrightarrow>
       (tl sa) setinterleaves ((a#list,lista), A)" by auto
       from th2pre a b c have th2pre1: "aa\<notin>A\<and>a\<in> A\<Longrightarrow>sa setinterleaves ((t, u), A)\<and> y1 \<in> A\<Longrightarrow>
       ((tl sa) @ [y1]) setinterleaves ((a#list@ [y1], lista @ [y1]), A)"  
         by (metis add_Suc_right append_Cons length_Cons lessI)  
       from  th2pre th2pre1 b c have th2: "aa\<notin>A\<and>a\<in> A\<Longrightarrow>sa setinterleaves ((t, u), A) \<and> y1 \<in> A \<longrightarrow> 
       (sa @ [y1]) setinterleaves ((t @ [y1], u @ [y1]), A)" by auto
       from b c have th3pre: "aa\<notin>A\<and>a\<notin> A\<Longrightarrow>sa setinterleaves ((t, u), A)\<Longrightarrow>
       (tl sa) setinterleaves((a#list,lista), A)\<or>(tl sa)setinterleaves ((list,aa#lista), A)" by auto
       from th3pre a b c have th3pre1: "aa\<notin>A\<and>a\<notin> A\<Longrightarrow>sa setinterleaves ((t, u), A)\<and>
       (tl sa) setinterleaves ((a#list,lista), A)\<and> y1 \<in> A \<Longrightarrow>
       ((tl sa) @ [y1]) setinterleaves ((a#list@ [y1], lista @ [y1]), A)" 
         by (metis add_Suc_right append_Cons length_Cons lessI)  
       from th3pre a b c have th3pre2: "aa\<notin>A\<and>a\<notin> A\<Longrightarrow>sa setinterleaves ((t, u), A)\<and>
       (tl sa) setinterleaves ((list,aa#lista), A)\<and> y1 \<in> A \<Longrightarrow>
       ((tl sa) @ [y1]) setinterleaves ((list@ [y1], aa#lista @ [y1]), A)" 
         by (metis add_Suc append_Cons length_Cons lessI)         
       from th3pre th3pre1 th3pre2 a b c have th3: "aa\<notin>A\<and>a\<notin> A\<Longrightarrow>sa setinterleaves ((t, u), A) \<and> 
       y1 \<in> A \<longrightarrow> (sa @ [y1]) setinterleaves ((t @ [y1], u @ [y1]), A)" by auto 
       show ?thesis  
         using b c th0 th1 th2 th3 by auto
     qed
   qed
 qed
  
 
 lemma doubleReverse: "s1 setinterleaves ((t, u), A)\<longrightarrow>(rev s1) setinterleaves ((rev t, rev u), A)"
 proof (induction "length t + length u" arbitrary:s1 t u rule:nat_less_induct)
   case 1
   then show ?case 
     apply(cases t)  
     using emptyLeftNonSync 
      apply (metis emptyLeftProperty emptyLeftSelf rev.simps(1) set_rev)  
     apply(cases u) 
     using sym 
      apply (metis (no_types, lifting) emptyLeftNonSync emptyLeftProperty emptyLeftSelf 
      rev.simps(1) set_rev) 
   proof-
     fix a list aa lista
     assume a: "\<forall>m<length t + length u. \<forall>x xa. m = length x + length xa \<longrightarrow>
                (\<forall>xb. xb setinterleaves ((x, xa), A) \<longrightarrow>rev xb setinterleaves ((rev x, rev xa), A))"
     and b: "t = a # list"
     and c: "u = aa # lista"
     thus "s1 setinterleaves ((t, u), A) \<longrightarrow>rev s1 setinterleaves ((rev t, rev u), A)"  
     proof-
       from b c have th0pre: "a=aa\<and>aa\<in> A\<Longrightarrow>s1 setinterleaves ((t, u), A)\<Longrightarrow>
       (tl s1) setinterleaves ((list,lista), A)" by auto
       from th0pre a b c have th0pre1: "a=aa\<and>aa\<in> A\<Longrightarrow>s1 setinterleaves ((t, u), A)\<Longrightarrow>
       ((rev (tl s1)) setinterleaves ((rev list, rev lista), A))"  
         by (metis add_less_mono length_Cons lessI)
       from  th0pre th0pre1 b c have th0: "a=aa\<and>aa\<in> A\<Longrightarrow>s1 setinterleaves ((t, u), A) \<longrightarrow>
       rev s1 setinterleaves ((rev t, rev u), A)"   using addSync by fastforce 
       from b c have th1pre: "a\<notin>A\<and>aa\<in> A\<Longrightarrow>s1 setinterleaves ((t, u), A)\<Longrightarrow>
       (tl s1) setinterleaves ((list,aa#lista), A)" by auto
       from th1pre a b c have th1pre1: "a\<notin>A\<and>aa\<in> A\<Longrightarrow>s1 setinterleaves ((t, u), A)\<Longrightarrow>
       ((rev (tl s1)) setinterleaves ((rev list, rev (aa#lista)), A))"  
         by (metis add_less_mono1 length_Cons lessI)          
       from  th1pre th1pre1 b c have th1: "a\<notin>A\<and>aa\<in> A\<Longrightarrow>s1 setinterleaves ((t, u), A) \<longrightarrow>
       rev s1 setinterleaves ((rev t, rev u), A)"  using addNonSync by fastforce  
       from b c have th2pre: "aa\<notin>A\<and>a\<in> A\<Longrightarrow>s1 setinterleaves ((t, u), A)\<Longrightarrow>
       (tl s1) setinterleaves ((a#list,lista), A)" by auto
       from th2pre a b c have th2pre1: "aa\<notin>A\<and>a\<in> A\<Longrightarrow>s1 setinterleaves ((t, u), A)\<Longrightarrow>
       ((rev (tl s1)) setinterleaves ((rev (a#list), rev lista), A))"  
         by (metis add_Suc_right length_Cons lessI)        
       from  th2pre th2pre1 b c have th2: "aa\<notin>A\<and>a\<in> A\<Longrightarrow>s1 setinterleaves ((t, u), A) \<longrightarrow>
       rev s1 setinterleaves ((rev t, rev u), A)"  
         using addNonSync by fastforce 
       from b c have th3pre: "aa\<notin>A\<and>a\<notin> A\<Longrightarrow>s1 setinterleaves ((t, u), A)\<Longrightarrow>
       (tl s1) setinterleaves ((a#list,lista),A)\<or>(tl s1) setinterleaves((list,aa#lista), A)" by auto
       from th3pre a b c have th3pre1: "aa\<notin>A\<and>a\<notin> A\<Longrightarrow>s1 setinterleaves ((t, u), A)\<and>
       (tl s1) setinterleaves ((a#list,lista), A) \<Longrightarrow>
       ((rev (tl s1)) setinterleaves ((rev (a#list), rev (lista)), A))"   
         by (metis add_Suc_right length_Cons lessI)
       from th3pre a b c have th3pre2: "aa\<notin>A\<and>a\<notin> A\<Longrightarrow>s1 setinterleaves ((t, u), A)\<and>
       (tl s1) setinterleaves ((list,aa#lista), A) \<Longrightarrow>
       ((rev (tl s1)) setinterleaves ((rev (list), rev (aa#lista)), A))"  
         by (metis add_less_mono1 length_Cons lessI)
       from  th3pre1 have th3pre31: "aa\<notin>A\<and>a\<notin> A\<Longrightarrow>s1 setinterleaves ((t, u), A)\<and>
       ((rev (tl s1)) setinterleaves ((rev (a#list), rev (lista)), A))\<longrightarrow>
       ((rev (tl s1))@[aa]) setinterleaves ((rev (a#list), (rev (lista))@[aa]), A)"
         by (simp add: addNonSync)
       from  th3pre2 have th3pre32: "aa\<notin>A\<and>a\<notin> A\<Longrightarrow>s1 setinterleaves ((t, u), A)\<and>
       ((rev (tl s1)) setinterleaves ((rev (list), rev (aa#lista)), A))\<longrightarrow>
       ((rev (tl s1))@[a]) setinterleaves (((rev (list)@[a]), (rev (aa#lista))), A)"
         by (simp add: addNonSync)
       from th3pre th3pre1 th3pre2 th3pre31 th3pre32 a b c have th3: "aa\<notin>A\<and>a\<notin> A\<Longrightarrow>
       s1 setinterleaves ((t, u), A) \<longrightarrow>rev s1 setinterleaves ((rev t, rev u), A)" by force
       show?thesis  
         using b c th0 th1 th2 th3 by auto
     qed 
   qed
 qed
  
  
 lemma  ftf_Sync21: "(a\<in>set(u)\<and>a\<notin>set(t)\<or>a\<in>set(t)\<and>a\<notin>set(u))\<and>a\<in>A\<longrightarrow>setinterleaving(u, A ,t)= {}"
 proof (induction "length t + length u" arbitrary: t u rule:nat_less_induct)
   case 1
   then show ?case 
     apply(cases t)  
     using Sync.sym emptyLeftNonSync apply fastforce 
     apply(cases u)  
      apply auto[1]
     apply(simp split:if_splits, intro conjI impI, elim conjE disjE exE)
              apply blast
             apply auto[1]  
            apply blast 
           apply auto[1]  
          apply auto[1]  
     using less_SucI apply blast  
        apply auto[1] 
       apply auto[1]  
     using list.simps(15) apply auto[1] 
     by auto 
 qed
 
 lemma ftf_Sync32: "u=u1@[tick]\<and>t=t1@[tick]\<and>s setinterleaves ((t, u), insert tick (ev ` A))\<Longrightarrow>
                   \<exists>s1. s1 setinterleaves ((t1, u1), insert tick (ev ` A))\<and> (s=s1@[tick])"
 proof-
   assume h: "u=u1@[tick]\<and>t=t1@[tick]\<and>s setinterleaves ((t, u), insert tick (ev ` A))"
   thus "\<exists>s1. s1 setinterleaves ((t1, u1), insert tick (ev ` A))\<and> (s=s1@[tick])"
   proof-
     from h have a:"rev u=tick#rev u1" by auto
     from h have b:"rev t=tick#rev t1" by auto
     from h have ab: "(rev s)  setinterleaves ((tick#rev t1, tick#rev u1), insert tick (ev ` A))" 
       using doubleReverse by fastforce
     from h obtain ss where c: "ss  setinterleaves  ((rev t1, rev u1), insert tick (ev ` A))\<and> 
     ss=tl(rev s)" using ab by auto 
     from c have d: "(rev ss)  setinterleaves  (( t1,  u1), insert tick (ev ` A))" 
       using doubleReverse by fastforce
     from d have e: "rev s=tick#ss"  
       using ab append_Cons_eq_iff c by auto
     show ?thesis  
       using d e by blast
   qed
 qed
 
 
 lemma SyncWithTick_imp_NTF: 
   "(s @ [tick]) setinterleaves ((t, u),insert tick (ev ` A)) 
    \<Longrightarrow> t\<in> \<T> P \<Longrightarrow> u \<in> \<T> Q
    \<Longrightarrow> \<exists>t1 u1. t=t1@[tick] \<and> u=u1@[tick]\<and> s setinterleaves ((t1, u1), insert tick (ev ` A))"  
 proof-
   assume h: "(s @ [tick]) setinterleaves ((t, u), insert tick (ev ` A))"
   and h1: "t\<in> \<T> P"
   and h2: "u\<in> \<T> Q"
   thus "\<exists>t1 u1. t=t1@[tick] \<and> u=u1@[tick]\<and> s setinterleaves ((t1, u1), insert tick (ev ` A))"
   proof-
     from h have a: "(tick#rev s) setinterleaves ((rev t, rev u), insert tick (ev ` A))" 
       using doubleReverse by fastforce
     from h obtain tt uu where b: "t=tt@[tick]\<and>u=uu@[tick]"  
       by (metis T_nonTickFree_imp_decomp empty_iff ftf_Sync1 ftf_Sync21 h1 h2 insertI1 
           non_tickFree_tick tickFree_append tickFree_def)
     from h b have d: "s setinterleaves ((tt, uu), insert tick (ev ` A))"  
       using ftf_Sync32 by blast
     show ?thesis  
       using b d by blast
   qed 
 qed
 
 lemma synPrefix1: 
    " ta = [] 
      \<Longrightarrow> \<exists>t1 u1. (s @ t) setinterleaves ((ta, u), A) \<longrightarrow>  
                  t1 \<le> ta \<and> u1 \<le> u \<and> s setinterleaves ((t1, u1), A)"
 proof-
   assume a: "ta = []"
   obtain u1 where th: "u1=s" by blast
   from a have th2: "(s @ t) setinterleaves ((ta, u), A) \<longrightarrow> (s @ t)= u"  
     by (simp add: a emptyLeftProperty)
   from a have th3: "(s @ t) setinterleaves ((ta, u), A) \<longrightarrow> (\<forall>t1. t1\<in>set u\<longrightarrow>t1\<notin>A)"  
     by (simp add: emptyLeftNonSync)
   from a th have th1: "(s @ t) setinterleaves ((ta, u), A) \<longrightarrow> [] \<le> ta \<and> u1 \<le> u " 
     using le_list_def th2 by blast 
   from a th have thh1: "(s @ t) setinterleaves ((ta, u), A)\<and> (\<forall>t1. t1\<in>set u1\<longrightarrow>t1\<notin>A) \<longrightarrow> 
   s setinterleaves (([], u1), A)"  by (simp add: emptyLeftSelf)
   thus "\<exists>t1 u1. (s @ t) setinterleaves ((ta, u), A) \<longrightarrow> t1 \<le> ta \<and> u1 \<le> u \<and> 
   s setinterleaves ((t1, u1), A)" using th th1 th2 th3 thh1 by fastforce 
 qed
  
 
 lemma synPrefix: "\<exists>t1 u1. (s @ t) setinterleaves ((ta, u), A)\<longrightarrow>
                   t1\<le>ta\<and>u1\<le>u\<and>s setinterleaves ((t1, u1), A)"
 proof (induction "length ta + length u" arbitrary: s t ta u rule:nat_less_induct)
   case 1
   then show ?case 
     apply(cases ta)  
      using synPrefix1 apply fastforce 
     apply(cases u) 
      using sym synPrefix1 apply metis 
    proof-
      fix a list aa lista s t
      assume a: " \<forall>m<length ta + length u. \<forall>x xa. m = length x + length xa \<longrightarrow>
                  (\<forall>xb xc. \<exists>t1 u1. (xb @ xc) setinterleaves ((x, xa), A) \<longrightarrow>
                  t1 \<le> x \<and> u1 \<le> xa \<and> xb setinterleaves ((t1, u1), A))"
      and b: "ta = a # list"
      and c: "u = aa # lista " 
      thus " \<exists>t1 u1. (s @ t) setinterleaves ((ta, u), A) \<longrightarrow> t1 \<le> ta \<and> u1 \<le> u \<and> 
             s setinterleaves ((t1, u1), A)" 
      proof-
        from a have th0: "\<forall>xb xc. \<exists>t1 u1. (xb @ xc) setinterleaves ((list, lista), A) \<longrightarrow>
                                   t1 \<le> list \<and> u1 \<le> lista \<and> xb setinterleaves ((t1, u1), A)"  
          by (metis add_less_le_mono b c impossible_Cons le_cases not_le_imp_less)
        from b c obtain yb where thp: "a=aa\<and>a\<in> A\<and>(s@t) setinterleaves ((ta, u), A)\<and>length s >1 \<Longrightarrow>
        yb=tl s" by blast
        with b c have thp4: "a=aa\<and>a\<in> A\<and>(s @ t) setinterleaves ((ta, u), A)\<and>length s >1 \<Longrightarrow>s=a#yb" 
          by (auto, metis Cons_eq_append_conv list.sel(3) list.size(3) not_less0)
        have thp5: "a=aa\<and>a\<in> A\<and>(s @ t) setinterleaves ((ta, u), A)\<and>length s >1 \<Longrightarrow>
        (yb @ t) setinterleaves ((list, lista), A)"  using b c thp4 by auto 
        from th0 obtain yt yu where thp1: "a = aa \<and> a \<in> A \<Longrightarrow> (s @ t) setinterleaves ((ta, u), A) \<and> 
        1 < length s\<Longrightarrow>yb setinterleaves ((yt, yu), A)\<and>yt\<le>list\<and>yu\<le>lista"  using thp5 by blast 
        from thp thp1 have thp2: "a=aa\<and>a\<in> A\<Longrightarrow> (s @ t) setinterleaves ((ta, u), A)\<and> length s >1\<longrightarrow> 
        s setinterleaves ((a#yt, aa#yu), A)" using thp4 by auto 
        from b c have thp3: "a=aa\<and>a\<in> A\<Longrightarrow> (s @ t) setinterleaves ((ta, u), A) \<and> length s=1\<longrightarrow>
        s setinterleaves (([a], [aa]), A)" 
          using append_eq_append_conv2[of s t "[aa]"] by (auto, metis append_Nil2 
          append_eq_append_conv length_Cons list.size(3))
        have thp6: "a=aa\<and>a\<in> A\<Longrightarrow> (s @ t) setinterleaves ((ta, u), A) \<and> length s=0\<longrightarrow>
        s setinterleaves (([], []), A)" by auto
        from thp1 have thp7: "a=aa\<and>a\<in> A\<Longrightarrow> (s @ t) setinterleaves ((ta, u), A)\<and> length s >1\<Longrightarrow>
        (a # yt)\<le>ta \<and>(aa # yu)\<le>u"  by (metis b c le_less less_cons)  
        have th: "a=aa\<and>a\<in> A\<Longrightarrow>\<exists>t1 u1. (s @ t) setinterleaves ((ta, u), A) \<longrightarrow> 
        t1 \<le> ta \<and> u1 \<le> u \<and> s setinterleaves ((t1, u1), A)"
        proof -
          assume dd:"a=aa \<and> a\<in> A"
          consider (aa) "length s = 0" | (bb) "length s = 1" | (cc) "length s > 1"
            by linarith
          then show ?thesis 
          proof cases 
            case aa
            with thp6 show ?thesis 
              by (rule_tac x="[]" in exI, rule_tac x="[]" in exI, simp) 
          next
            case bb
            with dd thp3 b c show ?thesis 
              by (rule_tac x="[a]" in exI, rule_tac x="[a]" in exI, auto simp add: le_list_def)            
          next
            case cc
            with dd thp2 thp7 b c show ?thesis
              by (rule_tac x="a#yt" in exI, rule_tac x="a#yu" in exI, auto simp add: le_list_def)   
         qed
       qed
       from b c have th1pre: "a\<notin>A\<and>aa\<in> A\<and>(s @ t) setinterleaves ((ta, u), A) \<longrightarrow>
       tl (s @ t) setinterleaves ((list, u), A)\<and>hd (s@t)=a" by auto 
       from a b c obtain yt1 yu1 where th1pre1: "a\<notin>A\<and>aa\<in> A\<and>(s @ t) setinterleaves ((ta, u), A)\<and>
       length s>0\<longrightarrow>yt1\<le>list\<and> yu1 \<le> u\<and> tl s setinterleaves ((yt1, yu1), A)"  
         by (metis (no_types, lifting) length_Cons length_greater_0_conv lessI plus_nat.simps(2) 
         th1pre tl_append2)
       from b have th1pre2: "yt1\<le>list\<longrightarrow>a#yt1\<le>ta"  
         by (simp add: le_less less_cons) 
       from b c have th1pre3: "a\<notin>A\<and>aa\<in> A\<and>tl s setinterleaves ((yt1, yu1), A)\<longrightarrow>
       (a#(tl s)) setinterleaves ((a#yt1, yu1), A)"  
         by (metis (mono_tags, lifting) addNonSync doubleReverse rev.simps(2) rev_rev_ident)  
       from b c th1pre1 th1pre2 have th1pre4: "a\<notin>A\<and>aa\<in> A\<and>(s @ t) setinterleaves ((ta, u), A)\<and>
       length s>0 \<longrightarrow>a#yt1\<le>ta\<and> yu1 \<le>u\<and> s setinterleaves ((a#yt1, yu1), A)" 
         using th1pre th1pre3  by fastforce  
       have th1pre5:"a\<notin>A\<and>aa\<in> A\<and>(s @ t) setinterleaves ((ta, u), A)\<and>length s=0 \<longrightarrow>[]\<le>ta\<and> [] \<le>u\<and> 
       s setinterleaves (([], []), A)" by auto
       have th1: "a\<notin>A\<and>aa\<in> A\<Longrightarrow>\<exists>t1 u1. (s @ t) setinterleaves ((ta, u), A) \<longrightarrow> 
       t1 \<le> ta \<and> u1 \<le> u \<and> s setinterleaves ((t1, u1), A)"  using th1pre4 th1pre5 by blast 
       from b c have th2pre: "aa\<notin>A\<and>a\<in> A\<and>(s @ t) setinterleaves ((ta, u), A) \<longrightarrow>
       tl (s @ t) setinterleaves ((ta, lista), A)\<and>hd (s@t)=aa" by auto 
       from a b c obtain yt2 yu2 where th2pre1: "aa\<notin>A\<and>a\<in> A\<and>(s @ t) setinterleaves ((ta, u), A)\<and>
       length s>0\<longrightarrow>yt2\<le>ta\<and> yu2 \<le> lista\<and> (tl s) setinterleaves ((yt2, yu2), A)"  
         by (metis (no_types, lifting) add_Suc_right length_Cons length_greater_0_conv lessI 
         th2pre tl_append2)  
       from c have th2pre2: "yu2\<le>lista\<longrightarrow>aa#yu2\<le>u"   
         by (simp add: le_less less_cons) 
       from b c have th2pre3: "aa\<notin>A\<and>a\<in> A\<and>tl s setinterleaves ((yt2, yu2), A)\<longrightarrow>
       (aa#(tl s)) setinterleaves ((yt2, aa#yu2), A)"  
         by (metis (mono_tags, lifting) addNonSync doubleReverse rev.simps(2) rev_rev_ident)  
       from b c th2pre1 th2pre2 have th2pre4: "aa\<notin>A\<and>a\<in> A\<and>(s @ t) setinterleaves ((ta, u), A)\<and>
       length s>0 \<longrightarrow>yt2\<le>ta\<and> aa#yu2 \<le>u\<and> s setinterleaves ((yt2, aa#yu2), A)" 
         using th2pre th2pre3  by fastforce  
       have th2pre5:"aa\<notin>A\<and>a\<in> A\<and>(s @ t) setinterleaves ((ta, u), A)\<and>length s=0 \<longrightarrow>
       []\<le>ta\<and> [] \<le>u\<and> s setinterleaves (([], []), A)" by auto
       have th2: "aa\<notin>A\<and>a\<in> A\<Longrightarrow>\<exists>t1 u1. (s @ t) setinterleaves ((ta, u), A) \<longrightarrow> 
       t1 \<le> ta \<and> u1 \<le> u \<and> s setinterleaves ((t1, u1), A)"  using th2pre4 th2pre5 by blast      
       from b c have th3pre: "aa\<notin>A\<and>a\<notin> A\<and>(s @ t) setinterleaves ((ta, u), A)\<longrightarrow>tl (s @ t) 
       setinterleaves ((ta, lista), A)\<and>hd (s@t)=aa\<or>tl (s @ t)setinterleaves((list, u), A)\<and>hd(s@t)=a" 
         by auto
       from a b c th3pre obtain yt31 yu31 where th3pre1: "aa\<notin>A\<and>a\<notin> A\<and>
       (s @ t) setinterleaves ((ta, u), A)\<and>tl (s @ t) setinterleaves ((ta, lista), A)\<and>
       hd (s@t)=aa\<and>length s>0\<longrightarrow>yt31\<le>ta\<and> yu31 \<le> lista\<and> (tl s) setinterleaves ((yt31, yu31), A)" 
         by(metis(no_types,lifting)add_Suc_right length_Cons length_greater_0_conv lessI tl_append2) 
       from a b c th3pre obtain yt32 yu32 where th3pre2: "aa\<notin>A\<and>a\<notin>A\<and>(s@t)setinterleaves ((ta, u),A)\<and>
       tl (s @ t) setinterleaves ((list, u), A)\<and>hd (s@t)=a\<and>length s>0\<longrightarrow>yt32\<le>list\<and> yu32 \<le>u\<and> 
       (tl s) setinterleaves ((yt32, yu32), A)"  
         by (metis add_less_mono1 impossible_Cons le_neq_implies_less length_greater_0_conv 
         nat_le_linear tl_append2)
       from b c have th3pre3: "aa\<notin>A\<and>a\<notin> A\<and>tl s setinterleaves ((yt31, yu31), A)\<longrightarrow>
       (aa#(tl s)) setinterleaves ((yt31, aa#yu31), A)"  
         by (metis (mono_tags, lifting) addNonSync doubleReverse rev.simps(2) rev_rev_ident) 
       from b c th3pre1 th3pre2 have th3pre4: "aa\<notin>A\<and>a\<notin> A\<and>(s @ t) setinterleaves ((ta, u), A)\<and>
       length s>0\<and>tl (s @ t) setinterleaves ((ta, lista), A)\<and>hd (s@t)=aa \<longrightarrow>yt31\<le>ta\<and> aa#yu31 \<le>u\<and> 
       s setinterleaves ((yt31, aa#yu31), A)"  
         by (metis hd_append2 le_less length_greater_0_conv less_cons list.exhaust_sel th3pre3)
       from b c have th3pre5: "aa\<notin>A\<and>a\<notin> A\<and>tl s setinterleaves ((yt32, yu32), A)\<longrightarrow>
       (a#(tl s)) setinterleaves ((a#yt32, yu32), A)"  
         by (metis (mono_tags, lifting) addNonSync doubleReverse rev.simps(2) rev_rev_ident) 
       from b c th3pre1 th3pre2 have th3pre6: "aa\<notin>A\<and>a\<notin> A\<and>(s @ t) setinterleaves ((ta, u), A)\<and>
       length s>0\<and>tl (s @ t) setinterleaves ((list, u), A)\<and>hd (s@t)=a \<longrightarrow>a#yt32\<le>ta\<and> yu32 \<le>u\<and> 
       s setinterleaves ((a#yt32, yu32), A)" 
         using th3pre th3pre5  by (metis hd_append2 le_less length_greater_0_conv less_cons 
         list.exhaust_sel)
       have th3pre7:"aa\<notin>A\<and>a\<notin> A\<and>(s @ t) setinterleaves ((ta, u), A)\<and>length s=0 \<longrightarrow>
       []\<le>ta\<and> [] \<le>u\<and> s setinterleaves (([], []), A)" by auto
       have th3: "aa\<notin>A\<and>a\<notin> A\<Longrightarrow>\<exists>t1 u1. (s @ t) setinterleaves ((ta, u), A) \<longrightarrow> 
       t1 \<le> ta \<and> u1 \<le> u \<and> s setinterleaves ((t1, u1), A)"  
         using th3pre th3pre4 th3pre6 th3pre7 by blast 
       with a b c th th1 th2 show ?thesis
         by fastforce
     qed
   qed
 qed
 
 lemma SyncWithTick_imp_NTF1: 
 "(s @ [tick]) setinterleaves ((t, u), insert tick (ev ` A)) 
  \<Longrightarrow> t\<in> \<T> P \<Longrightarrow> u\<in> \<T> Q
  \<Longrightarrow> \<exists> t u Xa Y. (t, Xa) \<in> \<F> P \<and> ( (u, Y) \<in> \<F> Q \<and> 
                  s setinterleaves ((t, u), insert tick (ev ` A)) \<and> 
                  X - {tick} = (Xa \<union> Y) \<inter> insert tick (ev ` A) \<union> Xa \<inter> Y)"
   apply (drule SyncWithTick_imp_NTF)
     apply simp
    apply simp 
 proof -
   assume A: "t \<in> \<T> P"
   and B: "u \<in> \<T> Q"
   and C: "\<exists>t1 u1. t = t1 @ [tick]\<and>u = u1@[tick]\<and>s setinterleaves ((t1, u1), insert tick (ev ` A))" 
   from C obtain t1 u1 
     where D: "t = t1 @ [tick] \<and> u = u1 @ [tick] \<and> 
                   s setinterleaves ((t1, u1), insert tick (ev ` A))" by blast
   from A B D have E: "(t1, X-{tick}) \<in> \<F> P \<and> (u1, X-{tick}) \<in> \<F> Q"  
     by (simp add: T_F process_charn)  
   thus  " \<exists>t u Xa Y. (t, Xa) \<in> \<F> P \<and> (u, Y) \<in> \<F> Q \<and> 
                      s setinterleaves ((t, u), insert tick (ev ` A)) \<and> 
                      X - {tick} = (Xa \<union> Y) \<inter> insert tick (ev ` A) \<union> Xa \<inter> Y"
     using A B C D E by blast
 qed
 
 lemma ftf_Sync: 
   "front_tickFree u
    \<Longrightarrow> front_tickFree t
    \<Longrightarrow> s setinterleaves ((t, u),insert tick (ev ` A))
    \<Longrightarrow> front_tickFree s"
 proof-
   assume A: "front_tickFree u"
   assume B: "front_tickFree t"
   assume C: "s setinterleaves ((t, u), insert tick (ev ` A))"
   thus "front_tickFree s" 
   proof-
     from A obtain u1 where A1: "\<forall> u2. u1\<le>u\<and>tickFree u1\<and>  (u2\<le>u\<and>tickFree u2\<longrightarrow>u2\<le>u1)"   
       by (metis append.right_neutral append_eq_first_pref_spec front_tickFree_charn le_list_def 
          tickFree_Nil)
     from A A1 have AA1: "u1=u\<or>u=u1@[tick]" 
       by (metis(no_types, lifting) antisym append_Nil2 append_eq_first_pref_spec append_is_Nil_conv 
       front_tickFree_charn le_list_def less_list_def less_self nonTickFree_n_frontTickFree)
     from B obtain t1 where B1: "\<forall> t2. t1\<le>t\<and>tickFree t1\<and>  (t2\<le>t\<and>tickFree t2\<longrightarrow>t2\<le>t1)"
       by (metis append.right_neutral append_eq_first_pref_spec front_tickFree_charn le_list_def 
       tickFree_Nil)
     from B B1 have BB1: "t1=t\<or>t=t1@[tick]" 
       by (metis(no_types, lifting) antisym append_Nil2 append_eq_first_pref_spec append_is_Nil_conv 
       front_tickFree_charn le_list_def less_list_def less_self nonTickFree_n_frontTickFree)
     from A1 B1 have C1: "\<forall>s1. s1 setinterleaves ((t1, u1), insert tick (ev ` A))\<longrightarrow>tickFree s1"  
       by (meson ftf_Sync1 tickFree_def)
     from AA1 BB1 have CC1: "u1=u\<and>t1=t\<longrightarrow>tickFree s" 
       by (simp add: C C1)
     from AA1 BB1 have CC2: "u1=u\<and>t=t1@[tick]\<longrightarrow>tickFree s"  using ftf_Sync21  
       by (metis A1 C equals0D insertI1 non_tickFree_tick tickFree_append tickFree_def)
     from AA1 BB1 have CC3: "u=u1@[tick]\<and>t1=t\<longrightarrow>tickFree s"  using ftf_Sync21 
       by (metis B1 C insertI1 insert_not_empty mk_disjoint_insert non_tickFree_tick tickFree_append 
       tickFree_def) 
     from AA1 BB1 have CC4: "u=u1@[tick]\<and>t=t1@[tick]\<Longrightarrow>
     \<exists>s1. s1 setinterleaves ((t1, u1), insert tick (ev ` A))\<and>(s=s1@[tick])"  
       using C ftf_Sync32 by blast  
     from C1 CC4 have CC5: "front_tickFree s"  
       using AA1 BB1 CC1 CC2 CC3 tickFree_implies_front_tickFree 
       tickFree_implies_front_tickFree_single by auto
     with A1 B1 C1 AA1 BB1 show ?thesis  
       using CC1 CC2 CC3 tickFree_implies_front_tickFree by auto
     qed
   qed
 
 lemma is_processT5_SYNC2: "
 \<And> sa Y t u Xa Ya.  (t,Xa) \<in> \<F> P \<and> (u,Ya) \<in> \<F> Q \<and> (sa setinterleaves ((t,u),insert tick (ev ` A))) 
   \<Longrightarrow>\<forall>c. c \<in> Y \<longrightarrow>
         (\<forall> t1 u1. (sa@[c]) setinterleaves ((t1,u1),insert tick (ev ` A))\<longrightarrow>
         (((t1,{}) \<in> \<F> P\<longrightarrow>(u1, {}) \<notin> \<F> Q)\<and>((t1,{}) \<in> \<F> Q\<longrightarrow>(u1, {}) \<notin> \<F> P))) 
   \<Longrightarrow> \<exists>t2 u2 Xb. (t2, Xb) \<in> \<F> P \<and> 
                   (\<exists>Yb. (u2, Yb) \<in> \<F> Q \<and>
                         sa setinterleaves ((t2, u2), insert tick (ev ` A)) \<and>
                         ( Xa \<union> Ya) \<inter> insert tick (ev ` A) \<union> Xa \<inter> Ya \<union> Y = 
                             (Xb \<union> Yb) \<inter> insert tick (ev ` A) \<union> Xb \<inter> Yb)"  
 proof -
   fix sa Y t u Xa Ya
   assume A: "(t,Xa) \<in> \<F> P \<and> (u,Ya) \<in> \<F> Q \<and>(sa setinterleaves ((t,u),insert tick (ev ` A)))" 
   and B: " \<forall>c. c \<in> Y \<longrightarrow>
                (\<forall> t1 u1. (sa@[c]) setinterleaves ((t1,u1),insert tick (ev ` A)) \<longrightarrow>
                (((t1,{}) \<in> \<F> P \<longrightarrow>
                (u1, {}) \<notin> \<F> Q) \<and> ((t1,{}) \<in> \<F> Q\<longrightarrow>(u1, {}) \<notin> \<F> P)))"
   thus "\<exists>t2 u2 Xb. (t2, Xb) \<in> \<F> P \<and> 
                    (\<exists>Yb. (u2, Yb) \<in> \<F> Q \<and> sa setinterleaves ((t2, u2), insert tick (ev ` A)) \<and>
                    (Xa \<union> Ya) \<inter> insert tick (ev ` A) \<union> Xa \<inter> Ya \<union> Y = 
                       (Xb \<union> Yb) \<inter> insert tick (ev ` A) \<union> Xb \<inter> Yb)"
   proof-
     from A B obtain Y1 Y2 
                where A1: "(Y1=(Y\<inter>insert tick (ev ` A)))\<and>(Y2=(Y - insert tick (ev ` A)))" 
       by blast
     from A1 have AA1: "Y1 \<union> Y2 = Y" 
       by blast 
     from A1 have newAA: "\<forall>y\<in>Y1. y\<in> insert tick (ev ` A)" 
       by blast
     from A1 have newAAA: "\<forall>y\<in>Y2. y\<notin> insert tick (ev ` A)" 
       by blast
     from B A1 have AA2: "\<forall>z\<in>Y1.(t@[z], {}) \<notin> \<F> P \<or> (u@[z], {}) \<notin> \<F> Q" 
     proof(cases "\<exists>z \<in> Y1. (t@[z], {})\<in>\<F> P \<and> (u@[z], {}) \<in> \<F> Q")
       case True
       from True obtain z1 where TrA: "z1\<in>Y1\<and>(t@[z1], {})\<in>\<F> P \<and> (u@[z1], {}) \<in> \<F> Q" 
         by blast
       from TrA A have TrB: 
              "\<lbrakk>sa setinterleaves ((t,u),insert tick(ev ` A)); 
                z1\<in>insert tick (ev ` A)\<rbrakk>
               \<Longrightarrow>(sa@[z1]) setinterleaves ((t@[z1],(u@[z1])),insert tick (ev ` A))"    
       proof- 
         have a: "(rev sa) setinterleaves ((rev t,rev u),insert tick (ev ` A))"  
           using local.A doubleReverse by blast
         have b: "(z1#rev sa)  setinterleaves  ((z1#rev t,z1# rev u),insert tick (ev ` A))"  
           using TrA a newAA by auto
         show ?thesis  
           using b doubleReverse by fastforce
       qed
       then show ?thesis  
         using A1 B TrA local.A by blast  
     next
       case False
       then show ?thesis 
         by blast
     qed
     from A B A1 obtain Z1 Z2 where A2: "(Z1=Y1\<inter>{z.(t@[z], {})\<notin>\<F> P})\<and>(Z2=Y1-{z.(t@[z], {})\<notin>\<F> P})" 
       by blast
     from A2 have BA: "Y1=Z1\<union>Z2" 
       by blast
     from A2 have BAA: "\<forall>z\<in>Z1. (t@[z], {}) \<notin> \<F> P" 
       by blast
     from A2 have BAAA: "\<forall>z\<in>Z2. (u@[z], {})\<notin> \<F> Q"  
       using AA2 by blast
     from A2 BA BAA have A3: "(t, Z1)\<in> \<F> P"   
       by (meson F_T NF_NT is_processT5_S7 local.A)  
     from A A1 have A43: "\<forall>y\<in>Y2. (t@[y], {})\<notin> \<F> P \<and> (u@[y], {})\<notin> \<F> Q" 
     proof(cases "\<exists>y\<in>Y2. ((t@[y], {})\<in> \<F> P)\<or>((u@[y], {})\<in> \<F> Q)")
       case True
       from True obtain y1 where innAA: "y1\<in>Y2\<and>(((t@[y1], {})\<in> \<F> P)\<or>((u@[y1], {})\<in> \<F> Q))" by blast
       from innAA have innAAA: "y1\<notin> insert tick (ev ` A)"  
         using newAAA by auto
       from innAA have innAA1: 
              "\<lbrakk>sa setinterleaves ((t,u),insert tick (ev ` A)); 
                y1 \<notin> insert tick (ev ` A)\<rbrakk>
               \<Longrightarrow> ((t@[y1], {})\<in> \<F> P
                    \<longrightarrow>(sa@[y1]) setinterleaves ((t@[y1],u),insert tick (ev ` A))) \<and>
                       ((u@[y1], {})\<in> \<F> Q\<longrightarrow>(sa@[y1]) setinterleaves((t,u@[y1]),insert tick (ev`A)))" 
         by (simp add: addNonSync)        
       with A B innAA1 innAA show ?thesis  
         by (metis A1 DiffD1 innAAA is_processT4_empty)
     next
       case False
       then show ?thesis by blast
     qed
     from A1  A2 obtain Xbb where B1: "Xbb=(Xa\<union>Z1\<union>Y2)" 
       by blast
     from A B1 A3 A43  have A5: "(t, Xbb)\<in> \<F> P"   
       by (meson BAA is_processT5_S1)
     from A1 A2 obtain Ybb where B2: "Ybb=(Ya\<union>Z2\<union>Y2)" 
       by blast
     from A B have A52: "(u, Ybb)\<in> \<F> Q"  
       by (metis A43 B2 BAAA is_processT5_S1)   
     from A1 A2 have A61: "(Xbb \<union> Ybb)\<inter>insert tick (ev ` A)=((Xa\<union>Ya\<union>Y1\<union>Y2) \<inter> insert tick (ev ` A))"  
       using B1 B2 by blast
     from A1 have A62: "(Y1) \<inter> insert tick (ev ` A)=Y1"  
       using inf.orderE by auto
     from A1 have A63: "(Y2) \<inter> insert tick (ev ` A)={}"  
       by (simp add: AA1 Int_commute) 
     from A61 A62 A63 have A64:"((Xa\<union>Ya\<union>Y1\<union>Y2)\<inter>insert tick(ev `A))=((Xa\<union>Ya)\<inter>insert tick(ev `A)\<union>Y1)" 
       by (simp add: Int_Un_distrib2)
     from AA1 BA B1 B2 have A65: "(Xbb\<inter>Ybb)\<subseteq>((Xa\<inter>Ya)\<union>Y) " 
       by auto  
     from AA1 BA B1 B2 have A66:"(Xbb\<inter>Ybb)\<supseteq>((Xa\<inter>Ya)\<union>Y2)" 
       by auto    
     from A1 A2  have A66: "((Xa \<union> Ya) \<inter> insert tick (ev ` A) \<union> Xa \<inter> Ya \<union> Y) = ((Xbb \<union> Ybb) \<inter> 
     insert tick (ev ` A) \<union> Xbb \<inter> Ybb)"
     proof -
       have f1: "(Xa \<union> Ya) \<inter> insert tick (ev ` A) \<union> Xa \<inter> Ya \<union> Y = Y \<union> Xa \<inter> Ya \<union> ((Xa \<union> Ya) \<inter> 
       insert tick (ev ` A) \<union> Xbb \<inter> Ybb)"using A65 by auto
       have "Xa \<inter> Ya \<union> Y2 \<union> Xbb \<inter> Ybb = Xbb \<inter> Ybb"
         by (meson A66 le_iff_sup)
       then have "(Xa \<union> Ya) \<inter> insert tick (ev ` A) \<union> Xa \<inter> Ya \<union> Y = Xbb \<inter> Ybb \<union> ((Xa \<union> Ya) \<inter> 
       insert tick (ev ` A) \<union> Y1)" using f1 A1 by auto
       then show ?thesis
         using A61 A64 by force
     qed
     with A5 A52 A66 show ?thesis  
       using local.A by blast  
   qed
 qed
 
 lemma pt3: 
   "ta \<in> \<T> P 
    \<Longrightarrow> u \<in> \<T> Q \<Longrightarrow> (s @ t) setinterleaves ((ta, u), insert tick (ev ` A))
    \<Longrightarrow> \<exists>t u X. (t, X) \<in> \<F> P \<and>
                 (\<exists>Y. (u, Y) \<in> \<F> Q \<and> 
                      s setinterleaves ((t, u), insert tick (ev ` A)) \<and>
                      tick \<notin> X \<and> tick \<notin> Y \<and> (X \<union> Y) \<inter> ev ` A = {} \<and> X \<inter> Y = {})"  
 proof-
   assume a1: "ta \<in> \<T> P"
   assume a2: "u \<in> \<T> Q"
   assume a3: "(s @ t) setinterleaves ((ta, u), insert tick (ev ` A))"
   have aa: "ta \<in> \<T> P \<Longrightarrow>u \<in> \<T> Q \<Longrightarrow> (s @ t) setinterleaves ((ta, u), insert tick (ev ` A))\<Longrightarrow>
                 \<exists>t u. t \<in> \<T> P \<and>(u \<in> \<T> Q \<and>s setinterleaves ((t, u), insert tick (ev ` A)))" 
     using is_processT3_ST_pref synPrefix by blast
   thus "\<exists>t u X. (t, X) \<in> \<F> P \<and>(\<exists>Y. (u, Y) \<in> \<F> Q \<and>
                  s setinterleaves ((t, u), insert tick (ev ` A)) \<and>
                  tick \<notin> X \<and> tick \<notin> Y \<and> (X \<union> Y) \<inter> ev ` A = {} \<and> X \<inter> Y = {})"  
     using NF_NT a1 a2 a3 by blast
 qed
-  
 
-lemma Sync_maintains_is_process:
- "is_process ({(s,R).\<exists> t u X Y. (t,X) \<in> \<F> P \<and> (u,Y) \<in> \<F> Q \<and> 
-                                (s setinterleaves ((t,u),(ev`A) \<union> {tick})) \<and> 
-                                R = (X \<union> Y) \<inter> ((ev`A) \<union> {tick}) \<union> X \<inter> Y} \<union> 
-              {(s,R).\<exists> t u r v. front_tickFree v \<and> (tickFree r \<or> v=[]) \<and> 
-                                s = r@v \<and> 
-                                (r setinterleaves ((t,u),(ev`A) \<union> {tick})) \<and>      
-                                (t \<in> \<D> P \<and> u \<in> \<T> Q \<or> t \<in> \<D> Q \<and> u \<in> \<T> P)},
 
-              {s.    \<exists> t u r v. front_tickFree v \<and> (tickFree r \<or> v=[]) \<and> 
+
+subsection\<open>The Sync Operator Definition\<close>
+
+lift_definition Sync :: "['a process,'a set,'a process] => 'a process"    ("(3(_ \<lbrakk>_\<rbrakk>/ _))" [64,0,65] 64)  
+  is "\<lambda>P A Q. ({(s,R).\<exists> t u X Y. (t,X) \<in> \<F> P \<and> (u,Y) \<in> \<F> Q \<and> 
+                                 (s setinterleaves ((t,u),(ev`A) \<union> {tick})) \<and> 
+                                 R = (X \<union> Y) \<inter> ((ev`A) \<union> {tick}) \<union> X \<inter> Y}    \<union> 
+               {(s,R).\<exists> t u r v. front_tickFree v \<and> (tickFree r \<or> v=[]) \<and> 
+                                 s = r@v \<and> 
+                                 (r setinterleaves ((t,u),(ev`A) \<union> {tick})) \<and> 
+                                 (t \<in> \<D> P \<and> u \<in> \<T> Q \<or> t \<in> \<D> Q \<and> u \<in> \<T> P)},
+               
+               {s.   \<exists> t u r v. front_tickFree v \<and> (tickFree r \<or> v=[]) \<and> 
                                 s = r@v \<and> 
                                 (r setinterleaves ((t,u),(ev`A) \<union> {tick})) \<and> 
                                 (t \<in> \<D> P \<and> u \<in> \<T> Q \<or> t \<in> \<D> Q \<and> u \<in> \<T> P)})"
-              (is "is_process(?f, ?d)") 
-proof(simp only: fst_conv snd_conv Failures_def is_process_def FAILURES_def DIVERGENCES_def,
-      fold FAILURES_def DIVERGENCES_def,fold Failures_def,intro conjI) 
-  show "([], {}) \<in> ?f" 
-    apply auto 
-    by (metis Int_commute Int_empty_right Sync.si_empty1 Un_empty empty_iff insert_iff is_processT1) 
-next 
-  show " \<forall>s X. (s, X) \<in> ?f \<longrightarrow> front_tickFree s" 
-    apply (auto simp:is_processT2 append_T_imp_tickFree front_tickFree_append D_imp_front_tickFree) 
-      using ftf_Sync is_processT2 apply blast
-     using D_imp_front_tickFree ftf_Sync is_processT2_TR apply blast
-    using D_imp_front_tickFree ftf_Sync is_processT2_TR by blast  
-next
-  show "\<forall>s t. (s @ t, {}) \<in> ?f \<longrightarrow> (s, {}) \<in> ?f" 
-    apply auto   
-        apply(drule F_T) 
-        apply(drule F_T) 
-  proof(goal_cases)
-    case (1 s t ta u X Y)
+proof -
+  show "is_process ({(s,R).\<exists> t u X Y. (t,X) \<in> \<F> P \<and> (u,Y) \<in> \<F> Q \<and> 
+                                      (s setinterleaves ((t,u),(ev`(A :: 'a set)) \<union> {tick})) \<and> 
+                                      R = (X \<union> Y) \<inter> ((ev`A) \<union> {tick}) \<union> X \<inter> Y} \<union> 
+                    {(s,R).\<exists> t u r v. front_tickFree v \<and> (tickFree r \<or> v=[]) \<and> 
+                                      s = r@v \<and> 
+                                      (r setinterleaves ((t,u),(ev`A) \<union> {tick})) \<and>      
+                                      (t \<in> \<D> P \<and> u \<in> \<T> Q \<or> t \<in> \<D> Q \<and> u \<in> \<T> P)},
+                
+                    {s.    \<exists> t u r v. front_tickFree v \<and> (tickFree r \<or> v=[]) \<and> 
+                                      s = r@v \<and> 
+                                      (r setinterleaves ((t,u),(ev`A) \<union> {tick})) \<and> 
+                                      (t \<in> \<D> P \<and> u \<in> \<T> Q \<or> t \<in> \<D> Q \<and> u \<in> \<T> P)})"
+                    (is "is_process(?f, ?d)") for P Q A
+  unfolding is_process_def FAILURES_def DIVERGENCES_def
+  proof (simp only: fst_conv snd_conv, intro conjI)
+    show "([], {}) \<in> ?f" 
+      apply auto 
+      by (metis Int_commute Int_empty_right Sync.si_empty1 Un_empty empty_iff insert_iff is_processT1) 
+  next 
+    show " \<forall>s X. (s, X) \<in> ?f \<longrightarrow> front_tickFree s" 
+      apply (auto simp:is_processT2 append_T_imp_tickFree front_tickFree_append D_imp_front_tickFree) 
+        using ftf_Sync is_processT2 apply blast
+       using D_imp_front_tickFree ftf_Sync is_processT2_TR apply blast
+      using D_imp_front_tickFree ftf_Sync is_processT2_TR by blast  
+  next
+    show "\<forall>s t. (s @ t, {}) \<in> ?f \<longrightarrow> (s, {}) \<in> ?f" 
+      apply auto   
+          apply(drule F_T) 
+          apply(drule F_T) 
+    proof(goal_cases)
+      case (1 s t ta u X Y)
+      then show ?case 
+        using pt3 by fastforce
+  next
+    case (2 s t ta u r v)
+    have aa: "front_tickFree v 
+               \<Longrightarrow> s@t = r @ v \<Longrightarrow> r setinterleaves ((ta, u), insert tick (ev ` A)) 
+               \<Longrightarrow> \<forall>t u r. r setinterleaves ((t,u),insert tick(ev `A)) \<longrightarrow>
+                            (\<forall>v. s=r@v\<longrightarrow>front_tickFree v \<longrightarrow>
+                            \<not>tickFree r \<and> v\<noteq>[]\<or>(t \<in> \<D> P \<longrightarrow>
+                            u \<notin> \<T> Q) \<and> (t \<in> \<D> Q \<longrightarrow> u \<notin> \<T> P))
+               \<Longrightarrow> tickFree r \<Longrightarrow> ta \<in> \<D> P \<Longrightarrow> u \<in> \<T> Q \<Longrightarrow> s<r" 
+      apply(simp add: append_eq_append_conv2) 
+      by (metis append_Nil2 front_tickFree_Nil front_tickFree_dw_closed le_list_def less_list_def)
+    from 2(1,2,3,4,5,6,7) Sync.sym aa have a1: "s<r" by blast
+    have aaa: "r setinterleaves ((ta, u), insert tick (ev ` A)) 
+               \<Longrightarrow> tickFree r \<Longrightarrow> ta \<in> \<D> P
+               \<Longrightarrow> u \<in> \<T> Q \<Longrightarrow> s<r 
+               \<Longrightarrow> \<exists>t u X. (t, X) \<in> \<F> P \<and> (\<exists>Y. (u, Y) \<in> \<F> Q \<and>
+                          s setinterleaves ((t, u), insert tick (ev ` A)) \<and>
+                          tick \<notin> X \<and> tick \<notin> Y \<and> (X \<union> Y) \<inter> ev ` A = {} \<and> X \<inter> Y = {})"
+      apply(drule D_T) 
+      apply(simp add: le_list_def less_list_def)  
+      using Sync.sym pt3 by blast
+    have aab: "\<exists>t u X. (t, X) \<in> \<F> P \<and>(\<exists>Y. (u, Y) \<in> \<F> Q \<and> 
+                       s setinterleaves ((t, u), insert tick (ev ` A)) \<and> 
+                       tick \<notin> X \<and> tick \<notin> Y \<and> (X \<union> Y) \<inter> ev ` A = {} \<and> X \<inter> Y = {})" 
+      using 2(1,2,3,4,5,6,7) aa aaa Sync.sym by auto
+    then show ?case by auto  
+  next
+    case (3 s t ta u r v)
+    have aa: "front_tickFree v \<Longrightarrow>s @ t = r @ v 
+             \<Longrightarrow> r setinterleaves ((ta, u), insert tick (ev ` A)) 
+             \<Longrightarrow> \<forall>t u r. r setinterleaves ((t, u), insert tick (ev ` A)) \<longrightarrow>
+                    (\<forall>v. s = r @ v \<longrightarrow>front_tickFree v \<longrightarrow>\<not> tickFree r \<and> v \<noteq> [] \<or> 
+                           (t \<in> \<D> P \<longrightarrow> u \<notin> \<T> Q) \<and> (t \<in> \<D> Q \<longrightarrow> u \<notin> \<T> P)) 
+             \<Longrightarrow> tickFree r 
+             \<Longrightarrow> ta \<in> \<D> Q \<Longrightarrow> u \<in> \<T> P \<Longrightarrow> s<r"  
+      apply(simp add: append_eq_append_conv2) 
+      by (metis append_Nil2 front_tickFree_Nil front_tickFree_dw_closed le_list_def less_list_def)
+    
+    have aaa: "r setinterleaves ((ta, u), insert tick (ev ` A)) 
+               \<Longrightarrow> tickFree r \<Longrightarrow> ta \<in> \<D> Q \<Longrightarrow> u \<in> \<T> P \<Longrightarrow>s<r
+               \<Longrightarrow> \<exists>t u X. (t, X) \<in> \<F> P \<and> 
+                           (\<exists>Y. (u, Y) \<in> \<F> Q \<and>s setinterleaves ((t, u), insert tick (ev ` A)) \<and>
+                            tick \<notin> X \<and> tick \<notin> Y \<and> (X \<union> Y) \<inter> ev ` A = {} \<and> X \<inter> Y = {})" 
+      apply(drule D_T) 
+      apply(simp add: le_list_def less_list_def)  
+      using Sync.sym pt3 by blast
+    from 3(1,2,3,4,5,6,7) Sync.sym aa have a1: "s<r"  
+      by blast
+    have aab: "\<exists>t u X. (t, X) \<in> \<F> P \<and> (\<exists>Y. (u, Y) \<in> \<F> Q \<and> 
+                       s setinterleaves ((t, u), insert tick (ev ` A)) \<and> 
+                       tick \<notin> X \<and> tick \<notin> Y \<and> (X \<union> Y) \<inter> ev ` A = {} \<and> X \<inter> Y = {})" 
+      using 3(1,2,3,4,5,6,7) aa aaa Sync.sym by auto 
     then show ?case 
-      using pt3 by fastforce
-next
-  case (2 s t ta u r v)
-  have aa: "front_tickFree v 
-             \<Longrightarrow> s@t = r @ v \<Longrightarrow> r setinterleaves ((ta, u), insert tick (ev ` A)) 
-             \<Longrightarrow> \<forall>t u r. r setinterleaves ((t,u),insert tick(ev `A)) \<longrightarrow>
-                          (\<forall>v. s=r@v\<longrightarrow>front_tickFree v \<longrightarrow>
-                          \<not>tickFree r \<and> v\<noteq>[]\<or>(t \<in> \<D> P \<longrightarrow>
-                          u \<notin> \<T> Q) \<and> (t \<in> \<D> Q \<longrightarrow> u \<notin> \<T> P))
-             \<Longrightarrow> tickFree r \<Longrightarrow> ta \<in> \<D> P \<Longrightarrow> u \<in> \<T> Q \<Longrightarrow> s<r" 
-    apply(simp add: append_eq_append_conv2) 
-    by (metis append_Nil2 front_tickFree_Nil front_tickFree_dw_closed le_list_def less_list_def)
-  from 2(1,2,3,4,5,6,7) Sync.sym aa have a1: "s<r" by blast
-  have aaa: "r setinterleaves ((ta, u), insert tick (ev ` A)) 
-             \<Longrightarrow> tickFree r \<Longrightarrow> ta \<in> \<D> P
-             \<Longrightarrow> u \<in> \<T> Q \<Longrightarrow> s<r 
-             \<Longrightarrow> \<exists>t u X. (t, X) \<in> \<F> P \<and> (\<exists>Y. (u, Y) \<in> \<F> Q \<and>
-                        s setinterleaves ((t, u), insert tick (ev ` A)) \<and>
-                        tick \<notin> X \<and> tick \<notin> Y \<and> (X \<union> Y) \<inter> ev ` A = {} \<and> X \<inter> Y = {})"
-    apply(drule D_T) 
-    apply(simp add: le_list_def less_list_def)  
-    using Sync.sym pt3 by blast
-  have aab: "\<exists>t u X. (t, X) \<in> \<F> P \<and>(\<exists>Y. (u, Y) \<in> \<F> Q \<and> 
-                     s setinterleaves ((t, u), insert tick (ev ` A)) \<and> 
-                     tick \<notin> X \<and> tick \<notin> Y \<and> (X \<union> Y) \<inter> ev ` A = {} \<and> X \<inter> Y = {})" 
-    using 2(1,2,3,4,5,6,7) aa aaa Sync.sym by auto
-  then show ?case by auto  
-next
-  case (3 s t ta u r v)
-  have aa: "front_tickFree v \<Longrightarrow>s @ t = r @ v 
-           \<Longrightarrow> r setinterleaves ((ta, u), insert tick (ev ` A)) 
-           \<Longrightarrow> \<forall>t u r. r setinterleaves ((t, u), insert tick (ev ` A)) \<longrightarrow>
-                  (\<forall>v. s = r @ v \<longrightarrow>front_tickFree v \<longrightarrow>\<not> tickFree r \<and> v \<noteq> [] \<or> 
-                         (t \<in> \<D> P \<longrightarrow> u \<notin> \<T> Q) \<and> (t \<in> \<D> Q \<longrightarrow> u \<notin> \<T> P)) 
-           \<Longrightarrow> tickFree r 
-           \<Longrightarrow> ta \<in> \<D> Q \<Longrightarrow> u \<in> \<T> P \<Longrightarrow> s<r"  
-    apply(simp add: append_eq_append_conv2) 
-    by (metis append_Nil2 front_tickFree_Nil front_tickFree_dw_closed le_list_def less_list_def)
-  
-  have aaa: "r setinterleaves ((ta, u), insert tick (ev ` A)) 
-             \<Longrightarrow> tickFree r \<Longrightarrow> ta \<in> \<D> Q \<Longrightarrow> u \<in> \<T> P \<Longrightarrow>s<r
-             \<Longrightarrow> \<exists>t u X. (t, X) \<in> \<F> P \<and> 
-                         (\<exists>Y. (u, Y) \<in> \<F> Q \<and>s setinterleaves ((t, u), insert tick (ev ` A)) \<and>
-                          tick \<notin> X \<and> tick \<notin> Y \<and> (X \<union> Y) \<inter> ev ` A = {} \<and> X \<inter> Y = {})" 
-    apply(drule D_T) 
-    apply(simp add: le_list_def less_list_def)  
-    using Sync.sym pt3 by blast
-  from 3(1,2,3,4,5,6,7) Sync.sym aa have a1: "s<r"  
-    by blast
-  have aab: "\<exists>t u X. (t, X) \<in> \<F> P \<and> (\<exists>Y. (u, Y) \<in> \<F> Q \<and> 
-                     s setinterleaves ((t, u), insert tick (ev ` A)) \<and> 
-                     tick \<notin> X \<and> tick \<notin> Y \<and> (X \<union> Y) \<inter> ev ` A = {} \<and> X \<inter> Y = {})" 
-    using 3(1,2,3,4,5,6,7) aa aaa Sync.sym by auto 
-  then show ?case 
-    by auto 
-next
-  case (4 s t ta u)
-  from 4(3) have a1: "ta \<in> \<T> P"  
-    by (simp add: D_T)
-  then show ?case  
-    using "4"(1) "4"(4) pt3 by blast  
-next
-  case (5 s t ta u)
-  from 5(3) have a1: "ta \<in> \<T> Q"  
-    by (simp add: D_T)
-  then show ?case  
-    using "5"(1) "5"(4) Sync.sym pt3 by blast
-qed      
-next 
-  show "\<forall>s X Y. (s, Y) \<in> ?f \<and> X \<subseteq> Y \<longrightarrow> (s, X) \<in> ?f"   
-    apply auto 
-  proof(goal_cases)
-    case (1 s X t u Xa Ya)
-    have aa: "X \<subseteq> ((Xa \<union> Ya) \<inter> insert tick (ev ` A) \<union> Xa \<inter> Ya )\<Longrightarrow>\<exists>x1 y1. x1\<subseteq>Xa \<and> y1\<subseteq>Ya \<and> 
-    X=((x1 \<union> y1) \<inter> insert tick (ev ` A) \<union> x1 \<inter> y1)" 
-      apply(simp add: Set.subset_iff_psubset_eq) 
-      apply(erule disjE) 
-       defer 
-       apply blast 
-    proof-
-      assume A: "X \<subset> (Xa \<union> Ya) \<inter> insert tick (ev ` A) \<union> Xa \<inter> Ya" 
-      from A obtain X1 where B: "X1=((Xa \<union> Ya) \<inter> insert tick (ev ` A) \<union> Xa \<inter> Ya)-X" 
-        by blast
-      from A obtain x where C: "x=Xa-X1" 
-        by blast
-      from A obtain y where D: "y=Ya-X1" 
-        by blast
-      from A B C D have E: "X = (x \<union> y) \<inter> insert tick (ev ` A) \<union> x \<inter> y" 
-        by blast
-      thus " \<exists>x1. (x1 \<subset> Xa \<or> x1 = Xa) \<and> (\<exists>y1. (y1 \<subset> Ya \<or> y1 = Ya) \<and> X = (x1 \<union> y1) \<inter> 
-      insert tick (ev ` A) \<union> x1 \<inter> y1)"
-        using A B C D E by (metis Un_Diff_Int inf.strict_order_iff inf_sup_absorb) 
-    qed 
-    then show ?case using 1(1,2,3,4,5)  
-      by (meson process_charn)
+      by auto 
+  next
+    case (4 s t ta u)
+    from 4(3) have a1: "ta \<in> \<T> P"  
+      by (simp add: D_T)
+    then show ?case  
+      using "4"(1) "4"(4) pt3 by blast  
+  next
+    case (5 s t ta u)
+    from 5(3) have a1: "ta \<in> \<T> Q"  
+      by (simp add: D_T)
+    then show ?case  
+      using "5"(1) "5"(4) Sync.sym pt3 by blast
+  qed      
+  next 
+    show "\<forall>s X Y. (s, Y) \<in> ?f \<and> X \<subseteq> Y \<longrightarrow> (s, X) \<in> ?f"   
+      apply auto 
+    proof(goal_cases)
+      case (1 s X t u Xa Ya)
+      have aa: "X \<subseteq> ((Xa \<union> Ya) \<inter> insert tick (ev ` A) \<union> Xa \<inter> Ya )\<Longrightarrow>\<exists>x1 y1. x1\<subseteq>Xa \<and> y1\<subseteq>Ya \<and> 
+      X=((x1 \<union> y1) \<inter> insert tick (ev ` A) \<union> x1 \<inter> y1)" 
+        apply(simp add: Set.subset_iff_psubset_eq) 
+        apply(erule disjE) 
+         defer 
+         apply blast 
+      proof-
+        assume A: "X \<subset> (Xa \<union> Ya) \<inter> insert tick (ev ` A) \<union> Xa \<inter> Ya" 
+        from A obtain X1 where B: "X1=((Xa \<union> Ya) \<inter> insert tick (ev ` A) \<union> Xa \<inter> Ya)-X" 
+          by blast
+        from A obtain x where C: "x=Xa-X1" 
+          by blast
+        from A obtain y where D: "y=Ya-X1" 
+          by blast
+        from A B C D have E: "X = (x \<union> y) \<inter> insert tick (ev ` A) \<union> x \<inter> y" 
+          by blast
+        thus " \<exists>x1. (x1 \<subset> Xa \<or> x1 = Xa) \<and> (\<exists>y1. (y1 \<subset> Ya \<or> y1 = Ya) \<and> X = (x1 \<union> y1) \<inter> 
+        insert tick (ev ` A) \<union> x1 \<inter> y1)"
+          using A B C D E by (metis Un_Diff_Int inf.strict_order_iff inf_sup_absorb) 
+      qed 
+      then show ?case using 1(1,2,3,4,5)  
+        by (meson process_charn)
+    qed
+   
+  next  
+    let ?f1 = "{(s,R). \<exists> t u X Y. (t,X) \<in> \<F> P \<and> (u,Y) \<in> \<F> Q \<and> 
+                       (s setinterleaves ((t,u),(ev`A) \<union> {tick})) \<and> 
+                       R = (X \<union> Y) \<inter> ((ev`A) \<union> {tick}) \<union> X \<inter> Y}" 
+    have is_processT5_SYNC3: 
+              "\<And>sa X Y.(sa, X) \<in>?f1 \<Longrightarrow>(\<forall>c. c\<in>Y\<longrightarrow>(sa@[c],{})\<notin>?f)\<Longrightarrow>(sa, X\<union>Y) \<in> ?f1" 
+      apply(clarsimp) 
+      apply(rule is_processT5_SYNC2[simplified]) 
+       apply(auto simp:is_processT5) apply blast  
+      by (metis Sync.sym Un_empty_right inf_sup_absorb inf_sup_aci(5) insert_absorb insert_not_empty)  
+    show "\<forall>s X Y. (s, X) \<in> ?f \<and> (\<forall>c. c \<in> Y \<longrightarrow> (s @ [c], {}) \<notin> ?f) \<longrightarrow> (s, X \<union> Y) \<in> ?f"
+      apply(intro allI impI, elim conjE UnE)
+       apply(rule rev_subsetD)
+        apply(rule is_processT5_SYNC3)
+      by(auto)  
+  next
+    show "\<forall>s X. (s @ [tick], {}) \<in> ?f \<longrightarrow> (s, X - {tick}) \<in> ?f" 
+      apply auto 
+          apply(drule F_T) 
+          apply(drule F_T)  
+          using SyncWithTick_imp_NTF1 apply fastforce 
+         apply(metis append_assoc append_same_eq front_tickFree_dw_closed nonTickFree_n_frontTickFree 
+         non_tickFree_tick tickFree_append) 
+        apply(metis butlast_append butlast_snoc front_tickFree_charn non_tickFree_tick tickFree_append 
+        tickFree_implies_front_tickFree) 
+       apply (metis NT_ND append_Nil2 front_tickFree_Nil is_processT3_ST is_processT9_S_swap 
+       SyncWithTick_imp_NTF) 
+      by (metis NT_ND append_Nil2 front_tickFree_Nil is_processT3_ST is_processT9_S_swap 
+      SyncWithTick_imp_NTF)
+      
+  next
+    show "\<forall>s t. s \<in> ?d \<and> tickFree s \<and> front_tickFree t \<longrightarrow> s @ t \<in> ?d" 
+      apply auto
+         using front_tickFree_append apply blast 
+        using front_tickFree_append apply blast 
+       apply blast
+      by blast
+  next  
+    show "\<forall>s X. s \<in> ?d \<longrightarrow>  (s, X) \<in> ?f"
+      by blast
+  next  
+    show "\<forall>s. s @ [tick] \<in> ?d \<longrightarrow> s \<in> ?d"  
+      apply auto
+         apply (metis butlast_append butlast_snoc front_tickFree_charn non_tickFree_tick 
+         tickFree_append tickFree_implies_front_tickFree)
+        apply (metis butlast_append butlast_snoc front_tickFree_charn non_tickFree_tick 
+        tickFree_append tickFree_implies_front_tickFree) 
+       apply (metis D_T append.right_neutral front_tickFree_Nil is_processT3_ST is_processT9 
+       SyncWithTick_imp_NTF) 
+      by (metis D_T append.right_neutral front_tickFree_Nil is_processT3_ST is_processT9 
+      SyncWithTick_imp_NTF) 
   qed
- 
-next  
-  let ?f1 = "{(s,R). \<exists> t u X Y. (t,X) \<in> \<F> P \<and> (u,Y) \<in> \<F> Q \<and> 
-                     (s setinterleaves ((t,u),(ev`A) \<union> {tick})) \<and> 
-                     R = (X \<union> Y) \<inter> ((ev`A) \<union> {tick}) \<union> X \<inter> Y}" 
-  have is_processT5_SYNC3: 
-            "\<And>sa X Y.(sa, X) \<in>?f1 \<Longrightarrow>(\<forall>c. c\<in>Y\<longrightarrow>(sa@[c],{})\<notin>?f)\<Longrightarrow>(sa, X\<union>Y) \<in> ?f1" 
-    apply(clarsimp) 
-    apply(rule is_processT5_SYNC2[simplified]) 
-     apply(auto simp:is_processT5) apply blast  
-    by (metis Sync.sym Un_empty_right inf_sup_absorb inf_sup_aci(5) insert_absorb insert_not_empty)  
-  show "\<forall>s X Y. (s, X) \<in> ?f \<and> (\<forall>c. c \<in> Y \<longrightarrow> (s @ [c], {}) \<notin> ?f) \<longrightarrow> (s, X \<union> Y) \<in> ?f"
-    apply(intro allI impI, elim conjE UnE)
-     apply(rule rev_subsetD)
-      apply(rule is_processT5_SYNC3)
-    by(auto)  
-next
-  show "\<forall>s X. (s @ [tick], {}) \<in> ?f \<longrightarrow> (s, X - {tick}) \<in> ?f" 
-    apply auto 
-        apply(drule F_T) 
-        apply(drule F_T)  
-        using SyncWithTick_imp_NTF1 apply fastforce 
-       apply(metis append_assoc append_same_eq front_tickFree_dw_closed nonTickFree_n_frontTickFree 
-       non_tickFree_tick tickFree_append) 
-      apply(metis butlast_append butlast_snoc front_tickFree_charn non_tickFree_tick tickFree_append 
-      tickFree_implies_front_tickFree) 
-     apply (metis NT_ND append_Nil2 front_tickFree_Nil is_processT3_ST is_processT9_S_swap 
-     SyncWithTick_imp_NTF) 
-    by (metis NT_ND append_Nil2 front_tickFree_Nil is_processT3_ST is_processT9_S_swap 
-    SyncWithTick_imp_NTF)
-    
-next
-  show "\<forall>s t. s \<in> ?d \<and> tickFree s \<and> front_tickFree t \<longrightarrow> s @ t \<in> ?d" 
-    apply auto
-       using front_tickFree_append apply blast 
-      using front_tickFree_append apply blast 
-     apply blast
-    by blast
-next  
-  show "\<forall>s X. s \<in> ?d \<longrightarrow>  (s, X) \<in> ?f"
-    by blast
-next  
-  show "\<forall>s. s @ [tick] \<in> ?d \<longrightarrow> s \<in> ?d"  
-    apply auto
-       apply (metis butlast_append butlast_snoc front_tickFree_charn non_tickFree_tick 
-       tickFree_append tickFree_implies_front_tickFree)
-      apply (metis butlast_append butlast_snoc front_tickFree_charn non_tickFree_tick 
-      tickFree_append tickFree_implies_front_tickFree) 
-     apply (metis D_T append.right_neutral front_tickFree_Nil is_processT3_ST is_processT9 
-     SyncWithTick_imp_NTF) 
-    by (metis D_T append.right_neutral front_tickFree_Nil is_processT3_ST is_processT9 
-    SyncWithTick_imp_NTF) 
 qed
 
-lemmas  Rep_Abs_Sync[simp] = Abs_process_inverse[simplified, OF Sync_maintains_is_process]
-
-subsection\<open>Projections\<close>
+subsection\<open>The Projections\<close>
 
 lemma
   F_Sync    : "\<F> (P \<lbrakk> A \<rbrakk> Q) = 
                    {(s,R).\<exists> t u X Y. (t,X) \<in> \<F> P \<and> 
                                        (u,Y) \<in> \<F> Q \<and> 
                                        s setinterleaves ((t,u),(ev`A) \<union> {tick}) \<and> 
                                        R = (X \<union> Y) \<inter> ((ev`A) \<union> {tick}) \<union> X \<inter> Y} \<union> 
                    {(s,R).\<exists> t u r v. front_tickFree v \<and> 
                                        (tickFree r \<or> v=[]) \<and> 
                                        s = r@v \<and> 
                                        r setinterleaves ((t,u),(ev`A)\<union>{tick}) \<and> 
                                        (t \<in> \<D> P \<and> u \<in> \<T> Q \<or> t \<in> \<D> Q \<and> u \<in> \<T> P)}"
-       
-       
-  unfolding Sync_def 
-  apply(subst Failures_def) 
-  apply(simp only: Rep_Abs_Sync) 
-  by(auto simp: FAILURES_def)
-   
+  by (simp add: Failures.rep_eq Sync.rep_eq FAILURES_def)   
 
 lemma
   D_Sync    : "\<D> (P \<lbrakk> A \<rbrakk> Q) = 
                    {s.    \<exists> t u r v. front_tickFree v \<and> (tickFree r \<or> v=[]) \<and> 
                             s = r@v \<and> r setinterleaves ((t,u),(ev`A) \<union> {tick}) \<and> 
                             (t \<in> \<D> P \<and> u \<in> \<T> Q \<or> t \<in> \<D> Q \<and> u \<in> \<T> P)}"
-
-  unfolding Sync_def
-  apply(subst D_def)
-  apply(simp only: Rep_Abs_Sync)
-  by(simp add: DIVERGENCES_def)
+  by (simp add: Divergences.rep_eq Sync.rep_eq DIVERGENCES_def)   
  
 
 lemma
   T_Sync    : "\<T> (P \<lbrakk> A \<rbrakk> Q) = 
                    {s.    \<exists> t u. t \<in> \<T> P \<and> u \<in> \<T> Q \<and> 
                                  s setinterleaves ((t,u),(ev`A) \<union> {tick})}\<union>
                    {s.    \<exists> t u r v. front_tickFree v \<and> (tickFree r \<or> v=[]) \<and> 
                                  s = r@v \<and> r setinterleaves ((t,u),(ev`A) \<union> {tick}) \<and> 
                                  (t \<in> \<D> P \<and> u \<in> \<T> Q \<or> t \<in> \<D> Q \<and> u \<in> \<T> P)}"
-
-  unfolding Sync_def
-  apply(subst Traces_def, simp only: Rep_Abs_Sync, simp add:TRACES_def FAILURES_def)
-  apply auto 
-   apply (meson F_T)
-  using T_F by blast
+  by (simp add: Traces.rep_eq TRACES_def Failures.rep_eq[symmetric] F_Sync) blast
+  
   
 subsection\<open>Syntax for Interleave and Parallel Operator \<close>
 
 abbreviation Inter_syntax  ("(_|||_)" [72,73] 72)
   where "P ||| Q \<equiv> (P \<lbrakk> {} \<rbrakk> Q)"
 
 abbreviation Par_syntax  ("(_||_)" [74,75] 74)
   where "P || Q  \<equiv> (P \<lbrakk> UNIV \<rbrakk> Q)"
 
 subsection\<open> Continuity Rule \<close>
 
 lemma mono_Sync_D1:  
 "P \<sqsubseteq> Q \<Longrightarrow> \<D> (Q \<lbrakk> A \<rbrakk> S) \<subseteq> \<D> (P \<lbrakk> A \<rbrakk> S)"
   apply(auto simp: D_Sync)
   using le_approx1 apply blast
   using le_approx_lemma_T apply blast
    apply (metis append_Nil2 le_approx1 subsetCE tickFree_Nil tickFree_implies_front_tickFree) 
   by (metis append_Nil2 le_approx_lemma_T subsetCE tickFree_Nil tickFree_implies_front_tickFree)
 
 lemma mono_Sync_D2:
 "P \<sqsubseteq> Q\<Longrightarrow>(\<forall> s. s \<notin> \<D> (P  \<lbrakk> A \<rbrakk>  S) \<longrightarrow> Ra (P  \<lbrakk> A \<rbrakk>  S) s = Ra (Q  \<lbrakk> A \<rbrakk>  S) s)"
   apply auto 
    apply(simp add: Ra_def D_Sync F_Sync)
    apply (metis (no_types, lifting) F_T append_Nil2 front_tickFree_Nil le_approx2)
   apply(simp add: Ra_def D_Sync F_Sync)
   apply(insert le_approx_lemma_F[of P Q] le_approx_lemma_T[of P Q]  
                le_approx1[of P Q] le_approx2T[of P Q], auto) 
       apply blast
      apply blast
     apply blast
   using front_tickFree_Nil apply blast
   using front_tickFree_Nil by blast
 
 lemma interPrefixEmpty: "s setinterleaves ((t,[]),A)\<and>t1<t\<Longrightarrow>\<exists>s1<s. s1 setinterleaves ((t1, []), A)"
   by (metis (no_types, lifting) Sync.sym emptyLeftProperty le_list_def nil_le2 
   order.strict_implies_order synPrefix1)
 
 lemma interPrefix:"\<exists>u1 s1. s setinterleaves((t,u),A)\<and>t1<t\<longrightarrow>u1\<le>u\<and>s1<s\<and>s1 setinterleaves((t1,u1),A)"
 proof (induction "length t + length u" arbitrary:s t u t1 rule:nat_less_induct)
   case 1
   then show ?case 
     apply(cases t)
      apply auto[1]
     apply(cases u)   
      apply (meson interPrefixEmpty nil_le2)   
   proof- 
     fix a list aa lista 
     assume a: " \<forall>m<length t + length u.  \<forall>x xa. m = length x + length xa \<longrightarrow> (\<forall>xb xc. \<exists>u1 s1. 
     xb setinterleaves((x, xa),A)\<and>xc < x \<longrightarrow> u1 \<le> xa \<and> s1 < xb \<and> s1 setinterleaves ((xc, u1), A))"
     and b: "t = a # list"
     and c: "u = aa # lista"
     thus "\<exists>u1 s1. s setinterleaves((t, u),A)\<and>t1<t\<longrightarrow>u1 \<le>u\<and>s1<s\<and>s1 setinterleaves ((t1, u1), A)"  
     proof-
       from b c have th0pre: "a=aa\<and>aa\<in> A\<Longrightarrow>s setinterleaves ((t, u), A) \<Longrightarrow>
       (tl s) setinterleaves ((list,lista), A)" by auto    
       from a obtain yu ys  
         where th0pre1: "a=aa\<and>aa\<in> A \<and> s setinterleaves ((t, u), A)\<and> t1 < a # list \<and> length t1>0
                         \<Longrightarrow> yu \<le> lista \<and> ys<tl s \<and> ys setinterleaves ((tl t1, yu), A)"    
         apply (simp add: le_list_def less_list_def append_eq_Cons_conv) 
         by (metis add_less_mono b c length_Cons lessI list.sel(3) th0pre)        
       from th0pre th0pre1  b c 
       have th0pre2: "a=aa \<and> aa\<in>A
                      \<Longrightarrow> s setinterleaves ((a # list, u), A) \<and> t1<a#list\<and>length t1>0
                      \<Longrightarrow> (a#ys)setinterleaves((a#tl t1, a#yu), A)\<and>a#ys<s\<and>a#yu\<le>u\<and>t1=a#tl t1"   
         apply (simp add: le_list_def less_list_def  Cons_eq_append_conv)  
         by (metis append_Cons list.exhaust_sel list.inject list.sel(3))
       have th0pre3: "a=aa\<and>aa\<in>A\<Longrightarrow>s setinterleaves ((a # list, u), A)\<and>t1 < a # list\<and>length t1=0\<Longrightarrow>
       []<s\<and>[]\<le>u\<and> [] setinterleaves ((t1, []), A)"  
         apply (simp add: le_list_def less_list_def) using c by auto
       from  th0pre2 th0pre3 c  have th0 : "a=aa\<and>aa\<in>A\<Longrightarrow>s setinterleaves ((a # list, u), A)\<and> 
       t1 < a # list\<Longrightarrow>\<exists>u1\<le>u. \<exists>s1<s. s1 setinterleaves ((t1, u1), A)"  by fastforce
       from b c have th1pre: "a\<notin>A\<and>aa\<in> A\<Longrightarrow>s setinterleaves ((a # list, u), A) \<Longrightarrow>
       (tl s) setinterleaves ((list,aa#lista), A)" by auto
       from a obtain yu1 ys1  where th1pre1: "a\<notin>A\<and>aa\<in> A\<and>s setinterleaves ((a # list, u), A)\<and> 
       t1 < a # list\<and>length t1>0\<Longrightarrow>yu1\<le>u\<and>ys1<tl s\<and>ys1 setinterleaves ((tl t1, yu1), A)"  
         apply (simp add: le_list_def less_list_def append_eq_Cons_conv)  
         by (metis add_Suc b c length_Cons lessI list.sel(3) th1pre)
       from th1pre1 have th1pre2: "a\<notin>A\<and>aa\<in> A \<and> ys1 setinterleaves ((tl t1, yu1), A)\<Longrightarrow>
       (a#ys1) setinterleaves ((a#tl t1, yu1), A)" apply simp  
         by (metis (mono_tags, lifting) addNonSync doubleReverse rev.simps(2) rev_rev_ident)
       from th1pre th1pre1  b c have th1pre3: "a\<notin>A\<and>aa\<in> A\<Longrightarrow>s setinterleaves ((a # list, u), A)\<and> 
       t1<a#list\<and>length t1>0\<Longrightarrow>(a#ys1) setinterleaves ((a#tl t1, yu1), A)\<and>a#ys1<s\<and>yu1\<le>u\<and>t1=a#tl t1"  
         apply (simp add: le_list_def less_list_def )  
         by (metis append_Cons list.exhaust_sel list.inject list.sel(3) th1pre2)
       have th1preEmpty: "a\<notin>A\<and>aa\<in> A\<Longrightarrow>s setinterleaves ((a # list, u), A)\<and>t1 < a # list\<and>length t1=0
       \<Longrightarrow>[]<s\<and>[]\<le>u\<and> [] setinterleaves ((t1, []), A)" apply (simp add: le_list_def less_list_def) 
         using c by auto
       from c have th1: "a\<notin>A\<and>aa\<in> A\<Longrightarrow>s setinterleaves ((a # list, u), A)\<and>t1 < a # list\<Longrightarrow>
       \<exists>u1\<le>u. \<exists>s1<s. s1 setinterleaves ((t1, u1), A)"   using th1pre3 th1preEmpty by fastforce
       from b c have th2pre: "aa\<notin>A\<and>a\<in> A\<Longrightarrow>s setinterleaves ((a # list, u), A) \<Longrightarrow>
       (tl s) setinterleaves ((a#list,lista), A)" by auto
       from a  th2pre obtain yu2 ys2  where th2pre1: "aa\<notin>A\<and>a\<in> A\<and>s setinterleaves ((a # list, u), A)\<and> 
       t1 < a # list\<and>length t1>0\<Longrightarrow>yu2\<le>lista\<and>ys2<tl s\<and>ys2 setinterleaves ((t1, yu2), A)"  
         apply (simp add: le_list_def less_list_def)   
         by (metis add_Suc_right b c length_Cons lessI)    
       from th2pre1 have th2pre2: "aa\<notin>A\<and>a\<in> A \<and> ys2 setinterleaves ((t1, yu2), A)\<Longrightarrow>
       (aa#ys2) setinterleaves ((t1, aa#yu2), A)" apply simp  
         by (metis (mono_tags, lifting) addNonSync doubleReverse rev.simps(2) rev_rev_ident)
       from th2pre th2pre1  b c have th2pre3: "aa\<notin>A\<and>a\<in> A \<Longrightarrow>s setinterleaves ((a # list, u), A)\<and> 
       t1 < a # list\<and>length t1>0\<Longrightarrow>(aa#ys2) setinterleaves ((t1, aa#yu2), A)\<and>aa#ys2<s\<and>aa#yu2\<le>u"  
         apply (simp add: le_list_def less_list_def )  using th2pre2 by auto
       have th2preEmpty: "aa\<notin>A\<and>a\<in> A\<Longrightarrow>s setinterleaves ((a # list, u), A)\<and>t1 < a # list\<and>length t1=0
       \<Longrightarrow>[]<s\<and>[]\<le>u\<and> [] setinterleaves ((t1, []), A)" apply (simp add: le_list_def less_list_def) 
         using c by auto
       from th2pre3 b c have th2: "aa\<notin>A\<and>a\<in> A\<Longrightarrow>s setinterleaves ((a # list, u), A)\<and>t1 < a # list\<Longrightarrow>
       \<exists>u1\<le>u. \<exists>s1<s. s1 setinterleaves ((t1, u1), A)"  
         using th2preEmpty by blast
       from b c have th3pre: "aa\<notin>A\<and>a\<notin> A\<Longrightarrow>s setinterleaves ((a # list, u), A) \<Longrightarrow>
       (tl s) setinterleaves ((a#list,lista), A)\<and>hd s=aa\<or>(tl s) setinterleaves ((list,u), A)\<and>hd s=a" 
         by auto
       from a c b th3pre obtain yu3 ys3  where th3pre1: "(aa\<notin>A\<and>a\<notin> A\<and>s setinterleaves 
       ((a # list, u), A)\<and> t1 < a # list\<and>length t1>0\<and>(tl s) setinterleaves ((a#list,lista), A)\<longrightarrow>
       yu3\<le>lista\<and>ys3<tl s\<and>ys3 setinterleaves((t1,yu3),A))" apply(simp add:le_list_def less_list_def) 
         by (metis (no_types, lifting) add_Suc length_Cons lessI) 
       have adsmallPrefix: "t1<a # list\<and>length t1>0\<Longrightarrow>tl t1<list"  
         using less_tail by fastforce
       from a b c th3pre adsmallPrefix obtain yu30 ys30   where th3pre12: "(aa\<notin>A\<and>a\<notin> A\<Longrightarrow>
       (tl s) setinterleaves ((list,u), A)\<and>hd s=a\<and>tl t1< list\<longrightarrow>yu30\<le>u\<and>ys30<tl s\<and>
       ys30 setinterleaves ((tl t1, yu30), A))" apply (simp add: le_list_def less_list_def)  
         by (metis (no_types, lifting) add_Suc_right length_Cons lessI)  
       have th3pre1more1: "yu3\<le>lista \<Longrightarrow>aa#yu3\<le>u " using c  
         by (metis le_less less_cons)
       have th3pre1more2: "aa\<notin>A\<and>a\<notin> A\<and>s setinterleaves ((a # list, aa#lista), A) \<and>
       (tl s) setinterleaves ((a#list,lista), A)\<and>hd s=aa\<and>ys3<tl s \<Longrightarrow>aa#ys3<s " using c 
         by (metis less_cons list.exhaust_sel list.sel(2) nil_less)
       have  th3pre1more21: "aa \<notin> A \<and>a \<notin> A \<and> ys3<tl s\<and>ys3 setinterleaves ((t1, yu3), A) \<and> 
       hd s = aa \<longrightarrow>(aa # ys3) setinterleaves ((t1, aa # yu3), A)"
         by (metis (mono_tags, lifting) addNonSync doubleReverse rev.simps(2) rev_rev_ident)
       from th3pre1more1 th3pre1more2 th3pre1more21 th3pre1 have th3pre1more3: "(aa\<notin>A\<and>a\<notin> A\<and>
       s setinterleaves ((a # list, u), A)\<and> t1 < a # list\<and>length t1>0\<and>(tl s) setinterleaves 
       ((a#list,lista), A)\<and>hd s=aa\<longrightarrow>aa#yu3\<le>u\<and>aa#ys3<s\<and>(aa#ys3) setinterleaves ((t1, aa#yu3), A))" 
         using c by blast     
       have th3pre1more32: "aa\<notin>A\<and>a\<notin> A\<and>s setinterleaves ((a # list, aa#lista), A) \<and>
       (tl s) setinterleaves ((list,aa#lista), A)\<and>hd s=a\<and>ys30<tl s \<Longrightarrow>a#ys30<s " using c 
         by (metis less_cons list.exhaust_sel list.sel(2) nil_less)
       have  th3pre1more213: "aa \<notin> A \<and>a \<notin> A \<and> ys30<tl s\<and>ys30 setinterleaves ((tl t1, yu30), A) \<and> 
       hd s = a \<and>t1<a#list\<longrightarrow>(a # ys30) setinterleaves ((a#tl t1, yu30), A)"  
         by (metis (mono_tags, lifting) addNonSync doubleReverse rev.simps(2) rev_rev_ident)
       from  th3pre1more32 th3pre12 th3pre1more213 have th3pre1more33: "(aa\<notin>A\<and>a\<notin> A\<and>s setinterleaves 
       ((a # list, u), A)\<and> t1 < a # list\<and>length t1>0\<and>(tl s) setinterleaves ((list,aa#lista), A)\<and>
       hd s=a\<longrightarrow>yu30\<le>u\<and>a#ys30<s\<and>(a#ys30) setinterleaves ((t1, yu30), A))" 
         by (metis adsmallPrefix c hd_append2 le_list_def length_greater_0_conv list.exhaust_sel 
         list.sel(1) order.strict_implies_order)  
       from th3pre1more3 th3pre1more33 b c th3pre  have th3NoEmpty: "aa\<notin>A\<and>a\<notin> A\<Longrightarrow>s setinterleaves 
       ((a # list, u), A)\<and>t1 < a # list\<and>length t1>0\<Longrightarrow>\<exists>u1\<le>u. \<exists>s1<s. s1 setinterleaves ((t1, u1), A)" 
         apply (simp add: le_list_def less_list_def)  
         by (metis append.simps(2))   
       have th3preEmpty: "aa\<notin>A\<and>a\<notin> A\<Longrightarrow>s setinterleaves ((a # list, u), A)\<and>t1 < a # list\<and>length t1=0
       \<Longrightarrow>[]<s\<and>[]\<le>u\<and> [] setinterleaves ((t1, []), A)"
         apply (simp add: le_list_def less_list_def) using c by auto    
       from th3NoEmpty th3preEmpty have th3: "aa\<notin>A\<and>a\<notin> A\<Longrightarrow>s setinterleaves ((a # list, u), A)\<and>t1 < 
       a # list\<Longrightarrow>\<exists>u1\<le>u. \<exists>s1<s. s1 setinterleaves ((t1, u1), A)" 
         by blast      
       show?thesis  
         using b c th0 th1 th2 th3 by auto
     qed 
   qed  
 qed
 
 lemma mono_Sync2a:
    "r\<in>min_elems(\<D> (P \<lbrakk>A\<rbrakk> S))
    \<Longrightarrow> \<exists>t u. r setinterleaves ((t, u),insert tick (ev ` A)) \<and>
              (t \<in> min_elems(\<D> P) \<and> u \<in> \<T> S \<or> t \<in> min_elems(\<D> S) \<and> 
              u \<in> \<T> P \<and> u \<in> (\<T> P - (\<D> P-min_elems(\<D> P))))" 
 proof- 
   fix r
   assume A: "r \<in> min_elems(\<D> (P  \<lbrakk>A\<rbrakk> S))"
   thus "\<exists>t u. r setinterleaves ((t, u), insert tick (ev ` A))\<and>(t \<in> min_elems(\<D> P) \<and> 
               u \<in> \<T> S \<or> t \<in> min_elems(\<D> S) \<and> u \<in> \<T> P \<and> u \<in> (\<T> P - (\<D> P-min_elems(\<D> P))))" 
   proof(cases "\<forall>t u r1. r1\<le>r\<and> r1 setinterleaves((t, u),insert tick (ev ` A))
                         \<longrightarrow> (t \<notin> min_elems(\<D> P)) \<and> (t \<notin> min_elems(\<D> S))")
     case True
     from A have AA: "r \<in> \<D> (P  \<lbrakk>A\<rbrakk> S)"  
       using elem_min_elems by blast
     from AA obtain t1 u1 where A1: 
                    "\<exists>r1\<le>r. r1 setinterleaves ((t1, u1), insert tick (ev ` A)) \<and>
                               (t1 \<in> \<D> P \<or> t1 \<in> \<D> S)" apply(simp add: D_Sync) 
                               using le_list_def by blast
     from True A1 have A2: "(t1 \<notin> min_elems(\<D> P)) \<and> (t1 \<notin> min_elems(\<D> S))"  
       by blast
     from A1 A2 min_elems5 obtain tm1 tm2 
       where tmA: "(t1\<in>\<D> P \<longrightarrow> 
                   (tm1\<le>t1\<and>tm1\<in> min_elems(\<D> P))) \<and> (t1\<in>\<D> S\<longrightarrow>(tm2\<le>t1\<and>tm2\<in> min_elems(\<D> S)))"  
       by metis
     from A2 tmA have AB1: "(t1\<in>\<D> P\<longrightarrow>tm1<t1)\<and>(t1\<in>\<D> S\<longrightarrow>tm2<t1)" 
       by (metis A1 order.not_eq_order_implies_strict)
     from A1 AB1 obtain um1 rm1 um2 rm2 where AB2: " (t1\<in>\<D> P\<longrightarrow>um1\<le>u1 \<and> rm1 setinterleaves 
     ((tm1, um1),insert tick (ev ` A)))\<and>(t1\<in>\<D> S\<longrightarrow>um2\<le>u1 \<and> rm2 setinterleaves 
     ((tm2, um2), insert tick (ev ` A)))" by (meson interPrefix)     
     from A1 A2 True tmA AB1 have A3: "(t1\<in>\<D> P\<longrightarrow>rm1<r\<and>rm1\<in>\<D>(P\<lbrakk>A\<rbrakk>S))\<and>(t1\<in>\<D> S\<longrightarrow>rm2<r\<and>rm2\<in> \<D>(P\<lbrakk>A\<rbrakk>S))"  
       by (meson dual_order.strict_implies_order interPrefix order_trans) 
     from A3 AA have ATrue: "r \<notin> min_elems(\<D> (P  \<lbrakk>A\<rbrakk> S))" using min_elems_def  
       using A1 by blast   
     with A ATrue show ?thesis 
       by blast 
   next
     case False
     from A have dsync: "r\<in>\<D> (P \<lbrakk>A\<rbrakk> S)"  
       by (simp add: local.A elem_min_elems)
     from dsync obtain r1 t2 u2 
       where C: "r1\<le>r\<and> r1 setinterleaves ((t2, u2), insert tick (ev ` A)) \<and>
                ((t2 \<in> \<D> P \<and> u2 \<in> \<T> S) \<or> (t2 \<in> \<D> S \<and> u2 \<in> \<T> P))" 
                apply(simp add: D_Sync)  
                using le_list_def by blast
     from C have r1D: "r1 \<in> \<D> (P \<lbrakk>A\<rbrakk> S)" apply(simp add: D_Sync)  
       using front_tickFree_Nil by blast
     from A C r1D have eq: "r1=r" apply(simp add: min_elems_def) 
       using le_neq_trans by blast
     from A False have minAa: "(t2 \<in> \<D> P\<and>u2\<in>\<T> S)\<longrightarrow>(t2 \<in> min_elems(\<D> P))"  
     proof(cases "t2 \<in> \<D> P \<and>u2 \<in> \<T> S\<and> t2 \<notin> min_elems(\<D> P)")
       case True
       from True obtain t3 where inA: "t3<t2\<and>t3\<in>min_elems(\<D> P)" 
         by (metis le_imp_less_or_eq min_elems5)
       from inA obtain r3 u3 where inA1: "u3\<le>u2\<and>r3 setinterleaves((t3,u3),insert tick(ev ` A))\<and>r3<r"  
         using C eq interPrefix by blast 
       from inA1 have inA3: "u3 \<in> \<T> S"  
         using True is_processT3_ST_pref by blast
       from inA1 have inA2: "r3 \<in> \<D>(P \<lbrakk>A\<rbrakk> S)" apply (simp add: D_Sync)  
         using elem_min_elems front_tickFree_Nil inA inA3 by blast 
       with A eq inA1 show ?thesis 
         by(simp add: min_elems_def) 
     next
       case False
       then show ?thesis 
         by blast
     qed
     from A False have minAb1: "(t2 \<in> \<D> S\<and>u2\<in> \<T> P)\<longrightarrow>(t2 \<in> min_elems(\<D> S))"  
     proof(cases "t2 \<in> \<D> S \<and> u2 \<in> \<T> P\<and> t2 \<notin> min_elems(\<D> S)")
       case True
       from True obtain t3 r3 u3 where inA: "t3<t2\<and>t3\<in>min_elems(\<D> S)" 
       and inA1: "u3\<le>u2\<and>r3 setinterleaves ((t3, u3), insert tick (ev ` A))\<and>r3<r"
         by (metis C eq interPrefix le_less min_elems5)
       from inA1 have inA3: "u3 \<in> \<T> P"  
         using True is_processT3_ST_pref by blast
       from inA1 have inA2: "r3 \<in> \<D> (P \<lbrakk>A\<rbrakk> S)" apply (simp add: D_Sync)  
         using elem_min_elems front_tickFree_Nil inA inA3 by blast 
       with A eq inA1 show ?thesis 
         by(simp add: min_elems_def)
     next
       case False
       then show ?thesis 
         by blast
     qed
     from A False have minAb2: "(t2 \<in> \<D> S\<and>u2\<in> \<T> P)\<longrightarrow>(u2 \<in> (\<T> P-(\<D> P-min_elems(\<D> P))))" 
     proof(cases "t2 \<in> \<D> S \<and>u2 \<in> \<T> P\<and> u2 \<in>(\<D> P-min_elems(\<D> P))")
       case True
       from True have inAAA: "u2\<in>\<D> P\<and>u2\<notin>min_elems(\<D> P)" 
         by blast
       from inAAA obtain u3  where inA: "u3<u2\<and>u3\<in>min_elems(\<D> P)"  
         by (metis le_neq_trans min_elems5) 
       from inA obtain t3 r3 where inA1: "t3\<le>t2\<and>r3 setinterleaves((t3,u3),insert tick(ev ` A))\<and>r3<r"  
         using C Sync.sym eq interPrefix by blast
       from inA1 have inA3: "u3 \<in> \<D> P\<and>t3 \<in> \<T> S"  
         using D_T True elem_min_elems inA is_processT3_ST_pref by blast 
       from inA1 have inA2: "r3 \<in> \<D> (P \<lbrakk>A\<rbrakk> S)" apply (simp add: D_Sync)  
         using Sync.sym front_tickFree_Nil inA3 by blast  
       with A inA1 inA2 show ?thesis 
         by(simp add: min_elems_def)
     next
       case False
       then show ?thesis 
         by blast
     qed
     with A C show ?thesis   
       using eq minAa minAb1 by blast  
   qed
 qed
  
 lemma mono_Sync_D3: 
   assumes ordered: "P \<sqsubseteq> Q" 
   shows "min_elems (\<D> (P \<lbrakk>A\<rbrakk> S)) \<subseteq> \<T>(Q \<lbrakk>A\<rbrakk> S)" 
 proof- 
   have mono_sync2b:"P \<sqsubseteq> Q \<Longrightarrow> \<forall>r. r \<in> min_elems(\<D> (P\<lbrakk>A\<rbrakk>S))\<longrightarrow>r \<in> \<T>(Q\<lbrakk>A\<rbrakk>S)" 
     apply(frule impI)
     apply(auto simp: mono_Sync2a) 
   proof - 
     fix r
     assume A: "P \<sqsubseteq> Q"
     and B: "r \<in> min_elems(\<D>(P\<lbrakk>A\<rbrakk>S))" 
     from B obtain t u 
       where E: "r setinterleaves ((t, u), insert tick (ev ` A)) \<and> (t \<in> min_elems(\<D> P)  \<and>
                 u \<in> \<T> S \<or> t \<in> min_elems(\<D> S) \<and> u \<in> (\<T> P-(\<D> P - min_elems(\<D> P))))" 
                using mono_Sync2a  by blast
     from E have F:"(t \<in> \<T> Q \<and> u \<in> \<T> S) \<or> (t \<in> \<T> S \<and> u \<in> \<T> Q)"  
       using le_approx2T le_approx3 ordered by blast     
     thus "r \<in> \<T> (Q \<lbrakk>A\<rbrakk> S)"  
       by (metis (no_types, lifting) E Sync.sym T_Sync UnCI Un_commute insert_is_Un mem_Collect_eq) 
   qed 
   show ?thesis 
     apply(insert ordered) 
     apply(frule mono_sync2b) 
     by blast
 qed
 
 lemma mono_D_Sync: "\<D> (S \<lbrakk> A \<rbrakk> Q) = \<D> (Q \<lbrakk> A \<rbrakk> S)"
   by(auto simp: D_Sync)
 
 lemma mono_T_Sync: "\<T> (S \<lbrakk> A \<rbrakk> Q) = \<T> (Q \<lbrakk> A \<rbrakk> S)"
   apply(auto simp: T_Sync)  
   using Sync.sym by fastforce+
    
 
 lemma mono_F_Sync: "\<F> (S \<lbrakk> A \<rbrakk> Q)  = \<F> (Q \<lbrakk> A \<rbrakk> S) "
   apply auto  
    apply (simp add: F_Sync)
   using Sync.sym apply blast
   apply (simp add: F_Sync)
   using Sync.sym by blast
 
 lemma mono_Ra_Sync: "Ra (S \<lbrakk> A \<rbrakk> Q) s = Ra (Q \<lbrakk> A \<rbrakk> S) s"
   apply auto
    apply (auto simp: Ra_def)
   by (auto simp: mono_F_Sync)
 
 lemma mono_Sync[simp]     : "P \<sqsubseteq> Q \<Longrightarrow> (P \<lbrakk> A \<rbrakk> S) \<sqsubseteq> (Q \<lbrakk> A \<rbrakk> S)"
   by(auto simp: le_approx_def mono_Sync_D1 mono_Sync_D2 mono_Sync_D3)
 
 lemma mono_Sync_sym [simp]: "P \<sqsubseteq> Q \<Longrightarrow> (S \<lbrakk> A \<rbrakk> P) \<sqsubseteq> (S \<lbrakk> A \<rbrakk> Q)"
   by (metis Process_eq_spec mono_D_Sync mono_F_Sync mono_Sync)
 
 lemma chain_Sync1: "chain Y \<Longrightarrow> chain (\<lambda>i. Y i  \<lbrakk> A \<rbrakk> S)"
   by(simp add: chain_def) 
 
 lemma chain_Sync2: "chain Y \<Longrightarrow> chain (\<lambda>i. S  \<lbrakk> A \<rbrakk> Y i)"
   by(simp add: chain_def)
 
 lemma empty_setinterleaving : "[] setinterleaves ((t, u), A) \<Longrightarrow> t = []"  
   by (cases t, cases u, auto, cases u, simp_all split:if_splits) 
 
 lemma inters_fin_fund: "finite{(t, u). s setinterleaves ((t, u), A)}"
 proof (induction "length s" arbitrary:s rule:nat_less_induct)
   case 1
   have A:"{(t, u). s setinterleaves((t, u), A)} \<subseteq> {([],[])} \<union> 
                    {(t, u). s setinterleaves ((t, u), A) \<and> 
                             (\<exists> a list. t = a#list  \<and> a \<notin> A) \<and> u = []} \<union> 
                    {(t, u). s setinterleaves ((t, u), A) \<and> 
                             (\<exists> a list. u = a#list \<and> a \<notin> A) \<and> t = []} \<union> 
                    {(t, u). s setinterleaves ((t, u), A) \<and> 
                             (\<exists> a list aa lista. u = a#list \<and> t = aa#lista)}" 
            (is "?A \<subseteq> {([],[])} \<union> ?B \<union> ?C \<union> ?D") 
     apply (rule subsetI, safe)
           apply(simp_all add: neq_Nil_conv)   
          apply (metis Sync.si_empty2 Sync.sym empty_iff list.exhaust_sel)
         using list.exhaust_sel apply blast
        apply (metis Sync.sym emptyLeftNonSync list.exhaust_sel list.set_intros(1))    
       using list.exhaust_sel apply blast
      apply (metis emptyLeftNonSync list.exhaust_sel list.set_intros(1))
     by (metis Sync.si_empty2 Sync.sym empty_iff list.exhaust_sel)
   have a1:"?B \<subseteq> { ((hd s#list), [])| list. (tl s) setinterleaves ((list, []), A) \<and> (hd s) \<notin> A}" 
   (is "?B  \<subseteq> ?B1") by auto
   define f where a2:"f = (\<lambda>a (t, (u::'a event list)). ((a::'a event)#t, ([]::'a event list)))"
   have a3:"?B1 \<subseteq> {(hd s # list, []) |list. tl s setinterleaves ((list, []), A)} " (is "?B1  \<subseteq> ?B2") 
     by blast
   from a1 a3 have a13:"?B \<subseteq> ?B2" 
     by simp
   have AA: "finite ?B" 
   proof (cases s)
     case Nil
     then show ?thesis 
       using not_finite_existsD by fastforce
   next
     case (Cons a list)
     hence aa:"finite{(t,u).(tl s) setinterleaves((t, u), A)}"using 1[THEN spec, of "length (tl s)"] 
       by (simp)
     have "{(hd s#list, [])|list. tl s setinterleaves((list,[]),A)}\<subseteq>(\<lambda>(t, u).f(hd s)(t, u)) `{(t, u). 
     tl s setinterleaves ((t, u), A)}" using a2 by auto
     hence "finite ?B2" using finite_imageI [of "{(t, u). (tl s) setinterleaves ((t, u), A)}" 
     "\<lambda>(t, u). f (hd s) (t, u)", OF aa] using rev_finite_subset by auto 
     then show ?thesis using a13 
       by (meson rev_finite_subset)
   qed
   have a1:"?C \<subseteq> { ([],(hd s#list))| list. (tl s) setinterleaves (([],list), A) \<and> (hd s) \<notin> A}" 
   (is "?C  \<subseteq> ?C1") by auto
   define f where a2:"f = (\<lambda>a ((t::'a event list), u). (([]::'a event list), (a::'a event)#u))"
   have a3:"?C1 \<subseteq> {([],hd s # list) |list. tl s setinterleaves (([],list), A)} " (is "?C1  \<subseteq> ?C2") 
     by blast
   from a1 a3 have a13:"?C \<subseteq> ?C2" 
     by simp
   have AAA:"finite ?C"
   proof (cases s)
     case Nil
     then show ?thesis 
       using not_finite_existsD by fastforce
   next
     case (Cons a list)
     hence aa:"finite {(t,u).(tl s)setinterleaves((t, u), A)}"using 1[THEN spec, of "length (tl s)"] 
       by (simp)
     have "{([], hd s # list) |list. tl s setinterleaves (([], list), A)} \<subseteq> (\<lambda>(t, u). 
     f (hd s) (t, u)) ` {(t, u). tl s setinterleaves ((t, u), A)}" using a2 by auto
     hence "finite ?C2" using finite_imageI [of "{(t, u). (tl s) setinterleaves ((t, u), A)}" 
     "\<lambda>(t, u). f (hd s) (t, u)", OF aa] using rev_finite_subset by auto 
     then show ?thesis using a13 
       by (meson rev_finite_subset)
   qed
   have dd0:"?D \<subseteq> {(a#l, aa#la)|a aa l la. s setinterleaves ((a#l, aa#la), A)}" (is "?D \<subseteq> ?D1")
     apply (rule subsetI, auto, simp split:if_splits) 
     by (blast, blast, metis, blast)
   have AAAA:"finite ?D" 
   proof (cases s)
     case Nil
     hence "?D \<subseteq> {([],[])}" 
       using empty_setinterleaving by auto
     then show ?thesis 
       using infinite_super by auto
   next
     case (Cons a list)
     hence dd1:"?D1 \<subseteq> {(a#l, u)| l u. list setinterleaves ((l, u), A)} 
                 \<union> {(t, a#la)| t la. list setinterleaves ((t, la), A)} 
                 \<union> {(a#l, a#la)|l la. list setinterleaves ((l, la), A)}"(is "?D1 \<subseteq> ?D2 \<union> ?D3 \<union> ?D4") 
       by (rule_tac subsetI, auto split:if_splits)
     with Cons have aa:"finite {(t,u). list setinterleaves ((t, u), A)}" 
       using 1[THEN spec, of "length list"] by (simp)
     define f where a2:"f = (\<lambda> (t, (u::'a event list)). ((a::'a event)# t, u))" 
     with Cons have "?D2 \<subseteq> (f ` {(t, u). list setinterleaves ((t, u), A)})" 
       using a2 by auto
     hence dd2:"finite ?D2"
       using finite_imageI [of "{(t, u). list setinterleaves ((t, u), A)}" f, OF aa]
       by (meson rev_finite_subset)
     define f where a2:"f = (\<lambda> ((t::'a event list),u). (t,(a::'a event)#u))" 
     with Cons have "?D3 \<subseteq> (f ` {(t, u). list setinterleaves ((t, u), A)})" 
       using a2 by auto
     hence dd3:"finite ?D3"       
       using finite_imageI [of "{(t, u). list setinterleaves ((t, u), A)}" f, OF aa]
       by (meson rev_finite_subset) 
     define f where a2:"f = (\<lambda> (t,u). ((a::'a event)#t,(a::'a event)#u))" 
     with Cons have "?D4 \<subseteq> (f ` {(t, u). list setinterleaves ((t, u), A)})" 
       using a2 by auto
     hence dd4:"finite ?D4"
       using finite_imageI [of "{(t, u). list setinterleaves ((t, u), A)}" f, OF aa]
       by (meson rev_finite_subset)       
     with dd0 dd1 dd2 dd3 dd4 show ?thesis 
       by (simp add: finite_subset) 
   qed    
   from A AA AAA AAAA show ?case 
     by (simp add: finite_subset)    
 qed
 
 lemma inters_fin: "finite{(t, u, r). r setinterleaves ((t, u), insert tick (ev ` A)) \<and> 
                                      (\<exists>v. x = r @ v \<and> front_tickFree v \<and> (tickFree r \<or> v = []))}" 
                   (is "finite ?A")
 proof -
   have a:"?A\<subseteq>(\<Union>r \<in> {r. r \<le> x}. {a. \<exists>t u. a=(t,u,r)\<and>r setinterleaves((t,u),insert tick(ev ` A))})" 
   (is "?A \<subseteq> (\<Union>r \<in> {r. r \<le> x}. ?P r)")
     using le_list_def by fastforce
   have b:"\<forall>(r::'a event list). finite (?P r)"
   proof(rule allI)
     fix r::"'a event list"
     define f where "f= (\<lambda>((t::'a event list), (u::'a event list)). (t,u,r))"
     hence "?P r \<subseteq> (f ` {(t, u). r setinterleaves ((t, u), insert tick (ev ` A) )})" 
       by auto
     then show "finite (?P r)" 
       using inters_fin_fund[of r "insert tick (ev ` A)"] finite_imageI[of "{(t, u). r setinterleaves 
       ((t, u), insert tick (ev ` A))}" f]  by (meson rev_finite_subset)   
   qed
   have "{t. \<exists>t2. x = t @ t2} = {r. \<exists>ra. r @ ra = x}" 
     by blast
   hence "finite {r. r \<le> x}" using prefixes_fin[of x, simplified Let_def, THEN conjunct1] 
     by (auto simp add:le_list_def) 
   with a b show ?thesis 
     by (meson finite_UN_I infinite_super)
 qed  
 
  
 lemma limproc_Sync_D: 
   "chain Y\<Longrightarrow> \<D> (lim_proc(range Y)\<lbrakk>A\<rbrakk> S) = \<D>(lim_proc(range(\<lambda>i. Y i \<lbrakk>A\<rbrakk> S)))" 
   apply(auto simp:Process_eq_spec  F_Sync D_Sync T_Sync F_LUB D_LUB T_LUB chain_Sync1) 
       apply blast 
      apply blast 
     using front_tickFree_Nil apply blast
     using front_tickFree_Nil apply blast 
   proof - 
     fix x
     assume A: "chain Y"
     and B: " \<forall>xa. \<exists>t u r v. front_tickFree v \<and> (tickFree r \<or> v = []) \<and> 
                             x = r @ v \<and> r setinterleaves ((t, u), insert tick (ev ` A)) \<and> 
                             (t \<in> \<D> (Y xa) \<and> u \<in> \<T> S \<or> t \<in> \<D> S \<and> u \<in> \<T> (Y xa))"
     thus   "\<exists>t u r v. front_tickFree v \<and> (tickFree r \<or> v = []) \<and> x = r @ v \<and> 
                       r setinterleaves ((t, u), insert tick (ev ` A)) \<and> 
                       ((\<forall>x. t \<in> \<D> (Y x)) \<and> u \<in> \<T> S \<or> t \<in> \<D> S \<and> (\<forall>x. u \<in> \<T> (Y x)))" 
     proof(cases "\<forall>t u r. r setinterleaves ((t, u), insert tick (ev ` A)) \<longrightarrow>
                           (r\<le>x \<longrightarrow> ((\<exists>x. t \<notin> \<D> (Y x)) \<or> u \<notin> \<T> S) \<and> 
                            (t \<in> \<D> S \<longrightarrow> (\<exists>x. u \<notin> \<T> (Y x))))") 
       case True 
       from A obtain tryunion where Ctryy: 
                 "tryunion={(t, u, r). r setinterleaves ((t, u), insert tick (ev ` A)) \<and>
                                       (\<exists>v.(x = r @ v \<and> front_tickFree v \<and> (tickFree r \<or> v = [])))}" 
         by simp
       from Ctryy inters_fin have tolfin: "finite tryunion" 
         by auto
       obtain tryunion1 
         where Ctryy1: "tryunion1 = {n. \<exists>(t,u, r) \<in> tryunion.
                                          (t \<in> \<D> (Y n) \<and> u \<in> \<T> S \<or> t \<in> \<D> S \<and> u \<in> \<T> (Y n))}" by simp
       from B Ctryy1 Ctryy have Ctryy3: "\<forall>n. n\<in>tryunion1"  
         by blast  
       from Ctryy3 have Ctryy2: "infinite tryunion1"   
         using finite_nat_set_iff_bounded by auto  
       from Ctryy2 Ctryy1 tolfin obtain  r2 t2 u2 
         where Ee: "(t2,u2, r2) \<in> tryunion \<and> 
                    infinite {n. (t2 \<in> \<D> (Y n) \<and> u2 \<in> \<T> S \<or> t2 \<in> \<D> S \<and> u2 \<in> \<T> (Y n))}"  
         by auto
       from True Ee  Ctryy obtain x1 x2 
         where Ee1: "((t2 \<notin> \<D> (Y x1)) \<or> u2 \<notin> \<T> S) \<and> (t2 \<in> \<D> S \<longrightarrow>  (u2 \<notin> \<T> (Y x2)))" 
         apply (simp add: le_list_def) by blast       
       from Ee Ee1 Ctryy obtain x3 
         where Ee2: "(x1\<le>x3) \<and> (x2\<le>x3) \<and> (t2 \<in> \<D> (Y x3) \<and> u2 \<in> \<T> S \<or> t2 \<in> \<D> S \<and> u2 \<in> \<T> (Y x3))"  
         apply(simp add: infinite_nat_iff_unbounded_le)  
       proof - 
         assume a1: "r2 setinterleaves ((t2, u2), insert tick (ev ` A)) \<and> 
                     (\<exists>v. x = r2 @ v \<and> front_tickFree v \<and> (tickFree r2 \<or> v = [])) \<and> 
                     ((\<forall>m. \<exists>n\<ge>m. t2 \<in> \<D> (Y n) \<and> u2 \<in> \<T> S) \<or> 
                      (\<forall>m. \<exists>n\<ge>m. t2 \<in> \<D> S \<and> u2 \<in> \<T> (Y n)))"
         assume a2: "\<And>x3. x1 \<le> x3 \<and> x2 \<le> x3\<and>(t2 \<in> \<D> (Y x3) \<and> u2 \<in> \<T> S \<or> t2 \<in> \<D> S \<and> u2 \<in> \<T> (Y x3)) 
                     \<Longrightarrow> thesis"
         obtain nn :: "nat \<Rightarrow> nat" 
           where f3: "\<forall>x0. (\<exists>v1\<ge>x0. t2 \<in> \<D> S \<and> u2 \<in> \<T> (Y v1)) = 
                           (x0 \<le> nn x0 \<and> t2 \<in> \<D> S \<and> u2 \<in> \<T> (Y (nn x0)))" by moura
         obtain nna :: "nat \<Rightarrow> nat" 
           where "\<forall>x0. (\<exists>v1\<ge>x0. t2 \<in> \<D> (Y v1) \<and> u2 \<in> \<T> S) = 
                       (x0 \<le> nna x0 \<and> t2 \<in> \<D> (Y (nna x0)) \<and> u2 \<in> \<T> S)" by moura
         then have f4: "(\<forall>n. n \<le> nna n \<and> t2 \<in> \<D> (Y (nna n)) \<and> u2 \<in> \<T> S) \<or> 
                        (\<forall>n. n \<le> nn n \<and> t2 \<in> \<D> S \<and> u2 \<in> \<T> (Y (nn n)))" using f3 a1 by presburger
         have "(\<exists>n. \<not> n \<le> nn n \<or> t2 \<notin> \<D> S \<or> u2 \<notin> \<T> (Y (nn n))) \<or> 
               (\<exists>n\<ge>x1. x2 \<le> n \<and> (t2 \<in> \<D> (Y n) \<and> 
                       u2 \<in> \<T> S \<or> t2 \<in> \<D> S \<and> u2 \<in> \<T> (Y n)))" by (metis le_cases order.trans) 
         moreover 
         { assume "\<exists>n. \<not> n \<le> nn n \<or> t2 \<notin> \<D> S \<or> u2 \<notin> \<T> (Y (nn n))"
           then have "\<forall>n. n \<le> nna n \<and> t2 \<in> \<D> (Y (nna n)) \<and> u2 \<in> \<T> S" 
             using f4 by blast
           then have "\<exists>n\<ge>x1. x2 \<le> n \<and> (t2 \<in> \<D> (Y n) \<and> u2 \<in> \<T> S \<or> t2 \<in> \<D> S \<and> u2 \<in> \<T> (Y n))"
             by (metis (no_types) le_cases order.trans) 
         } 
         ultimately show ?thesis 
           using a2 by blast 
       qed 
       from A have Abb1: "\<forall>n1 n2. n1\<le>n2 \<longrightarrow> Y n1 \<sqsubseteq> Y n2" 
         by (simp add: po_class.chain_mono)
       from A Abb1 have Abb2: "\<forall>n1 n2. n1>n2 \<and> t \<notin> \<D> (Y n2) \<longrightarrow> t \<notin> \<D> (Y n1)" 
         using le_approx1 less_imp_le_nat by blast
       from A Abb1 have Abb3: "\<forall>n1 n2. n1>n2 \<and> t \<notin> \<T> (Y n2) \<longrightarrow> t \<notin> \<T> (Y n1)"  
         by (meson NT_ND le_approx2T less_imp_le_nat)
       from Abb2 Ee2 have Ab1: "t2 \<notin> \<D> (Y x1)\<longrightarrow>t2 \<notin> \<D> (Y x3)"  
         by (meson Abb1 le_approx1 less_imp_le_nat subsetCE)
       from Abb3 have Ab2: "u2 \<notin> \<T> (Y x2)\<longrightarrow>u2 \<notin> \<T> (Y x3)"  
         by (meson Abb1 Ee2 NT_ND le_approx2T less_imp_le_nat)
       from True Ee Ee1  Ee2 Ab1 Ab2 show ?thesis  
         by blast 
     next 
       case False 
       from A B False obtain t u r 
         where Bb1: "r setinterleaves ((t, u), insert tick (ev ` A)) \<and> r \<le> x \<and> 
                     ((\<forall>x. t \<in> \<D> (Y x)) \<and> u \<in> \<T> S \<or> t \<in> \<D> S \<and> (\<forall>x. u \<in> \<T> (Y x)))"   
         by auto
       from B have Bb21: "front_tickFree x"  
         by (metis D_imp_front_tickFree append_Nil2 front_tickFree_append ftf_Sync is_processT2_TR)
       from B Bb1 have Bb2: "\<exists>v. front_tickFree v \<and> (tickFree r \<or> v = [])\<and> x = r @ v"  
         by (metis Bb21 front_tickFree_Nil front_tickFree_mono le_list_def)  
       then show ?thesis  
         using Bb1 by blast  
     qed  
   qed  
    
 
 lemma limproc_Sync_F_annex1: 
   " chain Y
     \<Longrightarrow> \<forall>n. (a, b) \<in> \<F> (Y n \<lbrakk>A\<rbrakk> S) 
     \<Longrightarrow> \<exists>x. a \<notin> \<D> (Y x \<lbrakk>A\<rbrakk> S) 
     \<Longrightarrow> \<exists>t u X. (\<forall>x. (t, X) \<in> \<F> (Y x)) \<and> 
                 (\<exists>Y. (u, Y) \<in> \<F> S \<and> a setinterleaves((t, u),insert tick (ev ` A)) \<and> 
                 b = (X \<union> Y) \<inter> insert tick (ev ` A) \<union> X \<inter> Y)"
 proof - 
   fix a b
   assume A: "chain Y"
   assume B: "\<forall>n. (a, b) \<in> \<F> (Y n \<lbrakk>A\<rbrakk> S)"
   assume C: "\<exists>x. a \<notin> \<D> (Y x \<lbrakk>A\<rbrakk> S)"
   thus "\<exists>t u X. (\<forall>x. (t, X) \<in> \<F> (Y x)) \<and>
                 (\<exists>Y. (u, Y) \<in> \<F> S \<and> 
                      a setinterleaves ((t, u), insert tick (ev ` A)) \<and> 
                      b = (X \<union> Y) \<inter> insert tick (ev ` A) \<union> X \<inter> Y)" 
   proof- 
     from B C obtain x1 where D: "a \<notin> \<D> (Y x1 \<lbrakk>A\<rbrakk> S)" 
       by blast
     from B D obtain t1 u1 X1 Y1 where E: 
          "a setinterleaves ((t1, u1), insert tick (ev ` A)) \<and>
          (t1, X1) \<in> \<F> (Y x1) \<and> (u1, Y1) \<in> \<F> S \<and> 
          b = (X1 \<union> Y1) \<inter> insert tick (ev ` A) \<union> X1 \<inter> Y1" 
       apply(auto simp: D_Sync F_Sync) 
       by fastforce
     from B D E have F: "t1 \<notin> \<D> (Y x1) \<and> t1 \<in> \<T>(Y x1)" apply(auto simp: D_Sync)  
       using F_T front_tickFree_Nil apply blast  
       by (simp add: F_T)
     from F have ee: "\<forall>i. (t1, X1) \<in> \<F> (Y i)\<and>(u1, Y1)\<in> \<F> S\<and> a setinterleaves 
     ((t1, u1), insert tick (ev ` A))\<and> b = (X1 \<union> Y1) \<inter> insert tick (ev ` A) \<union> X1 \<inter> Y1"  
       using E chain_lemma is_processT8_S le_approx2 local.A by metis
     with A B C D E F ee  show?thesis 
       by blast 
   qed
 qed
 
 lemma limproc_Sync_F_annex2: 
  "chain Y 
   \<Longrightarrow> \<forall>t u r. r setinterleaves ((t, u), insert tick (ev ` A)) \<longrightarrow>
       (\<forall>v. a = r @ v \<longrightarrow> front_tickFree v \<longrightarrow> 
            \<not> tickFree r \<and> v \<noteq> [] \<or> ((\<exists>x. t \<notin> \<D> (Y x)) \<or> u \<notin> \<T> S) \<and> 
            (t \<in> \<D> S \<longrightarrow> (\<exists>x. u \<notin> \<T> (Y x))))
   \<Longrightarrow> \<exists>x. a \<notin> \<D>(Y x \<lbrakk> A \<rbrakk> S)" 
   apply(auto simp: D_Sync) 
 proof-
   fix a
   assume A: "\<forall>t u r. r setinterleaves ((t, u), insert tick (ev ` A)) \<longrightarrow> 
                      (\<forall>v. a = r @ v \<longrightarrow>  front_tickFree v \<longrightarrow> 
                           \<not> tickFree r \<and> v \<noteq> [] \<or> 
                          ((\<exists>x. t \<notin> \<D> (Y x)) \<or> u \<notin> \<T> S) \<and> (t \<in> \<D> S \<longrightarrow>  (\<exists>x. u \<notin> \<T> (Y x))))"
   assume B: "chain Y"
   thus "\<exists>x. \<forall>t u r. r setinterleaves ((t, u), insert tick (ev ` A)) \<longrightarrow>
            (\<forall>v. a = r @ v \<longrightarrow>  front_tickFree v \<longrightarrow> 
            \<not> tickFree r\<and>v\<noteq>[] \<or> (t \<in> \<D> (Y x) \<longrightarrow> u \<notin> \<T> S) \<and> (t \<in> \<D> S \<longrightarrow> u \<notin> \<T> (Y x)))" 
   proof- 
     from B have D: "((\<exists>x. t \<notin> \<D> (Y x)) \<or> u \<notin> \<T> S) \<and> (t \<in> \<D> S \<longrightarrow> (\<exists>x. u \<notin> \<T> (Y x)))
                     \<Longrightarrow>  (\<exists>x. ((t \<in> \<D> (Y x) \<longrightarrow> u \<notin> \<T> S) \<and> (t \<in> \<D> S \<longrightarrow> u \<notin> \<T> (Y x))))" 
       by (meson D_T chain_lemma le_approx1 le_approx2T subsetCE)
     from A obtain tryunion 
       where Ctryy: "tryunion={(t, u, r). r setinterleaves ((t, u), insert tick (ev ` A)) \<and>
                     (\<exists>v. a = r @ v \<and> front_tickFree v \<and> (tickFree r \<or> v = []))}" 
       by simp
     from Ctryy have tolfin: "finite tryunion" 
       using inters_fin by auto 
     from B have Abb1: "\<forall>n1 n2. n1\<le>n2 \<longrightarrow> Y n1 \<sqsubseteq> Y n2"  
       by (simp add: po_class.chain_mono)
    from A Abb1 have Abb2: "\<forall>n1 n2 t. n1>n2\<and>t \<notin> \<D> (Y n2)\<longrightarrow>t \<notin> \<D> (Y n1)" 
       using le_approx1 less_imp_le_nat by blast
    from A Abb1 have Abb3: "\<forall>n1 n2 t. n1>n2\<and>t \<notin> \<T> (Y n2)\<longrightarrow>t \<notin> \<T> (Y n1)"  
       by (meson NT_ND le_approx2T less_imp_le_nat)
     from Abb2 Abb3 
     have oneIndexPre: "\<forall>t u. ((\<exists>x. t \<notin> \<D> (Y x)) \<or> u \<notin> \<T> S) \<and> (t \<in> \<D> S \<longrightarrow> 
                              (\<exists>x. u \<notin> \<T> (Y x))) \<longrightarrow>
                              (\<exists>x. (t \<notin> \<D> (Y x) \<or> u \<notin> \<T> S) \<and> (t \<in> \<D> S \<longrightarrow> u \<notin> \<T> (Y x)))"
       by (meson B D_T ND_F_dir2' chain_lemma le_approx1 subsetCE)  
     from A B oneIndexPre Abb2 Abb3  
     have oneIndex: "\<forall>t u r. r setinterleaves ((t, u), insert tick (ev ` A)) \<longrightarrow> 
                             (\<forall>v. a = r @ v \<longrightarrow>front_tickFree v \<longrightarrow> \<not> tickFree r\<and>v\<noteq>[] \<or>
                             ( \<exists>x.( (( t \<notin> \<D> (Y x)) \<or> u \<notin> \<T> S) \<and> (t \<in> \<D> S \<longrightarrow> (u \<notin> \<T> (Y x))))))" by blast
     define proUnion1 
       where finiUnion: "proUnion1 = {n. \<exists>(t,u, r)\<in>tryunion. (((t \<in> \<D> (Y n) \<longrightarrow> u \<notin> \<T> S) \<and> 
                                             (t \<in> \<D> S \<longrightarrow> u \<notin> \<T> (Y n)))\<and> 
                                             (\<forall>m. ( (t \<in> \<D> (Y m)\<longrightarrow>u \<notin> \<T> S) \<and> 
                                                    (t \<in> \<D> S\<longrightarrow>u \<notin> \<T> (Y m)))\<longrightarrow>n\<le>m))}"
     from B 
     have finiSet1: "\<And>r t u. (t,u, r) \<in> tryunion 
                              \<Longrightarrow> finite {n1.(((t \<in> \<D> (Y n1)\<longrightarrow>u \<notin> \<T> S) \<and> 
                                  (t\<in>\<D> S\<longrightarrow>u\<notin>\<T>(Y n1)))\<and>(\<forall>m1. ((t \<in> \<D> (Y m1) \<longrightarrow>
                                      u \<notin> \<T> S) \<and> (t \<in> \<D> S \<longrightarrow> u \<notin> \<T> (Y m1)))\<longrightarrow>n1\<le>m1))}"  
      by (metis (no_types, lifting) infinite_nat_iff_unbounded mem_Collect_eq not_less)
    from B tolfin finiUnion oneIndex finiSet1  have finiSet: "finite proUnion1"  
      by auto   
    from finiSet obtain proMax where ann: "proMax=Max(proUnion1)"  
      by blast   
    from ann Abb2 have ann1: "\<forall>num\<in>proUnion1. \<forall>t. t \<notin> \<D> (Y num)\<longrightarrow>t \<notin> \<D> (Y proMax)"  
      by (meson Abb1 Max_ge finiSet le_approx1 subsetCE)    
    from ann Abb3 have ann2: "\<forall>num\<in>proUnion1.  \<forall>t. t \<notin> \<T> (Y num)\<longrightarrow>t \<notin> \<T> (Y proMax)"  
      by (meson Abb1 D_T Max_ge finiSet le_approx2T)
    from finiUnion 
    have ann3: "\<forall>num\<in>proUnion1. \<exists>r t u. r setinterleaves((t, u),insert tick (ev ` A)) \<longrightarrow> 
                                    (\<forall>v. a = r @ v \<longrightarrow>front_tickFree v \<longrightarrow> 
                                          \<not> tickFree r \<and> v \<noteq> [] \<or>(( ((t\<notin>\<D>(Y num))\<or>u \<notin> \<T> S) \<and> 
                                          (t \<in> \<D> S \<longrightarrow> (u \<notin> \<T> (Y num))))))" by auto
    obtain proUnion2 
      where ann0: "proUnion2 ={(t, u, r).\<exists>n. (t, u, r) \<in> tryunion \<and>
                                             ((t \<in> \<D> (Y n)\<longrightarrow>u \<notin> \<T> S) \<and> 
                                             (t \<in> \<D> S \<longrightarrow> u \<notin> \<T> (Y n)))}" by auto 
    from ann0 Ctryy finiUnion 
    have ann1: "\<And>t u r.  (t, u, r)\<in> proUnion2
                         \<Longrightarrow>\<exists>num. num\<in>proUnion1 \<and> ((t \<in> \<D> (Y num) \<longrightarrow> u \<notin> \<T> S) \<and> 
                                  (t \<in> \<D> S \<longrightarrow> u \<notin> \<T> (Y num)))"    
    proof- 
      fix t u r
      assume a:  "(t, u, r)\<in> proUnion2"
      define P where PP:"P = (\<lambda>num. ((t \<in> \<D> (Y num) \<longrightarrow> u \<notin> \<T> S) \<and> (t \<in> \<D> S \<longrightarrow> u \<notin> \<T> (Y num))))"
      thus "\<exists>num. num\<in>proUnion1\<and> P num" 
      proof- 
        from finiUnion obtain minIndexRB where ann1preB: "minIndexRB={n. (P n)}" 
          by auto
        from B ann1preB obtain minmin where ab: "(minmin::nat) = Inf (minIndexRB)" 
          by auto
        from ann0 ann1preB PP have ann1preNoEmpty1: "minIndexRB \<noteq> {}" 
          using a by blast
        from ab ann1preNoEmpty1 have ann1pre0:"minmin \<in> minIndexRB" 
          using Inf_nat_def wellorder_Least_lemma(1) by force        
        have "minmin\<in> {n. \<exists>t u r. (t,u,r)\<in>tryunion \<and> ((t \<in> \<D> (Y n) \<longrightarrow> u \<notin> \<T> S) \<and> 
                                  (t \<in> \<D> S \<longrightarrow> u \<notin> \<T> (Y n))) \<and> (\<forall>m. (t \<in> \<D> (Y m) \<longrightarrow> 
                                    u \<notin> \<T> S) \<and> (t \<in> \<D> S \<longrightarrow> u \<notin> \<T> (Y m)) \<longrightarrow> n \<le> m)}"  
          apply(rule CollectI,rule_tac x=t in exI,rule_tac x=u in exI,rule_tac x=r in exI,intro conjI)
             using a ann0 apply blast          
            using PP ann1pre0 ann1preB apply blast
            using PP ann1pre0 ann1preB apply blast 
           by (simp add: Inf_nat_def PP ab ann1preB wellorder_Least_lemma(2)) 
        then show ?thesis  
          using ann1pre0 ann1preB finiUnion by blast 
      qed 
    qed 
    from ann1 
    have ann12: "\<forall>t u r. \<exists>num.(t, u, r) \<in> proUnion2 \<longrightarrow> num\<in>proUnion1 \<and>
                              ((t \<in> \<D> (Y num) \<longrightarrow> u \<notin> \<T> S) \<and> (t \<in> \<D> S \<longrightarrow> u \<notin> \<T> (Y num)))" by auto
    from ann0 Ctryy 
    have ann2: "\<forall>t u r. (t, u, r) \<in> proUnion2 \<longrightarrow> 
                         (r setinterleaves ((t, u), insert tick (ev ` A)) \<and>
                         (\<exists>v. a = r @ v \<and> front_tickFree v \<and> (tickFree r \<or> v = [])) \<and> 
                         (\<exists>nu1. (t \<in> \<D> (Y nu1) \<longrightarrow> u \<notin> \<T> S) \<and> (t \<in> \<D> S \<longrightarrow> u \<notin> \<T> (Y nu1))))" by simp 
    have ann15: "\<forall>t u r. (r setinterleaves ((t, u), insert tick (ev ` A)) \<and> 
                          (\<exists>v. a = r @ v \<and> front_tickFree v \<and> (tickFree r \<or> v = [])) \<and> 
                          (\<exists>nu1. (t \<in> \<D> (Y nu1) \<longrightarrow> u \<notin> \<T> S) \<and> (t \<in> \<D> S \<longrightarrow> u \<notin> \<T> (Y nu1)))) \<longrightarrow>
                                 (t, u, r) \<in> proUnion2"  
      using Ctryy ann0 by blast   
    from  ann12 ann15 
    have ann01: "\<forall>t u r. ((r setinterleaves ((t, u), insert tick (ev ` A)) \<and>
                         (\<exists>v. a = r @ v \<and> front_tickFree v \<and> (tickFree r \<or> v = [])) \<and> 
                         (\<exists>nu1. (t \<in> \<D> (Y nu1)\<longrightarrow>u \<notin> \<T> S) \<and> 
                         (t \<in> \<D> S \<longrightarrow> u \<notin> \<T> (Y nu1))))\<longrightarrow>
                            (\<exists>num\<in>proUnion1. ((t \<in> \<D> (Y num) \<longrightarrow> u \<notin> \<T> S) \<and> 
                               (t \<in> \<D> S \<longrightarrow> u \<notin> \<T> (Y num)))))"    by blast  
    from ann01  
    have annhelp: "\<forall>t u r. r setinterleaves ((t, u), insert tick (ev ` A)) \<longrightarrow>
                   (\<forall>v. a = r @ v \<longrightarrow> front_tickFree v \<longrightarrow>(tickFree r \<or> v = [])\<longrightarrow>
                   (\<exists>num\<in>proUnion1.((t \<in> \<D> (Y num) \<longrightarrow> u \<notin> \<T> S) \<and> (t \<in> \<D> S \<longrightarrow> u \<notin> \<T> (Y num)))))"
      by (metis oneIndex)     
    from Abb1 Abb2 
    have annHelp2: "\<forall>nn t u.
                       nn \<in> proUnion1 \<and> (t \<in> \<D> (Y nn) \<longrightarrow> u \<notin> \<T> S) \<and> (t \<in> \<D> S \<longrightarrow> u \<notin> \<T> (Y nn)) \<longrightarrow>
                       (t \<in> \<D> (Y proMax) \<longrightarrow> u \<notin> \<T> S) \<and> (t \<in> \<D> S \<longrightarrow> u \<notin> \<T> (Y proMax))" 
      by (metis Abb3 Max_ge ann finiSet le_neq_trans) 
    from  annHelp2 annhelp 
    have annHelp1: "\<forall>t u r.
                        r setinterleaves ((t, u), insert tick (ev ` A)) \<longrightarrow>
                        (\<forall>v. a = r @ v \<longrightarrow>
                             front_tickFree v \<longrightarrow>
                             tickFree r \<or> v = [] \<longrightarrow> (t \<in> \<D> (Y proMax) \<longrightarrow> u \<notin> \<T> S) \<and> 
                                                     (t \<in> \<D> S \<longrightarrow> u \<notin> \<T> (Y proMax)))" by blast       
    with A B  show ?thesis  
      by blast 
  qed 
 qed
 
 lemma limproc_Sync_F: 
  "chain Y \<Longrightarrow> \<F>(lim_proc (range Y)\<lbrakk> A \<rbrakk>S) = \<F>(lim_proc (range (\<lambda>i. Y i \<lbrakk> A \<rbrakk> S)))" 
   apply(auto simp add: Process_eq_spec D_Sync F_Sync F_LUB D_LUB T_LUB chain_Sync1) 
        apply blast 
       apply blast 
      apply blast 
     using front_tickFree_Nil apply blast
    using front_tickFree_Nil apply blast     
   proof- 
     fix a b
     assume A1: " \<forall>x. (\<exists>t u X. (t, X) \<in> \<F> (Y x) \<and> 
                               (\<exists>Y. (u, Y) \<in> \<F> S \<and> 
                               a setinterleaves ((t, u), insert tick (ev ` A)) \<and> 
                               b = (X \<union> Y) \<inter> insert tick (ev ` A) \<union> X \<inter> Y)) \<or>
                      (\<exists>t u r v. front_tickFree v \<and> (tickFree r \<or> v = []) \<and>  a = r @ v \<and> 
                               r setinterleaves ((t, u), insert tick (ev ` A)) \<and> 
                               (t \<in> \<D> (Y x) \<and> u \<in> \<T> S \<or> t \<in> \<D> S \<and> u \<in> \<T> (Y x)))"
     and B: " \<forall>t u r. r setinterleaves ((t, u), insert tick (ev ` A)) \<longrightarrow> 
                      (\<forall>v. a = r @ v \<longrightarrow>  front_tickFree v \<longrightarrow> 
                          \<not> tickFree r \<and> v \<noteq> [] \<or> 
                          ((\<exists>x. t \<notin> \<D> (Y x)) \<or> u \<notin> \<T> S) \<and> (t \<in> \<D> S \<longrightarrow>  (\<exists>x. u \<notin> \<T> (Y x))))"
     and C: "chain Y"
     thus  "\<exists>t u X. (\<forall>x. (t, X) \<in> \<F> (Y x)) \<and>(\<exists>Y. (u, Y) \<in> \<F> S \<and> a setinterleaves 
     ((t, u), insert tick (ev ` A)) \<and> b = (X \<union> Y) \<inter> insert tick (ev ` A) \<union> X \<inter> Y)" 
     proof (cases "\<exists>m. a \<notin> \<D>(Y m \<lbrakk> A \<rbrakk> S)") 
       case True 
       then obtain m where "a \<notin> \<D>(Y m \<lbrakk> A \<rbrakk> S)" 
         by blast
       with A1 have D: "\<forall>n. (a, b)\<in> \<F> (Y n \<lbrakk> A \<rbrakk> S)"
         by (auto simp: F_Sync)
       with A1 B C  show ?thesis 
         apply(erule_tac x=m in allE)    
         apply(frule limproc_Sync_F_annex2) 
          apply simp 
         by(simp add: limproc_Sync_F_annex1) 
     next 
       case False
       with False have E: "\<forall>n.  a \<in> \<D> (Y n \<lbrakk> A \<rbrakk> S)" 
         by blast
       with C E B show ?thesis 
         apply auto 
         apply(drule limproc_Sync_F_annex2) 
          apply blast 
         by fast 
     qed 
   qed
   
 lemma cont_left_Sync : "chain Y \<Longrightarrow> ((\<Squnion> i. Y i) \<lbrakk> A \<rbrakk> S) = (\<Squnion> i. (Y i \<lbrakk> A \<rbrakk> S))"
   by(simp add: Process_eq_spec chain_Sync1 limproc_Sync_D limproc_Sync_F limproc_is_thelub) 
   
 lemma cont_right_Sync : "chain Y \<Longrightarrow> (S \<lbrakk> A \<rbrakk> (\<Squnion> i. Y i)) = (\<Squnion> i. (S \<lbrakk> A \<rbrakk> Y i))"
   by (metis (no_types, lifting) Process_eq_spec cont_left_Sync lub_eq mono_D_Sync mono_F_Sync)
 
 lemma Sync_cont[simp]: 
 assumes f:"cont f" 
 and     g:"cont g"
 shows     "cont (\<lambda>x. (f x) \<lbrakk>A\<rbrakk> (g x))" 
 proof - 
   have A : "\<And>x. cont g \<Longrightarrow> cont (\<lambda>y. y \<lbrakk>A\<rbrakk> (g x))" 
     apply (rule contI2, rule monofunI) 
      apply(auto) 
     by (simp add: cont_left_Sync)
   have B : "\<And>y. cont g \<Longrightarrow> cont (\<lambda>x. y \<lbrakk>A\<rbrakk> g x)" 
     apply(rule_tac c="(\<lambda> x. y  \<lbrakk>A\<rbrakk> x)" in cont_compose) 
      apply(rule contI2, rule monofunI) 
       apply (simp) 
      apply (simp add: cont_right_Sync) 
     by simp 
   show ?thesis using f g  
     apply(rule_tac  f="(\<lambda>x. (\<lambda> f. f \<lbrakk>A\<rbrakk> g x))" in cont_apply) 
     by(auto intro:contI2 simp:A B)
 qed 
 
 
 
 end
diff --git a/thys/HOL-CSP/document/root.tex b/thys/HOL-CSP/document/root.tex
--- a/thys/HOL-CSP/document/root.tex
+++ b/thys/HOL-CSP/document/root.tex
@@ -1,64 +1,63 @@
 \documentclass[11pt,a4paper]{book}
-\usepackage[T1]{fontenc}
 \usepackage{isabelle,isabellesym}
 \usepackage{graphicx}
 \graphicspath {{figures/}}
 
 % further packages required for unusual symbols (see also
 % isabellesym.sty), use only when needed
 
 
 \usepackage{latexsym}
 \usepackage{amssymb}
   %for \<leadsto>, \<box>, \<diamond>, \<sqsupset>, \<mho>, \<Join>,
   %\<lhd>, \<lesssim>, \<greatersim>, \<lessapprox>, \<greaterapprox>,
   %\<triangleq>, \<yen>, \<lozenge>
 
 %\usepackage[greek,english]{babel}
   %option greek for \<euro>
   %option english (default language) for \<guillemotleft>, \<guillemotright>
 
-%\usepackage[utf8]{inputenc}
+%\usepackage[latin1]{inputenc}
   %for \<onesuperior>, \<onequarter>, \<twosuperior>, \<onehalf>,
   %\<threesuperior>, \<threequarters>, \<degree>
 
 %\usepackage[only,bigsqcap]{stmaryrd}
   %for \<Sqinter>
 
 %\usepackage{eufrak}
   %for \<AA> ... \<ZZ>, \<aa> ... \<zz> (also included in amssymb)
 
 %\usepackage{textcomp}
   %for \<cent>, \<currency>
 
 % this should be the last package used
 \usepackage{pdfsetup}
 
 % urls in roman style, theory text in math-similar italics
 \urlstyle{rm}
 \isabellestyle{it}
 
 \begin{document}
 
 \title{HOL-CSP Version 2.0}
-\author{ Safouan Taha \and Burkhart Wolff \and Lina Ye }
+\author{ Benoit Ballenghien \and Safouan Taha \and Burkhart Wolff \and Lina Ye }
 \maketitle
 
 \tableofcontents
 
 % sane default for proof documents
 \parindent 0pt\parskip 0.5ex
 
 % generated text of all theories
 \input{session}
 
 % optional bibliography
 \bibliographystyle{abbrv}
 \bibliography{adb-long,root}
 
 \end{document}
 
 %%% Local Variables:
 %%% mode: latex
 %%% TeX-master: t
 %%% End: